@forgezero/agent 0.1.0

package/dist/ssh-listen.d.ts

@@ -0,0 +1,41 @@
+import { type Server } from 'node:net';
+import { MAX_MESSAGE_BYTES, type AgentBackend } from './ssh-server';
+/**
+ * The socket `SSH_AUTH_SOCK` points at.
+ *
+ * `ssh-server.ts` speaks the protocol and had nowhere to speak it: the message
+ * handler was complete, tested, and nothing ever listened. An agent protocol
+ * with no socket is a parser.
+ *
+ * ## Framing is a stream problem, not a message problem
+ *
+ * A unix socket delivers bytes, not messages. `ssh` pipelines requests, and a
+ * single `data` event can carry two of them or half of one — so the buffer is
+ * drained in a loop until `readMessage` says it needs more. Handling one
+ * message per event works in every manual test and fails the moment a real
+ * client is fast.
+ *
+ * ## The DIRECTORY is the access control, not the socket
+ *
+ * Anything that can open this socket can sign with every key the vault holds.
+ * There is no authentication inside the protocol and there is not meant to be:
+ * the filesystem is the boundary, exactly as OpenSSH's own agent does it.
+ *
+ * Chmodding the socket alone is not enough, and measuring it showed why — the
+ * file appears when `listen` binds and the mode is only corrected in the
+ * callback afterwards, so it exists world-connectable for a moment first. A
+ * brief window is still a window on a machine where anything can retry.
+ *
+ * So the containing directory is created 0700 BEFORE binding. Traversal is
+ * denied for everybody else regardless of what the socket's own bits say, which
+ * is why `ssh-agent` puts its socket in a private directory too. The socket is
+ * chmodded as well, because two boundaries cost nothing.
+ */
+export interface SshListenOptions {
+    socketPath: string;
+    backend: AgentBackend;
+    /** Reported per connection failure. Never the key, never the data. */
+    onError?: (error: Error) => void;
+}
+export declare function startSshAgent(options: SshListenOptions): Server;
+export { MAX_MESSAGE_BYTES };

package/dist/ssh-listen.js

@@ -0,0 +1,149 @@
+// src/ssh-server.ts
+import { authorizedKey, publicKeyBlob, signatureBlob } from "@forgezero/runtime/openssh";
+var SSH_AGENT_FAILURE = 5;
+var SSH_AGENT_SUCCESS = 6;
+var SSH_AGENTC_REQUEST_IDENTITIES = 11;
+var SSH_AGENT_IDENTITIES_ANSWER = 12;
+var SSH_AGENTC_SIGN_REQUEST = 13;
+var SSH_AGENT_SIGN_RESPONSE = 14;
+var MAX_MESSAGE_BYTES = 256 * 1024;
+
+class SshAgentError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SshAgentError";
+  }
+}
+var u32 = (value) => {
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, value, false);
+  return out;
+};
+var concat = (...parts) => {
+  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+};
+var sshString = (value) => {
+  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+  return concat(u32(bytes.length), bytes);
+};
+var frame = (payload) => concat(u32(payload.length), payload);
+function readMessage(buffer) {
+  if (buffer.length < 4)
+    return null;
+  const length = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength).getUint32(0, false);
+  if (length > MAX_MESSAGE_BYTES) {
+    throw new SshAgentError("TOO_LARGE", `A ${length}-byte agent message is past the limit.`);
+  }
+  if (buffer.length < 4 + length)
+    return null;
+  return { message: buffer.subarray(4, 4 + length), rest: buffer.subarray(4 + length) };
+}
+var failure = () => frame(Uint8Array.from([SSH_AGENT_FAILURE]));
+async function handleMessage(message, backend) {
+  if (message.length === 0)
+    return failure();
+  switch (message[0]) {
+    case SSH_AGENTC_REQUEST_IDENTITIES: {
+      const identities = await backend.identities();
+      const body = identities.flatMap((identity) => [
+        sshString(publicKeyBlob(identity.publicKey)),
+        sshString(identity.comment)
+      ]);
+      return frame(concat(Uint8Array.from([SSH_AGENT_IDENTITIES_ANSWER]), u32(identities.length), ...body));
+    }
+    case SSH_AGENTC_SIGN_REQUEST: {
+      const view = new DataView(message.buffer, message.byteOffset, message.byteLength);
+      let offset = 1;
+      const read = () => {
+        if (offset + 4 > message.length)
+          throw new SshAgentError("TRUNCATED", "Short sign request.");
+        const length = view.getUint32(offset, false);
+        offset += 4;
+        if (offset + length > message.length) {
+          throw new SshAgentError("TRUNCATED", "Sign request claims more bytes than it carries.");
+        }
+        const slice = message.subarray(offset, offset + length);
+        offset += length;
+        return slice;
+      };
+      let keyBlob;
+      let data;
+      try {
+        keyBlob = read();
+        data = read();
+      } catch {
+        return failure();
+      }
+      if (keyBlob.length < 32)
+        return failure();
+      const publicKey = keyBlob.subarray(keyBlob.length - 32);
+      const signature = await backend.sign(publicKey, data);
+      if (!signature)
+        return failure();
+      return frame(concat(Uint8Array.from([SSH_AGENT_SIGN_RESPONSE]), sshString(signatureBlob(signature))));
+    }
+    default:
+      return failure();
+  }
+}
+var describeIdentities = (identities) => identities.map((identity) => authorizedKey(identity.publicKey, identity.comment));
+// src/ssh-listen.ts
+import { createServer } from "node:net";
+import { chmodSync, existsSync, mkdirSync, unlinkSync } from "node:fs";
+import { dirname } from "node:path";
+function startSshAgent(options) {
+  const directory = dirname(options.socketPath);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  chmodSync(directory, 448);
+  if (existsSync(options.socketPath))
+    unlinkSync(options.socketPath);
+  const server = createServer((socket) => {
+    let buffer = new Uint8Array(0);
+    socket.on("data", async (chunk) => {
+      const incoming = new Uint8Array(chunk);
+      const merged = new Uint8Array(buffer.length + incoming.length);
+      merged.set(buffer);
+      merged.set(incoming, buffer.length);
+      buffer = merged;
+      for (;; ) {
+        let next;
+        try {
+          next = readMessage(buffer);
+        } catch (error) {
+          options.onError?.(error);
+          socket.destroy();
+          return;
+        }
+        if (!next)
+          return;
+        buffer = next.rest;
+        try {
+          const reply = await handleMessage(next.message, options.backend);
+          socket.write(Buffer.from(reply.slice().buffer));
+        } catch (error) {
+          options.onError?.(error);
+        }
+      }
+    });
+    socket.on("error", () => socket.destroy());
+    socket.on("close", () => {
+      buffer = new Uint8Array(0);
+    });
+  });
+  server.listen(options.socketPath, () => {
+    chmodSync(options.socketPath, 384);
+  });
+  return server;
+}
+export {
+  startSshAgent,
+  MAX_MESSAGE_BYTES
+};

package/dist/ssh-listen.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ssh-server.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The SSH agent protocol, served rather than consumed.
+ *
+ * `ssh` talks to whatever `SSH_AUTH_SOCK` points at. Pointing it here means a
+ * developer's key lives in the vault and is used without ever existing on their
+ * disk — which removes the artefact that every leaked SSH key came from.
+ *
+ * ## Two operations, and the omissions are the design
+ *
+ * `REQUEST_IDENTITIES` and `SIGN_REQUEST` are implemented. `ADD_IDENTITY`,
+ * `REMOVE_IDENTITY` and `REMOVE_ALL_IDENTITIES` are deliberately NOT: this
+ * agent's keys come from the vault, and a client that could add one would let
+ * any process on the machine inject a key that `ssh` would then offer to every
+ * host the user connects to. Refusing them is not a missing feature, it is the
+ * difference between an agent and a shared keyring.
+ *
+ * Lock and unlock are also absent. An agent that can be locked by a message can
+ * be locked by anything that reaches the socket, and the socket is already the
+ * boundary — filesystem permissions decide who may speak here.
+ *
+ * ## Framing is length-prefixed and bounded
+ *
+ * Every message is a 4-byte big-endian length then that many bytes. A length
+ * field is attacker-controlled, so it is bounded before a buffer is allocated:
+ * an unbounded read is a one-packet memory exhaustion against a process holding
+ * a vault replica.
+ */
+declare const SSH_AGENT_FAILURE = 5;
+declare const SSH_AGENT_SUCCESS = 6;
+declare const SSH_AGENT_IDENTITIES_ANSWER = 12;
+declare const SSH_AGENT_SIGN_RESPONSE = 14;
+/**
+ * The largest message worth reading.
+ *
+ * An SSH signing request is a session identifier and a little framing — a few
+ * hundred bytes. 256 KiB is far above anything legitimate and far below a size
+ * that matters, and the point is that the bound exists at all.
+ */
+export declare const MAX_MESSAGE_BYTES: number;
+export declare class SshAgentError extends Error {
+    readonly code: 'TOO_LARGE' | 'TRUNCATED' | 'UNSUPPORTED';
+    constructor(code: 'TOO_LARGE' | 'TRUNCATED' | 'UNSUPPORTED', message: string);
+}
+/** An identity this agent will offer. The private half is never here. */
+export interface AgentIdentity {
+    /** 32 raw bytes. */
+    publicKey: Uint8Array;
+    comment: string;
+}
+export interface AgentBackend {
+    identities(): Promise<readonly AgentIdentity[]>;
+    /**
+     * Sign `data` with the key matching `publicKey`, or return null.
+     *
+     * Null rather than throwing for an unknown key: `ssh` offers every identity
+     * in turn and expects a failure for the ones a server did not accept, so an
+     * exception here would turn normal negotiation into a crash.
+     */
+    sign(publicKey: Uint8Array, data: Uint8Array): Promise<Uint8Array | null>;
+}
+/** Wrap a payload in the outer length prefix the protocol frames with. */
+export declare const frame: (payload: Uint8Array) => Uint8Array;
+/**
+ * Pull one complete message out of a buffer.
+ *
+ * Returns null when more bytes are needed — a socket delivers whatever arrived,
+ * not whatever was sent, and treating a partial read as a malformed message is
+ * how an agent drops every request larger than one TCP segment.
+ */
+export declare function readMessage(buffer: Uint8Array): {
+    message: Uint8Array;
+    rest: Uint8Array;
+} | null;
+/**
+ * Answer one message.
+ *
+ * Every unknown or unimplemented request answers FAILURE rather than closing
+ * the connection. `ssh` probes an agent's capabilities, and a socket that hangs
+ * up on an unexpected byte makes every client think the agent has died.
+ */
+export declare function handleMessage(message: Uint8Array, backend: AgentBackend): Promise<Uint8Array>;
+/** What `ssh-add -l` would print, for an operator checking what is offered. */
+export declare const describeIdentities: (identities: readonly AgentIdentity[]) => string[];
+export { SSH_AGENT_FAILURE, SSH_AGENT_SUCCESS, SSH_AGENT_IDENTITIES_ANSWER, SSH_AGENT_SIGN_RESPONSE };

package/dist/ssh-server.js

@@ -0,0 +1,109 @@
+// src/ssh-server.ts
+import { authorizedKey, publicKeyBlob, signatureBlob } from "@forgezero/runtime/openssh";
+var SSH_AGENT_FAILURE = 5;
+var SSH_AGENT_SUCCESS = 6;
+var SSH_AGENTC_REQUEST_IDENTITIES = 11;
+var SSH_AGENT_IDENTITIES_ANSWER = 12;
+var SSH_AGENTC_SIGN_REQUEST = 13;
+var SSH_AGENT_SIGN_RESPONSE = 14;
+var MAX_MESSAGE_BYTES = 256 * 1024;
+
+class SshAgentError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SshAgentError";
+  }
+}
+var u32 = (value) => {
+  const out = new Uint8Array(4);
+  new DataView(out.buffer).setUint32(0, value, false);
+  return out;
+};
+var concat = (...parts) => {
+  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+};
+var sshString = (value) => {
+  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+  return concat(u32(bytes.length), bytes);
+};
+var frame = (payload) => concat(u32(payload.length), payload);
+function readMessage(buffer) {
+  if (buffer.length < 4)
+    return null;
+  const length = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength).getUint32(0, false);
+  if (length > MAX_MESSAGE_BYTES) {
+    throw new SshAgentError("TOO_LARGE", `A ${length}-byte agent message is past the limit.`);
+  }
+  if (buffer.length < 4 + length)
+    return null;
+  return { message: buffer.subarray(4, 4 + length), rest: buffer.subarray(4 + length) };
+}
+var failure = () => frame(Uint8Array.from([SSH_AGENT_FAILURE]));
+async function handleMessage(message, backend) {
+  if (message.length === 0)
+    return failure();
+  switch (message[0]) {
+    case SSH_AGENTC_REQUEST_IDENTITIES: {
+      const identities = await backend.identities();
+      const body = identities.flatMap((identity) => [
+        sshString(publicKeyBlob(identity.publicKey)),
+        sshString(identity.comment)
+      ]);
+      return frame(concat(Uint8Array.from([SSH_AGENT_IDENTITIES_ANSWER]), u32(identities.length), ...body));
+    }
+    case SSH_AGENTC_SIGN_REQUEST: {
+      const view = new DataView(message.buffer, message.byteOffset, message.byteLength);
+      let offset = 1;
+      const read = () => {
+        if (offset + 4 > message.length)
+          throw new SshAgentError("TRUNCATED", "Short sign request.");
+        const length = view.getUint32(offset, false);
+        offset += 4;
+        if (offset + length > message.length) {
+          throw new SshAgentError("TRUNCATED", "Sign request claims more bytes than it carries.");
+        }
+        const slice = message.subarray(offset, offset + length);
+        offset += length;
+        return slice;
+      };
+      let keyBlob;
+      let data;
+      try {
+        keyBlob = read();
+        data = read();
+      } catch {
+        return failure();
+      }
+      if (keyBlob.length < 32)
+        return failure();
+      const publicKey = keyBlob.subarray(keyBlob.length - 32);
+      const signature = await backend.sign(publicKey, data);
+      if (!signature)
+        return failure();
+      return frame(concat(Uint8Array.from([SSH_AGENT_SIGN_RESPONSE]), sshString(signatureBlob(signature))));
+    }
+    default:
+      return failure();
+  }
+}
+var describeIdentities = (identities) => identities.map((identity) => authorizedKey(identity.publicKey, identity.comment));
+export {
+  readMessage,
+  handleMessage,
+  frame,
+  describeIdentities,
+  SshAgentError,
+  SSH_AGENT_SUCCESS,
+  SSH_AGENT_SIGN_RESPONSE,
+  SSH_AGENT_IDENTITIES_ANSWER,
+  SSH_AGENT_FAILURE,
+  MAX_MESSAGE_BYTES
+};

package/dist/ssh-server.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/subscribe.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Realtime scope sync — a WebSocket subscription, with polling as the floor.
+ *
+ * The agent holds the whole assigned project and environment in RAM. Keeping
+ * that current by polling a cursor means a rotation is live somewhere between
+ * zero and one interval after it happens, and the interval cannot be shortened
+ * far because every agent on the fleet is asking. A subscription inverts it: the
+ * platform pushes, so propagation is a network hop and an idle agent costs one
+ * open socket instead of a request every few seconds.
+ *
+ * ## Polling is not deleted, and that is the whole design
+ *
+ * A WebSocket is the fast path, never the only one. It fails in ways an HTTP
+ * request does not — a proxy that idles it out, a load balancer that drops it, a
+ * network that half-closes so the socket looks open and delivers nothing. Every
+ * one of those is silent, and a silent sync failure on a vault replica means an
+ * application confidently serving a credential that was revoked an hour ago.
+ *
+ * So the subscription is a latency optimisation over a poll that keeps running:
+ *
+ *   · the socket delivers changes as they happen
+ *   · the poll continues at a LONG interval and is what actually establishes
+ *     freshness — `lastSyncOkMs` moves on a poll, not on a frame
+ *   · a poll that finds changes the socket should have delivered is proof the
+ *     socket is lying, and it is torn down and reopened
+ *
+ * That last point is the one worth the code. A half-open socket is
+ * indistinguishable from a quiet one, and the only way to tell them apart is to
+ * ask over a channel that is known to work.
+ *
+ * ## Freshness is never asserted by a frame
+ *
+ * A frame proves the platform sent something. It does not prove this agent is
+ * seeing everything, because an attacker who can drop frames silently can hold a
+ * replica stale for as long as they like. The staleness clock therefore only
+ * advances on a successful poll — an authenticated round trip the agent
+ * initiated — and `get` still refuses when that clock runs out. A subscription
+ * can make the replica fresher; it can never make it *vouchable*.
+ */
+export type ChangeFrame = {
+    type: 'changed';
+    names: readonly string[];
+    cursor: number;
+} | {
+    type: 'resync';
+    reason?: string;
+} | {
+    type: 'revoked';
+    reason?: string;
+};
+export interface Subscriber {
+    /** Close and stop reconnecting. */
+    stop(): void;
+    /** For status output: is the socket currently up? */
+    readonly live: boolean;
+    /** How many times it has reconnected. A climbing number is a bad network. */
+    readonly reconnects: number;
+}
+export interface SubscribeOptions {
+    url: string;
+    /**
+     * Opens a socket. Injected so this is testable without a server, and so a
+     * runtime with its own WebSocket can supply it.
+     */
+    open(url: string): SocketLike;
+    /** Applied when a frame arrives. */
+    onFrame(frame: ChangeFrame): void | Promise<void>;
+    /** The poll that establishes freshness. Runs regardless of the socket. */
+    poll(): Promise<{
+        invalidated: string[];
+        resync: boolean;
+    }>;
+    /** Long, because the socket is doing the fast work. */
+    pollIntervalMs?: number;
+    /** Backoff ceiling. */
+    maxBackoffMs?: number;
+    onEvent?: (event: string, detail?: unknown) => void;
+    now?: () => number;
+    setTimer?: (fn: () => void, ms: number) => unknown;
+    clearTimer?: (handle: unknown) => void;
+}
+export interface SocketLike {
+    close(): void;
+    onmessage: ((event: {
+        data: string;
+    }) => void) | null;
+    onopen: (() => void) | null;
+    onclose: (() => void) | null;
+    onerror: ((error: unknown) => void) | null;
+}
+/**
+ * Reconnect with exponential backoff and full jitter.
+ *
+ * Jitter is not politeness. Every agent on a fleet loses its socket at the same
+ * instant when the platform restarts, and without jitter every one of them
+ * reconnects at the same instant too — turning a deploy into a self-inflicted
+ * denial of service at exactly the moment the platform is least able to absorb
+ * it. Full jitter across the whole window spreads them out.
+ */
+export declare function backoffMs(attempt: number, ceiling: number, random: () => number): number;
+export declare function subscribe(options: SubscribeOptions): Subscriber;

package/dist/subscribe.js

@@ -0,0 +1,121 @@
+// src/subscribe.ts
+var DEFAULT_POLL_MS = 60000;
+var DEFAULT_MAX_BACKOFF_MS = 30000;
+function backoffMs(attempt, ceiling, random) {
+  const window = Math.min(ceiling, 500 * 2 ** Math.min(attempt, 10));
+  return Math.floor(random() * window);
+}
+function subscribe(options) {
+  const pollInterval = options.pollIntervalMs ?? DEFAULT_POLL_MS;
+  const ceiling = options.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS;
+  const setTimer = options.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  const emit = options.onEvent ?? (() => {});
+  let socket = null;
+  let stopped = false;
+  let attempt = 0;
+  let live = false;
+  let reconnects = 0;
+  let pollTimer = null;
+  let retryTimer = null;
+  let deliveredSincePoll = new Set;
+  const teardown = () => {
+    if (socket) {
+      socket.onmessage = null;
+      socket.onopen = null;
+      socket.onclose = null;
+      socket.onerror = null;
+      try {
+        socket.close();
+      } catch {}
+      socket = null;
+    }
+    live = false;
+  };
+  const connect = () => {
+    if (stopped)
+      return;
+    teardown();
+    let opened;
+    try {
+      opened = options.open(options.url);
+    } catch (error) {
+      emit("open-failed", error);
+      scheduleRetry();
+      return;
+    }
+    socket = opened;
+    opened.onopen = () => {
+      live = true;
+      attempt = 0;
+      emit("open");
+    };
+    opened.onmessage = (event) => {
+      let frame;
+      try {
+        frame = JSON.parse(event.data);
+      } catch {
+        emit("bad-frame");
+        return;
+      }
+      if (frame.type === "changed")
+        for (const name of frame.names)
+          deliveredSincePoll.add(name);
+      options.onFrame(frame);
+    };
+    opened.onerror = (error) => emit("error", error);
+    opened.onclose = () => {
+      live = false;
+      if (stopped)
+        return;
+      reconnects += 1;
+      emit("closed");
+      scheduleRetry();
+    };
+  };
+  const scheduleRetry = () => {
+    if (stopped)
+      return;
+    attempt += 1;
+    retryTimer = setTimer(connect, backoffMs(attempt, ceiling, Math.random));
+  };
+  const pollOnce = async () => {
+    if (stopped)
+      return;
+    try {
+      const result = await options.poll();
+      const missed = result.invalidated.filter((name) => !deliveredSincePoll.has(name));
+      if (live && (missed.length > 0 || result.resync)) {
+        emit("socket-missed-changes", missed);
+        teardown();
+        connect();
+      }
+      deliveredSincePoll = new Set;
+    } catch (error) {
+      emit("poll-failed", error);
+    } finally {
+      if (!stopped)
+        pollTimer = setTimer(() => void pollOnce(), pollInterval);
+    }
+  };
+  connect();
+  pollTimer = setTimer(() => void pollOnce(), pollInterval);
+  return {
+    stop() {
+      stopped = true;
+      teardown();
+      clearTimer(pollTimer);
+      clearTimer(retryTimer);
+    },
+    get live() {
+      return live;
+    },
+    get reconnects() {
+      return reconnects;
+    }
+  };
+}
+export {
+  subscribe,
+  backoffMs
+};

package/dist/subscribe.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,73 @@
+{
+  "//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
+  "name": "@forgezero/agent",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "check": "tsc --noEmit",
+    "build": "bun build src/index.ts --outfile dist/fz-agent.js --target bun --format esm --packages external && bun build src/provision.ts src/subscribe.ts src/pipeline.ts src/ssh-server.ts src/ssh-listen.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
+    "prepublishOnly": "bun run check && bun run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.0",
+    "@types/bun": "latest",
+    "@types/node": "^22.0.0",
+    "@noble/curves": "^2.2.0",
+    "@noble/post-quantum": "^0.6.1"
+  },
+  "dependencies": {
+    "@forgezero/runtime": "^0.1.0",
+    "@forgezero/vault": "^0.1.0"
+  },
+  "bin": {
+    "fz-agent": "./dist/fz-agent.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "description": "The ForgeZero node agent \u2014 holds a project-scoped vault replica in RAM and serves it over a unix socket, so applications hold no credential.",
+  "keywords": [
+    "agent",
+    "forgezero",
+    "vault",
+    "secrets",
+    "systemd",
+    "attestation",
+    "sev-snp"
+  ],
+  "homepage": "https://forgezero.net/docs/agent",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/axxra/forgezero.git",
+    "directory": "packages/agent"
+  },
+  "bugs": "https://github.com/axxra/forgezero/issues",
+  "exports": {
+    "./provision": {
+      "types": "./dist/provision.d.ts",
+      "default": "./dist/provision.js"
+    },
+    "./subscribe": {
+      "types": "./dist/subscribe.d.ts",
+      "default": "./dist/subscribe.js"
+    },
+    "./pipeline": {
+      "types": "./dist/pipeline.d.ts",
+      "default": "./dist/pipeline.js"
+    },
+    "./ssh-listen": {
+      "types": "./dist/ssh-listen.d.ts",
+      "default": "./dist/ssh-listen.js"
+    },
+    "./ssh-server": {
+      "types": "./dist/ssh-server.d.ts",
+      "default": "./dist/ssh-server.js"
+    }
+  }
+}