@forgezero/agent 0.1.125 → 0.1.129

package/dist/host-maintenance.js

@@ -62,7 +62,7 @@ function planHostMaintenance(request, runtime = localRuntime()) {
     "--pipe",
     "--collect",
     `--unit=forgezero-${request.operation}`,
-    "--property=User=forgezero",
+    "--property=User=forgezero-api",
     `--property=WorkingDirectory=${workingDirectory}`,
     `--property=EnvironmentFile=${SHARED_ENV}`,
     "--property=Environment=NODE_ENV=production",

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.125";
+var VERSION = "0.1.129";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -89,7 +89,7 @@ export interface OperatorPlatformFleetCoordinates {
         databaseRole: 'master' | 'joiner';
     }[];
 }
-export type OperatorPlatformBootstrapMode = 'apply' | 'status';
+export type OperatorPlatformBootstrapMode = 'apply' | 'repair' | 'promote' | 'status';
 export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'genesis-cleanup' | 'rehearsal' | 'rehearsal-cleanup' | 'host-keys' | 'rehearsal-host-keys' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.125";
+var VERSION = "0.1.129";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3805,7 +3805,7 @@ function validateEnrolledComputeBootstrapSecrets(config, input) {
     ...cloudflareConfigured ? validateCloudflareBootstrapSecretPair(source) : {}
   };
 }
-function validatePlatformBootstrapSecrets(config, input) {
+function validatePlatformBootstrapSecrets(config, input, options = {}) {
   if (!input || typeof input !== "object" || Array.isArray(input))
     throw new Error("bootstrap credential input must be an object");
   const source = input;
@@ -3833,7 +3833,8 @@ function validatePlatformBootstrapSecrets(config, input) {
     throw new Error("backup credential is malformed");
   }
   const cloudflareConfigured = Boolean(config.cloudflareHandoff || config.runtime.environment.cloudflare);
-  if (cloudflareConfigured !== Boolean(cloudflareTunnelToken && cloudflareApiToken)) {
+  const cloudflareCredentialsSupplied = Boolean(cloudflareTunnelToken || cloudflareApiToken);
+  if (!cloudflareConfigured && cloudflareCredentialsSupplied || cloudflareConfigured && !cloudflareCredentialsSupplied && !options.allowStoredCloudflareCredentials || Boolean(cloudflareTunnelToken) !== Boolean(cloudflareApiToken)) {
     throw new Error("Cloudflare configuration requires attended CF_TUNNEL_TOKEN and CF_API_TOKEN together");
   }
   if (cloudflareTunnelToken)
@@ -4756,10 +4757,16 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     }
     allowInterruptedReleaseRebind = !exactIdentity && (boundedReleaseResume || approvedIdentityMigration);
   }
-  const platformPrivate = config.kind === "platform" ? (() => {
+  const reuseBoundPlatformCredentials = config.kind === "platform" && dependencies.reuseBoundPlatformCredentials === true;
+  if (reuseBoundPlatformCredentials && (!installed || !host.exists("/var/lib/forgezero/enrolment.json"))) {
+    throw new Error("stored-credential promotion requires an installed enrolled platform compute");
+  }
+  const platformPrivate = config.kind === "platform" && !reuseBoundPlatformCredentials ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
-    const checked4 = validatePlatformBootstrapSecrets(config, secrets);
+    const checked4 = validatePlatformBootstrapSecrets(config, secrets, {
+      allowStoredCloudflareCredentials: Boolean(installed?.cloudflare && config.cloudflareHandoff && !cloudflare)
+    });
     return {
       root: checked4.clusterBootstrapCode,
       email: checked4.emailSecret,
@@ -4797,7 +4804,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
     await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
   }
-  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+  if (config.kind === "platform" && platformPrivate?.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
     await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
   const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
@@ -4855,24 +4862,38 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     await verifyBootstrapBundleOnHost(host, config, true);
   }
   if (config.kind === "platform") {
-    const root = platformPrivate.root;
-    if (!host.exists(JWT_CREDENTIAL)) {
-      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
-    }
-    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
-      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
-    }
-    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
-    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
-    for (const [name, source] of Object.entries({
-      ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup.s3.secretAccessKey": platformPrivate.backup
-    })) {
-      if (source) {
-        const destination2 = `${CREDS}/${name}.cred`;
-        if (!host.exists(destination2)) {
-          await seal(host, name, destination2, source);
+    if (reuseBoundPlatformCredentials) {
+      const required = [
+        ...config.database.role !== "none" ? [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL] : [],
+        SEED_CREDENTIAL,
+        BACKUP_RECOVERY_CREDENTIAL,
+        ...emailCredentialName ? [`${CREDS}/${emailCredentialName}.cred`] : [],
+        ...config.runtime.environment.backup ? [`${CREDS}/backup.s3.secretAccessKey.cred`] : [],
+        ...installed?.cloudflare ? [CF_API_CREDENTIAL, CF_TUNNEL_API_CREDENTIAL, TUNNEL_CREDENTIAL] : [],
+        ...installed?.realtime ? [REALTIME_PUBLISH_CREDENTIAL, REALTIME_TICKET_CREDENTIAL] : []
+      ];
+      const missing = required.find((path) => !host.exists(path));
+      if (missing)
+        throw new Error(`stored platform credential is missing: ${missing}`);
+    } else {
+      const root = platformPrivate.root;
+      if (!host.exists(JWT_CREDENTIAL)) {
+        await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+      }
+      if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+        await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+      }
+      await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+      await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+      for (const [name, source] of Object.entries({
+        ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+        "backup.s3.secretAccessKey": platformPrivate.backup
+      })) {
+        if (source) {
+          const destination2 = `${CREDS}/${name}.cred`;
+          if (!host.exists(destination2))
+            await seal(host, name, destination2, source);
         }
       }
     }
@@ -5037,7 +5058,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
-  if (config.kind === "platform" && config.database.role === "master") {
+  if (config.kind === "platform" && config.database.role === "master" && !reuseBoundPlatformCredentials) {
     const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
     if (!host.exists(invitePath))
       throw new Error("platform invite is missing after deployment");
@@ -6713,12 +6734,12 @@ function planOperatorMetalBootstrap(request, mode) {
 var secretSources = (config) => [
   ...config.cloudflareHandoff ? [["cloudflare-handoff", config.cloudflareHandoff.handoffFile]] : []
 ];
-var attendedSecretNames = (config) => [
+var attendedSecretNames = (config, options = {}) => [
   "cluster-bootstrap-code",
   config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : "fz_smtp.password",
   ...config.enrolment.source === "api-token" ? ["enrol-token"] : [],
   ...config.runtime.environment.backup ? ["backup.s3.secretAccessKey"] : [],
-  ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? ["CF_TUNNEL_TOKEN", "CF_API_TOKEN"] : []
+  ...!options.reuseBoundCloudflare && (config.cloudflareHandoff || config.runtime.environment.cloudflare) ? ["CF_TUNNEL_TOKEN", "CF_API_TOKEN"] : []
 ];
 function planOperatorPlatformBootstrap(request, mode) {
   const config = readBootstrapConfig(request.platformConfigFile);
@@ -6734,7 +6755,14 @@ function planOperatorPlatformBootstrap(request, mode) {
       user: request.target.user,
       ...request.target.jump ? { via: request.target.jump.address } : {}
     },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "promote" ? [
+      "verify pinned SSH transport and caller-approved SSH agent",
+      "copy pinned Bun and packaged fz artifacts to a private staging directory",
+      "verify and copy the one immutable API Git bundle plus its manifest",
+      "stage the rewritten owner-only platform config without plaintext credentials",
+      "promote the exact release using the credentials already sealed on the enrolled compute",
+      "remove transient local and remote staging data"
+    ] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to a private staging directory",
       "verify and copy the one immutable API Git bundle plus its manifest",
@@ -6742,7 +6770,10 @@ function planOperatorPlatformBootstrap(request, mode) {
       "run typed fz bootstrap platform --apply from the local bundle",
       "remove transient local and remote staging data"
     ],
-    secretInputs: mode === "apply" ? [...attendedSecretNames(config), ...secretSources(config).map(([name]) => name)] : []
+    secretInputs: mode === "apply" || mode === "repair" ? [
+      ...attendedSecretNames(config, { reuseBoundCloudflare: mode === "repair" }),
+      ...mode === "repair" ? [] : secretSources(config).map(([name]) => name)
+    ] : []
   };
 }
 var fleetConfigIdentity = (config) => {
@@ -7172,10 +7203,10 @@ async function withOperatorGuestTransport(request, evidence, callback, options =
     rmSync6(directory, { recursive: true, force: true });
   }
 }
-async function stageConfig(config, directory) {
+async function stageConfig(config, directory, options = {}) {
   const rewritten = structuredClone(config);
   const staged = [];
-  for (const [name, source] of secretSources(config)) {
+  for (const [name, source] of options.reuseBoundCloudflare ? [] : secretSources(config)) {
     const bytes = ownerFile(source, SECRET_LIMIT, name);
     const local = join6(directory, name);
     writeFileSync8(local, bytes, { mode: 384, flag: "wx" });
@@ -7184,6 +7215,9 @@ async function stageConfig(config, directory) {
     if (name === "cloudflare-handoff")
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
+  if (options.reuseBoundCloudflare && rewritten.cloudflareHandoff) {
+    rewritten.cloudflareHandoff.handoffFile = `${REMOTE_STAGE}/cloudflare-handoff`;
+  }
   const bundle = await readBootstrapBundle(config.bootstrapBundle.bundleFile, config.bootstrapBundle.manifestFile);
   if (bundle.manifest.branch !== config.bootstrapBundle.branch) {
     throw new Error("reviewed bootstrap config branch does not match the bundle manifest");
@@ -7290,8 +7324,12 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const config = readBootstrapConfig(request.platformConfigFile);
     if (config.kind !== "platform")
       throw new Error("operator bootstrap requires a platform config");
-    const secrets = mode === "apply" ? validatePlatformBootstrapSecrets(config, options.secrets) : undefined;
-    const staged = await stageConfig(config, directory);
+    const secrets = mode === "apply" || mode === "repair" ? validatePlatformBootstrapSecrets(config, options.secrets, {
+      allowStoredCloudflareCredentials: mode === "repair"
+    }) : undefined;
+    const staged = await stageConfig(config, directory, {
+      reuseBoundCloudflare: mode === "repair" || mode === "promote"
+    });
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
     for (const name of staged.files)
@@ -7302,7 +7340,14 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
     for (const { name } of staged.bundleFiles)
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0644", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap bundle", true);
-    const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
+    const command = [
+      "/usr/bin/sudo",
+      "-n",
+      "/usr/local/bin/fz",
+      "bootstrap",
+      mode === "apply" ? "platform" : "repair",
+      mode === "promote" ? "stored-credentials" : "credentials-stdin"
+    ];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
 ` : undefined, mode === "apply");

package/dist/platform-fleet-verification.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.125";
+var VERSION3 = "0.1.129";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -3020,7 +3020,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.125";
+var VERSION3 = "0.1.129";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/recovery-host.d.ts

@@ -4,4 +4,13 @@ export interface RecoveryHostResult {
     stderr: string;
 }
 export type RecoveryHostExec = (argv: readonly string[]) => Promise<RecoveryHostResult>;
+export interface RecoveryBootstrapCoordinates {
+    profile: string;
+    role: string;
+    software: string;
+    apiOrigin: string;
+    edgeHostname: string;
+    databaseAddress?: string;
+}
+export declare function validateRecoveryBootstrapState(value: unknown, expected: RecoveryBootstrapCoordinates): void;
 export declare function runRecoveryHost(args: readonly string[], run?: RecoveryHostExec): Promise<void>;

package/dist/recovery-host.js

@@ -28,6 +28,26 @@ var nonEmpty = (path) => {
   if (!existsSync(path) || !statSync(path).isFile() || statSync(path).size < 1)
     throw new Error(`required file missing: ${path}`);
 };
+function validateRecoveryBootstrapState(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap state is malformed");
+  const state = value;
+  if (state.format !== 2 || state.kind !== "platform" || state.environment !== expected.profile || state.databaseRole !== expected.role || state.profile !== expected.software || state.apiUrl !== expected.apiOrigin || state.nodeHostname !== expected.edgeHostname || expected.databaseAddress !== undefined && state.databaseAddress !== expected.databaseAddress)
+    throw new Error("bootstrap state does not match reviewed recovery coordinates");
+}
+var exactBootstrapState = (expected) => {
+  const path = "/var/lib/forgezero/bootstrap.json";
+  nonEmpty(path);
+  if (statSync(path).size > 64 * 1024)
+    throw new Error("bootstrap state is oversized");
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error("bootstrap state is malformed");
+  }
+  validateRecoveryBootstrapState(value, expected);
+};
 var option = (args, name) => {
   const value = args.find((arg) => arg.startsWith(`--${name}=`))?.slice(name.length + 3);
   if (!value || /[\0\r\n]/.test(value))
@@ -51,15 +71,11 @@ async function runRecoveryHost(args, run = execute) {
     const apiOrigin = option(args, "api-origin");
     const edgeHostname = option(args, "edge-hostname");
     const databaseAddress = args.find((arg) => arg.startsWith("--db-address="))?.slice(13);
-    exactState("/opt/forgezero/.forge-state", `profile=${profile}`);
-    exactState("/opt/forgezero/.forge-state", `db_role=${role}`);
-    exactState("/opt/forgezero/.forge-state", `software_profile=${software}`);
-    if (databaseAddress)
-      exactState("/opt/forgezero/.forge-state", `db_address=${databaseAddress}`);
-    exactState("/opt/forgezero/shared/.env", "ARANGO_DB=fz");
-    exactState("/opt/forgezero/shared/.env", "FZ_DATABASE_MODE=platform");
-    exactState("/opt/forgezero/shared/.env", `API_ORIGIN=${apiOrigin}`);
-    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME=${edgeHostname}`);
+    exactBootstrapState({ profile, role, software, apiOrigin, edgeHostname, ...databaseAddress ? { databaseAddress } : {} });
+    exactState("/opt/forgezero/shared/.env", 'ARANGO_DB="fz"');
+    exactState("/opt/forgezero/shared/.env", 'FZ_DATABASE_MODE="platform"');
+    exactState("/opt/forgezero/shared/.env", `API_ORIGIN="${apiOrigin}"`);
+    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME="${edgeHostname}"`);
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
@@ -103,7 +119,7 @@ async function runRecoveryHost(args, run = execute) {
       throw new Error("maintenance accepts only fz db argv");
     const slot = activeSlot();
     const properties = [
-      "--property=User=forgezero",
+      "--property=User=forgezero-api",
       `--property=WorkingDirectory=/opt/forgezero/slots/${slot}`,
       "--property=Environment=NODE_ENV=production",
       "--property=EnvironmentFile=/opt/forgezero/shared/.env",
@@ -120,5 +136,6 @@ async function runRecoveryHost(args, run = execute) {
   throw new Error("unknown recovery-host action");
 }
 export {
+  validateRecoveryBootstrapState,
   runRecoveryHost
 };

package/dist/ssh-bootstrap.d.ts

@@ -1,6 +1,7 @@
 import type { NodeKeyPair } from '@forgezero/runtime/identity';
 import type { AgentOperationTelemetry } from './telemetry-runtime';
 import { type GitHostResolver } from './git-egress';
+import type { MetalBootstrapConfig } from './metal-bootstrap';
 export interface RemoteSshBootstrapClaim {
     computeKey: string;
     computeReference: string;
@@ -10,6 +11,7 @@ export interface RemoteSshBootstrapClaim {
     realm: string;
     projectKey: string;
     environmentKey: string;
+    runnerSshPublicKey: string;
     target: {
         host: string;
         port: number;
@@ -25,7 +27,12 @@ export interface RemoteSshBootstrapClaim {
             source: 'runner';
         } | {
             source: 'vault';
+            kind: 'private-key';
             privateKey: string;
+        } | {
+            source: 'vault';
+            kind: 'password';
+            password: string;
         };
     };
     enrolmentToken: string;
@@ -42,31 +49,18 @@ export interface RemoteMetalAdmissionClaim {
     label: string;
     regionKey: string;
     runnerNodeKey: string;
+    runnerSshPublicKey: string;
     challenge: string;
-    provisioning: {
-        volumeGroup: string;
-        bridge: string;
-        subnetPrefix: string;
-        addressStart: number;
-        addressEnd: number;
-        gateway: string;
-        nameservers: string[];
-        cpuPools: Array<{
-            key: string;
-            cpus: string;
-            physicalCores: number;
-            memoryNodes?: string;
-        }>;
-        housekeepingCpus: string;
-        housekeepingMemoryNodes?: string;
-        confidential?: {
-            cbitpos: number;
-            reducedPhysBits: number;
-            policy: string;
-        };
-    };
     target: RemoteSshBootstrapClaim['target'];
 }
+type MetalAdmissionProvisioning = Pick<MetalBootstrapConfig['profile'], 'volumeGroup' | 'bridge' | 'subnetPrefix' | 'addressStart' | 'addressEnd' | 'gateway' | 'nameservers' | 'cpuPools' | 'housekeepingCpus'>;
+/**
+ * Convert runner-observed Linux CPU topology into the fixed ForgeZero host
+ * boundary. The browser never authors this capacity. One physical core and all
+ * of its SMT siblings remain reserved for the host; every other complete core
+ * becomes the initial allocatable pool.
+ */
+export declare function deriveMetalAdmissionProvisioning(lscpu: string): MetalAdmissionProvisioning;
 export interface MetalAdmissionProof {
     jobKey: string;
     tenantKey: string;
@@ -109,6 +103,7 @@ export interface BootstrapCommandResult {
 export type BootstrapCommand = (argv: readonly string[], options?: {
     stdin?: string;
     secret?: boolean;
+    env?: Record<string, string>;
 }) => Promise<BootstrapCommandResult>;
 export interface SshBootstrapPullOptions {
     apiUrl: string;
@@ -173,3 +168,4 @@ export declare function startMetalAdmissionPull(options: SshBootstrapPullOptions
     stop(): Promise<void>;
     readonly active: boolean;
 };
+export {};

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.125";
+export declare const VERSION = "0.1.129";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.125",
+  "version": "0.1.129",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -11,13 +11,13 @@
     "typescript": "^5.6.0",
     "@types/bun": "latest",
     "@types/node": "^22.0.0",
-    "@forgezero/access": "0.1.13",
+    "@forgezero/access": "0.1.14",
     "@noble/curves": "^2.2.0",
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.18",
-    "@forgezero/vault": "0.1.24",
+    "@forgezero/runtime": "0.1.20",
+    "@forgezero/vault": "0.1.26",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",