@forgezero/agent 0.1.91 → 0.1.94

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.91";
+var VERSION3 = "0.1.94";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.91";
+var VERSION = "0.1.94";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3088,6 +3088,7 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
@@ -3193,7 +3194,7 @@ function validatePlatformSharedEnvironment(input) {
   if (input.otlpEndpoint !== "http://127.0.0.1:4318")
     throw new Error("OTLP must use the exact local collector endpoint.");
   validateCollectorUnit(input.otlpCollectorUnit);
-  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  agentTelemetryOrigin(input.agentOtlpEndpoint);
   for (const [name, value] of Object.entries({
     nodeHostname: input.nodeHostname,
     nodeRegion: input.nodeRegion,
@@ -3238,7 +3239,7 @@ function validatePlatformSharedEnvironment(input) {
     databaseReadPreferredCoordinators: readPreferred,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    agentOtlpEndpoint: agentTelemetryOrigin(input.agentOtlpEndpoint),
     ...initialInventory ? { initialInventory } : {}
   };
 }
@@ -3514,6 +3515,7 @@ function planLocalOtlpProof(endpoint2, collectorUnit) {
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
 var FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
 var FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+var LOCAL_DEBUG_OTEL_EXPORT = "local-debug";
 var ARCHIVE = "/run/forgezero-otelcol.tar.gz";
 var EXTRACT = "/run/forgezero-otelcol-release";
 var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
@@ -3539,7 +3541,9 @@ var destination = (value) => {
   return url.toString().replace(/\/$/, "");
 };
 function renderForgeZeroOtelCollector(exportEndpoint) {
-  const endpoint2 = destination(exportEndpoint);
+  const exporter = exportEndpoint === LOCAL_DEBUG_OTEL_EXPORT ? { definition: `  debug:
+    verbosity: basic`, name: "debug" } : { definition: `  otlp_http:
+    endpoint: ${JSON.stringify(destination(exportEndpoint))}`, name: "otlp_http" };
   return {
     config: `receivers:
   otlp:
@@ -3547,19 +3551,18 @@ function renderForgeZeroOtelCollector(exportEndpoint) {
       http:
         endpoint: 127.0.0.1:4318
 exporters:
-  otlp_http:
-    endpoint: ${JSON.stringify(endpoint2)}
+${exporter.definition}
 service:
   pipelines:
     traces:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     metrics:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     logs:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
 `,
     unit: `[Unit]
 Description=ForgeZero independently supervised OpenTelemetry Collector
@@ -3639,7 +3642,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -3816,14 +3820,20 @@ function validateBootstrapConfig(value) {
   if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?){2,}$/.test(value.nodeHostname)) {
     throw new Error("node hostname must be a lowercase public FQDN");
   }
-  let telemetry;
-  try {
-    telemetry = new URL(value.telemetryEndpoint);
-  } catch {
-    throw new Error("telemetry endpoint is malformed");
-  }
-  if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
-    throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+  if (value.telemetryEndpoint === LOCAL_DEBUG_OTEL_EXPORT) {
+    if (value.kind !== "platform" || value.environment !== "development") {
+      throw new Error("local debug telemetry is allowed only for the development platform profile");
+    }
+  } else {
+    let telemetry;
+    try {
+      telemetry = new URL(value.telemetryEndpoint);
+    } catch {
+      throw new Error("telemetry endpoint is malformed");
+    }
+    if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
+      throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+    }
   }
   const deploymentCredentials = value.deploymentCredentials ?? {};
   if (!deploymentCredentials || typeof deploymentCredentials !== "object" || Array.isArray(deploymentCredentials) || Object.keys(deploymentCredentials).length > 64) {

package/dist/fz-agent.js

@@ -9496,7 +9496,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.91";
+var VERSION2 = "0.1.94";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4810,7 +4810,8 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync13, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync13, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
+import { randomBytes as randomBytes10 } from "crypto";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
 
 // src/process-input.ts
@@ -4840,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.91";
+var VERSION2 = "0.1.94";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12236,6 +12237,7 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
@@ -12341,7 +12343,7 @@ function validatePlatformSharedEnvironment(input) {
   if (input.otlpEndpoint !== "http://127.0.0.1:4318")
     throw new Error("OTLP must use the exact local collector endpoint.");
   validateCollectorUnit(input.otlpCollectorUnit);
-  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  agentTelemetryOrigin(input.agentOtlpEndpoint);
   for (const [name, value] of Object.entries({
     nodeHostname: input.nodeHostname,
     nodeRegion: input.nodeRegion,
@@ -12386,7 +12388,7 @@ function validatePlatformSharedEnvironment(input) {
     databaseReadPreferredCoordinators: readPreferred,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    agentOtlpEndpoint: agentTelemetryOrigin(input.agentOtlpEndpoint),
     ...initialInventory ? { initialInventory } : {}
   };
 }
@@ -13740,6 +13742,7 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
 var FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
 var FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+var LOCAL_DEBUG_OTEL_EXPORT = "local-debug";
 var ARCHIVE = "/run/forgezero-otelcol.tar.gz";
 var EXTRACT = "/run/forgezero-otelcol-release";
 var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
@@ -13765,7 +13768,9 @@ var destination = (value) => {
   return url.toString().replace(/\/$/, "");
 };
 function renderForgeZeroOtelCollector(exportEndpoint) {
-  const endpoint2 = destination(exportEndpoint);
+  const exporter = exportEndpoint === LOCAL_DEBUG_OTEL_EXPORT ? { definition: `  debug:
+    verbosity: basic`, name: "debug" } : { definition: `  otlp_http:
+    endpoint: ${JSON.stringify(destination(exportEndpoint))}`, name: "otlp_http" };
   return {
     config: `receivers:
   otlp:
@@ -13773,19 +13778,18 @@ function renderForgeZeroOtelCollector(exportEndpoint) {
       http:
         endpoint: 127.0.0.1:4318
 exporters:
-  otlp_http:
-    endpoint: ${JSON.stringify(endpoint2)}
+${exporter.definition}
 service:
   pipelines:
     traces:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     metrics:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     logs:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
 `,
     unit: `[Unit]
 Description=ForgeZero independently supervised OpenTelemetry Collector
@@ -13865,7 +13869,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -14200,14 +14205,20 @@ function validateBootstrapConfig(value) {
   if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?){2,}$/.test(value.nodeHostname)) {
     throw new Error("node hostname must be a lowercase public FQDN");
   }
-  let telemetry;
-  try {
-    telemetry = new URL(value.telemetryEndpoint);
-  } catch {
-    throw new Error("telemetry endpoint is malformed");
-  }
-  if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
-    throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+  if (value.telemetryEndpoint === LOCAL_DEBUG_OTEL_EXPORT) {
+    if (value.kind !== "platform" || value.environment !== "development") {
+      throw new Error("local debug telemetry is allowed only for the development platform profile");
+    }
+  } else {
+    let telemetry;
+    try {
+      telemetry = new URL(value.telemetryEndpoint);
+    } catch {
+      throw new Error("telemetry endpoint is malformed");
+    }
+    if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
+      throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+    }
   }
   const deploymentCredentials = value.deploymentCredentials ?? {};
   if (!deploymentCredentials || typeof deploymentCredentials !== "object" || Array.isArray(deploymentCredentials) || Object.keys(deploymentCredentials).length > 64) {
@@ -17918,7 +17929,8 @@ var PROFILES = {
     workerScriptName: "forgezero-api-edge-development",
     region: { key: "in-south", label: "India South", country: "IN" },
     seedSyncEpoch: "development-23c19168773d69ea",
-    agentOtlpEndpoint: "https://otel.forgezero.net",
+    collectorExport: LOCAL_DEBUG_OTEL_EXPORT,
+    agentOtlpEndpoint: "http://127.0.0.1:4318",
     privateCidrs: ["10.42.0.0/24"]
   },
   production: {
@@ -17931,6 +17943,7 @@ var PROFILES = {
     workerScriptName: "forgezero-api-edge-production",
     region: { key: "in-south", label: "India South", country: "IN" },
     seedSyncEpoch: "production-genesis-v1",
+    collectorExport: "https://otel.forgezero.net",
     agentOtlpEndpoint: "https://otel.forgezero.net",
     privateCidrs: ["10.42.0.0/24"]
   }
@@ -17968,7 +17981,7 @@ function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
       manifestFile: bundle.manifestPath,
       branch: profile.branch
     },
-    telemetryEndpoint: profile.agentOtlpEndpoint,
+    telemetryEndpoint: profile.collectorExport,
     database: {
       role: "master",
       agency: "member",
@@ -19429,6 +19442,17 @@ function writeMetalOperatorFiles(directory) {
   });
   return { metalConfig, remoteRequest };
 }
+function writeDerivedLaunchFile(path, write) {
+  const temporary = `${path}.next.${process.pid}.${randomBytes10(6).toString("hex")}`;
+  try {
+    write(temporary);
+    renameSync10(temporary, path);
+    return path;
+  } catch (cause) {
+    rmSync8(temporary, { force: true });
+    throw cause;
+  }
+}
 function writePlatformGenesisFleet(directory, preset) {
   const output = genesisOutputDirectory(directory);
   const metalRequestFile = preset?.metalRequestFile ?? bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
@@ -19451,7 +19475,8 @@ function writePlatformGenesisFleet(directory, preset) {
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   }));
   const realtimeEnabled = preset ? true : bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
-  const cloudflareConfig = writeBootstrapConfig(join13(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
+  const cloudflareConfigPath = join13(output, "cloudflare.json");
+  const cloudflareConfigValue = createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
     discovery: {
       zoneName: preset?.profile.zoneName ?? bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
@@ -19468,7 +19493,8 @@ function writePlatformGenesisFleet(directory, preset) {
       service: "http://127.0.0.1:3000",
       tunnelName: preset ? guest.name : bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
     }))
-  }));
+  });
+  const cloudflareConfig = preset ? writeDerivedLaunchFile(cloudflareConfigPath, (path) => writeBootstrapConfig(path, cloudflareConfigValue)) : writeBootstrapConfig(cloudflareConfigPath, cloudflareConfigValue);
   const cloudflareAcceptance = join13(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region, preset ? {
     source: "bootstrap-bundle",
@@ -19477,13 +19503,17 @@ function writePlatformGenesisFleet(directory, preset) {
     bundleSha256: preset.bundle.manifest.sha256
   } : undefined).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
-    writeBootstrapConfig(path, config);
+    if (preset)
+      writeDerivedLaunchFile(path, (temporary) => writeBootstrapConfig(temporary, config));
+    else
+      writeBootstrapConfig(path, config);
     return path;
   });
   const requests = configs.map((platformConfigFile, index) => {
     const guest = fleet[index];
     const host = guestHostKeys.nodes.find(({ name }) => name === guest.name);
-    return writeOperatorPlatformBootstrapRequest(join13(output, `${guest.name}-remote.json`), {
+    const path = join13(output, `${guest.name}-remote.json`);
+    const request = {
       kind: "platform-remote",
       platformConfigFile,
       target: {
@@ -19502,9 +19532,12 @@ function writePlatformGenesisFleet(directory, preset) {
           hostKeySha256: metalRequest.target.hostKeySha256
         }
       }
-    });
+    };
+    return preset ? writeDerivedLaunchFile(path, (temporary) => writeOperatorPlatformBootstrapRequest(temporary, request)) : writeOperatorPlatformBootstrapRequest(path, request);
   });
-  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join13(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  const fleetPath = join13(output, "platform-fleet-remote.json");
+  const writeFleet = (path) => writeOperatorPlatformBootstrapFleetRequest(path, requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  const fleetRequest = preset ? writeDerivedLaunchFile(fleetPath, writeFleet) : writeFleet(fleetPath);
   return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
 function selectedForgeZeroLaunchEnvironment(value) {
@@ -19766,8 +19799,7 @@ async function cmdBootstrap(options, args) {
       }
       const outputDirectory = options.outputPath ?? join13(homedir2(), ".forgezero-secure", environment, "genesis");
       const environmentInput = options.bootstrapSecretsEnvFile ? readPlatformLaunchEnvironment(options.bootstrapSecretsEnvFile) : undefined;
-      const existingFleetPath = join13(outputDirectory, "platform-fleet-remote.json");
-      const fleet = existsSync13(existingFleetPath) ? readOperatorPlatformBootstrapFleetRequest(existingFleetPath) : readOperatorPlatformBootstrapFleetRequest((await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner)).fleetRequest);
+      const fleet = readOperatorPlatformBootstrapFleetRequest((await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner)).fleetRequest);
       if (planOperatorPlatformFleetBootstrap(fleet, "apply").environment !== environment) {
         throw new Error("existing platform fleet does not match the selected launch profile");
       }

package/dist/metal-bootstrap.js

@@ -366,12 +366,13 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.91";
+var VERSION = "0.1.94";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
 var FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
 var FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+var LOCAL_DEBUG_OTEL_EXPORT = "local-debug";
 var ARCHIVE = "/run/forgezero-otelcol.tar.gz";
 var EXTRACT = "/run/forgezero-otelcol-release";
 var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
@@ -397,7 +398,9 @@ var destination = (value) => {
   return url.toString().replace(/\/$/, "");
 };
 function renderForgeZeroOtelCollector(exportEndpoint) {
-  const endpoint = destination(exportEndpoint);
+  const exporter = exportEndpoint === LOCAL_DEBUG_OTEL_EXPORT ? { definition: `  debug:
+    verbosity: basic`, name: "debug" } : { definition: `  otlp_http:
+    endpoint: ${JSON.stringify(destination(exportEndpoint))}`, name: "otlp_http" };
   return {
     config: `receivers:
   otlp:
@@ -405,19 +408,18 @@ function renderForgeZeroOtelCollector(exportEndpoint) {
       http:
         endpoint: 127.0.0.1:4318
 exporters:
-  otlp_http:
-    endpoint: ${JSON.stringify(endpoint)}
+${exporter.definition}
 service:
   pipelines:
     traces:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     metrics:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     logs:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
 `,
     unit: `[Unit]
 Description=ForgeZero independently supervised OpenTelemetry Collector
@@ -497,7 +499,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([

package/dist/operator-bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.91";
+var VERSION = "0.1.94";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3088,6 +3088,7 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
@@ -3193,7 +3194,7 @@ function validatePlatformSharedEnvironment(input) {
   if (input.otlpEndpoint !== "http://127.0.0.1:4318")
     throw new Error("OTLP must use the exact local collector endpoint.");
   validateCollectorUnit(input.otlpCollectorUnit);
-  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  agentTelemetryOrigin(input.agentOtlpEndpoint);
   for (const [name, value] of Object.entries({
     nodeHostname: input.nodeHostname,
     nodeRegion: input.nodeRegion,
@@ -3238,7 +3239,7 @@ function validatePlatformSharedEnvironment(input) {
     databaseReadPreferredCoordinators: readPreferred,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    agentOtlpEndpoint: agentTelemetryOrigin(input.agentOtlpEndpoint),
     ...initialInventory ? { initialInventory } : {}
   };
 }
@@ -3514,6 +3515,7 @@ function planLocalOtlpProof(endpoint2, collectorUnit) {
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
 var FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
 var FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+var LOCAL_DEBUG_OTEL_EXPORT = "local-debug";
 var ARCHIVE = "/run/forgezero-otelcol.tar.gz";
 var EXTRACT = "/run/forgezero-otelcol-release";
 var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
@@ -3539,7 +3541,9 @@ var destination = (value) => {
   return url.toString().replace(/\/$/, "");
 };
 function renderForgeZeroOtelCollector(exportEndpoint) {
-  const endpoint2 = destination(exportEndpoint);
+  const exporter = exportEndpoint === LOCAL_DEBUG_OTEL_EXPORT ? { definition: `  debug:
+    verbosity: basic`, name: "debug" } : { definition: `  otlp_http:
+    endpoint: ${JSON.stringify(destination(exportEndpoint))}`, name: "otlp_http" };
   return {
     config: `receivers:
   otlp:
@@ -3547,19 +3551,18 @@ function renderForgeZeroOtelCollector(exportEndpoint) {
       http:
         endpoint: 127.0.0.1:4318
 exporters:
-  otlp_http:
-    endpoint: ${JSON.stringify(endpoint2)}
+${exporter.definition}
 service:
   pipelines:
     traces:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     metrics:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
     logs:
       receivers: [otlp]
-      exporters: [otlp_http]
+      exporters: [${exporter.name}]
 `,
     unit: `[Unit]
 Description=ForgeZero independently supervised OpenTelemetry Collector
@@ -3639,7 +3642,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
   await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "restart", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -3816,14 +3820,20 @@ function validateBootstrapConfig(value) {
   if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?){2,}$/.test(value.nodeHostname)) {
     throw new Error("node hostname must be a lowercase public FQDN");
   }
-  let telemetry;
-  try {
-    telemetry = new URL(value.telemetryEndpoint);
-  } catch {
-    throw new Error("telemetry endpoint is malformed");
-  }
-  if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
-    throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+  if (value.telemetryEndpoint === LOCAL_DEBUG_OTEL_EXPORT) {
+    if (value.kind !== "platform" || value.environment !== "development") {
+      throw new Error("local debug telemetry is allowed only for the development platform profile");
+    }
+  } else {
+    let telemetry;
+    try {
+      telemetry = new URL(value.telemetryEndpoint);
+    } catch {
+      throw new Error("telemetry endpoint is malformed");
+    }
+    if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
+      throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+    }
   }
   const deploymentCredentials = value.deploymentCredentials ?? {};
   if (!deploymentCredentials || typeof deploymentCredentials !== "object" || Array.isArray(deploymentCredentials) || Object.keys(deploymentCredentials).length > 64) {

package/dist/otel-collector.d.ts

@@ -1,6 +1,7 @@
 export declare const FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
 export declare const FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
 export declare const FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+export declare const LOCAL_DEBUG_OTEL_EXPORT = "local-debug";
 export interface OtelCollectorHost {
     write(path: string, content: string, mode: number): void;
     exec(argv: readonly string[]): Promise<{

package/dist/platform-bootstrap-runtime.js

@@ -728,6 +728,7 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
@@ -833,7 +834,7 @@ function validatePlatformSharedEnvironment(input) {
   if (input.otlpEndpoint !== "http://127.0.0.1:4318")
     throw new Error("OTLP must use the exact local collector endpoint.");
   validateCollectorUnit(input.otlpCollectorUnit);
-  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  agentTelemetryOrigin(input.agentOtlpEndpoint);
   for (const [name, value] of Object.entries({
     nodeHostname: input.nodeHostname,
     nodeRegion: input.nodeRegion,
@@ -878,7 +879,7 @@ function validatePlatformSharedEnvironment(input) {
     databaseReadPreferredCoordinators: readPreferred,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    agentOtlpEndpoint: agentTelemetryOrigin(input.agentOtlpEndpoint),
     ...initialInventory ? { initialInventory } : {}
   };
 }

package/dist/platform-fleet-verification.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.91";
+var VERSION3 = "0.1.94";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -4140,6 +4140,7 @@ var httpsOrigin = (name, raw) => {
   }
   return value.origin;
 };
+var agentTelemetryOrigin = (raw) => raw === "http://127.0.0.1:4318" ? raw : httpsOrigin("agentOtlpEndpoint", raw);
 function validatePlatformInitialInventory(value) {
   if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
@@ -4245,7 +4246,7 @@ function validatePlatformSharedEnvironment(input) {
   if (input.otlpEndpoint !== "http://127.0.0.1:4318")
     throw new Error("OTLP must use the exact local collector endpoint.");
   validateCollectorUnit(input.otlpCollectorUnit);
-  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  agentTelemetryOrigin(input.agentOtlpEndpoint);
   for (const [name, value] of Object.entries({
     nodeHostname: input.nodeHostname,
     nodeRegion: input.nodeRegion,
@@ -4290,7 +4291,7 @@ function validatePlatformSharedEnvironment(input) {
     databaseReadPreferredCoordinators: readPreferred,
     appOrigin: httpsOrigin("appOrigin", input.appOrigin),
     apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
-    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint),
+    agentOtlpEndpoint: agentTelemetryOrigin(input.agentOtlpEndpoint),
     ...initialInventory ? { initialInventory } : {}
   };
 }

package/dist/platform-launch-profile.d.ts

@@ -16,6 +16,7 @@ export interface ForgeZeroLaunchProfile {
         country: string;
         city?: string;
     };
+    collectorExport: string;
     agentOtlpEndpoint: string;
     seedSyncEpoch: string;
     privateCidrs: readonly string[];

package/dist/provision.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.91";
+var VERSION3 = "0.1.94";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.91";
+export declare const VERSION = "0.1.94";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.91",
+  "version": "0.1.94",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",