@forgezero/agent 0.1.97 → 0.1.99

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.97";
+var VERSION3 = "0.1.99";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.d.ts

@@ -195,8 +195,8 @@ export declare const legacyBootstrapIdentityDigest: (config: BootstrapConfig) =>
 /**
  * Exact, reviewed identity migrations for an already-installed platform host.
  * This is deliberately not a generic "stored coordinates match" escape hatch:
- * only the development collector transition from the retired external OTLP
- * placeholder to the supervised loopback sink is accepted.
+ * only the development collector transition and the addition of reviewed
+ * genesis attestation evidence are accepted.
  */
 export declare function approvedPlatformRepairIdentityDigests(config: PlatformBootstrapConfig): readonly string[];
 /** Exact prior-release identities accepted only while generation one is still unenrolled. */

package/dist/bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.97";
+var VERSION = "0.1.99";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4296,12 +4296,28 @@ function bootstrapIdentityDigest(config) {
 }
 var legacyBootstrapIdentityDigest = (config) => createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
 function approvedPlatformRepairIdentityDigests(config) {
-  if (config.environment !== "development" || config.telemetryEndpoint !== LOCAL_DEBUG_OTEL_EXPORT || config.runtime.environment.agentOtlpEndpoint !== "http://127.0.0.1:4318")
-    return [];
-  const previous = structuredClone(config);
-  previous.telemetryEndpoint = "https://otel.forgezero.net";
-  previous.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
-  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+  const prior = [];
+  const attestation = config.runtime.environment.initialInventory?.attestation;
+  if (attestation) {
+    const beforeAttestation = structuredClone(config);
+    delete beforeAttestation.runtime.environment.initialInventory.attestation;
+    prior.push(beforeAttestation);
+  }
+  const telemetryMigration = config.environment === "development" && config.telemetryEndpoint === LOCAL_DEBUG_OTEL_EXPORT && config.runtime.environment.agentOtlpEndpoint === "http://127.0.0.1:4318";
+  if (telemetryMigration) {
+    const beforeTelemetry = structuredClone(config);
+    beforeTelemetry.telemetryEndpoint = "https://otel.forgezero.net";
+    beforeTelemetry.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
+    prior.push(beforeTelemetry);
+    if (attestation) {
+      delete beforeTelemetry.runtime.environment.initialInventory.attestation;
+      prior.push(beforeTelemetry);
+    }
+  }
+  return [...new Set(prior.flatMap((previous) => [
+    bootstrapIdentityDigest(previous),
+    legacyBootstrapIdentityDigest(previous)
+  ]))];
 }
 function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
   if (!config.runtime.environment.initialInventory)
@@ -5011,8 +5027,12 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.attestation !== undefined) {
+        const attestation = exactKeys(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
+        exactKeys(attestation.tcbFloor, ["bootLoader", "tee", "snp", "microcode"], "initial attestation TCB floor");
+      }
       if (inventory.deployment !== undefined)
         exactKeys(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))

package/dist/fz-agent.js

@@ -9496,7 +9496,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.97";
+var VERSION2 = "0.1.99";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4841,7 +4841,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.97";
+var VERSION2 = "0.1.99";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -14681,12 +14681,28 @@ function bootstrapIdentityDigest(config) {
 }
 var legacyBootstrapIdentityDigest = (config) => createHash4("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
 function approvedPlatformRepairIdentityDigests(config) {
-  if (config.environment !== "development" || config.telemetryEndpoint !== LOCAL_DEBUG_OTEL_EXPORT || config.runtime.environment.agentOtlpEndpoint !== "http://127.0.0.1:4318")
-    return [];
-  const previous = structuredClone(config);
-  previous.telemetryEndpoint = "https://otel.forgezero.net";
-  previous.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
-  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+  const prior = [];
+  const attestation = config.runtime.environment.initialInventory?.attestation;
+  if (attestation) {
+    const beforeAttestation = structuredClone(config);
+    delete beforeAttestation.runtime.environment.initialInventory.attestation;
+    prior.push(beforeAttestation);
+  }
+  const telemetryMigration = config.environment === "development" && config.telemetryEndpoint === LOCAL_DEBUG_OTEL_EXPORT && config.runtime.environment.agentOtlpEndpoint === "http://127.0.0.1:4318";
+  if (telemetryMigration) {
+    const beforeTelemetry = structuredClone(config);
+    beforeTelemetry.telemetryEndpoint = "https://otel.forgezero.net";
+    beforeTelemetry.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
+    prior.push(beforeTelemetry);
+    if (attestation) {
+      delete beforeTelemetry.runtime.environment.initialInventory.attestation;
+      prior.push(beforeTelemetry);
+    }
+  }
+  return [...new Set(prior.flatMap((previous) => [
+    bootstrapIdentityDigest(previous),
+    legacyBootstrapIdentityDigest(previous)
+  ]))];
 }
 function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
   if (!config.runtime.environment.initialInventory)
@@ -15396,8 +15412,12 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
+      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
       exactKeys2(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.attestation !== undefined) {
+        const attestation = exactKeys2(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
+        exactKeys2(attestation.tcbFloor, ["bootLoader", "tee", "snp", "microcode"], "initial attestation TCB floor");
+      }
       if (inventory.deployment !== undefined)
         exactKeys2(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.97";
+var VERSION = "0.1.99";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1420,7 +1420,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.97";
+var VERSION = "0.1.99";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4296,12 +4296,28 @@ function bootstrapIdentityDigest(config) {
 }
 var legacyBootstrapIdentityDigest = (config) => createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config, true))).digest("hex");
 function approvedPlatformRepairIdentityDigests(config) {
-  if (config.environment !== "development" || config.telemetryEndpoint !== LOCAL_DEBUG_OTEL_EXPORT || config.runtime.environment.agentOtlpEndpoint !== "http://127.0.0.1:4318")
-    return [];
-  const previous = structuredClone(config);
-  previous.telemetryEndpoint = "https://otel.forgezero.net";
-  previous.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
-  return [bootstrapIdentityDigest(previous), legacyBootstrapIdentityDigest(previous)];
+  const prior = [];
+  const attestation = config.runtime.environment.initialInventory?.attestation;
+  if (attestation) {
+    const beforeAttestation = structuredClone(config);
+    delete beforeAttestation.runtime.environment.initialInventory.attestation;
+    prior.push(beforeAttestation);
+  }
+  const telemetryMigration = config.environment === "development" && config.telemetryEndpoint === LOCAL_DEBUG_OTEL_EXPORT && config.runtime.environment.agentOtlpEndpoint === "http://127.0.0.1:4318";
+  if (telemetryMigration) {
+    const beforeTelemetry = structuredClone(config);
+    beforeTelemetry.telemetryEndpoint = "https://otel.forgezero.net";
+    beforeTelemetry.runtime.environment.agentOtlpEndpoint = "https://otel.forgezero.net";
+    prior.push(beforeTelemetry);
+    if (attestation) {
+      delete beforeTelemetry.runtime.environment.initialInventory.attestation;
+      prior.push(beforeTelemetry);
+    }
+  }
+  return [...new Set(prior.flatMap((previous) => [
+    bootstrapIdentityDigest(previous),
+    legacyBootstrapIdentityDigest(previous)
+  ]))];
 }
 function interruptedPlatformReleaseIdentityDigests(config, releaseEvidence, bootstrapManifest) {
   if (!config.runtime.environment.initialInventory)
@@ -5011,8 +5027,12 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.attestation !== undefined) {
+        const attestation = exactKeys(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");
+        exactKeys(attestation.tcbFloor, ["bootLoader", "tee", "snp", "microcode"], "initial attestation TCB floor");
+      }
       if (inventory.deployment !== undefined)
         exactKeys(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))

package/dist/platform-fleet-verification.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.97";
+var VERSION3 = "0.1.99";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2908,7 +2908,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.97";
+var VERSION3 = "0.1.99";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.97";
+export declare const VERSION = "0.1.99";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.97",
+  "version": "0.1.99",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",