@forgezero/agent 0.1.2 → 0.1.10

package/dist/socket.d.ts

@@ -1,11 +1,10 @@
 import { type Server } from 'node:net';
 import { signRequest, type NodeKeyPair } from '@forgezero/runtime/identity';
-import { type Pipeline, type RunResult, type RunOptions } from './pipeline';
 import type { SecretCache } from './cache';
 /**
  * The signing socket — why the application on managed compute holds nothing.
  *
- * `@forgezero/vault` discovers `/run/forgezero.sock` and prefers it over
+ * `@forgezero/vault` discovers `/run/forgezero/vault.sock` and prefers it over
  * `FORGEZERO_API_KEY`, so moving an app onto managed compute is DELETING an
  * environment variable. That only means anything if something is listening, and
  * for a long time nothing was: the client knew how to prefer the socket and the
@@ -56,9 +55,6 @@ export type Request = {
     op: 'sync';
 } | {
     op: 'held';
-} | {
-    op: 'run';
-    pipeline: Pipeline;
 };
 export type Response = {
     ok: true;
@@ -91,10 +87,6 @@ export type Response = {
     op: 'held';
     names: string[];
     staleForMs: number;
-} | {
-    ok: true;
-    op: 'run';
-    result: RunResult;
 } | {
     ok: false;
     error: {
@@ -105,11 +97,9 @@ export type Response = {
 /**
  * Produces a hardware attestation report for this guest.
  *
- * Injected rather than implemented here, and ABSENT by default. A SEV-SNP report
- * is only meaningful if something verifies it against a measurement and a
- * freshness window, and the freshness window is an open architectural question
- * in this repo — `architecture.ts` carries it as `status: 'open'`. Inventing a
- * number would produce a check that looks like attestation and is not one.
+ * Injected and absent by default. A SEV-SNP report is meaningful only when the
+ * API verifies it against the server challenge, catalog measurement, TCB floor
+ * and AMD chain; this socket merely obtains the signed bytes.
  *
  * So with no source configured, `attest` REFUSES. It does not return an empty
  * report, and it does not silently succeed: a caller that believes it verified
@@ -126,15 +116,6 @@ export interface AgentOptions {
     /** The node's identifier, as the platform knows it. */
     nodeKey: string;
     attestation?: AttestationSource;
-    /**
-     * Runs a pipeline step. ABSENT by default, and that is the security posture.
-     *
-     * An agent that can execute arbitrary commands is a remote shell with a vault
-     * attached. Shipping one on by default would mean every compute that installs
-     * the agent for its secrets also accepts remote execution, which is not the
-     * trade anybody agreed to. An operator turns it on for the boxes that deploy.
-     */
-    exec?: RunOptions['exec'];
     /**
      * Secrets, cached in memory on this guest.
      *

package/package.json

@@ -1,11 +1,11 @@
 {
 	"//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
 	"name": "@forgezero/agent",
-	"version": "0.1.2",
+	"version": "0.1.10",
 	"type": "module",
 	"scripts": {
 		"check": "tsc --noEmit",
-		"build": "bun build src/index.ts --outfile dist/fz-agent.js --target bun --format esm --packages external && bun build src/provision.ts src/subscribe.ts src/pipeline.ts src/ssh-server.ts src/ssh-listen.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
+		"build": "bun build src/index.ts --outfile dist/fz-agent.js --target bun --format esm --packages external && bun build src/cli/index.ts --outfile dist/fz.js --target bun --format esm --packages external && bun build src/compute.ts src/provision.ts src/subscribe.ts src/pipeline.ts src/definition.ts src/ssh-server.ts src/ssh-listen.ts src/provisioning-pull.ts src/guest-enrolment.ts src/node-vault.ts src/metal-provision.ts src/metal-helper-socket.ts src/deployment-runner.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
 		"prepublishOnly": "bun run check && bun run build"
 	},
 	"devDependencies": {
@@ -16,15 +16,17 @@
 		"@noble/post-quantum": "^0.6.1"
 	},
 	"dependencies": {
-		"@forgezero/runtime": "^0.1.0",
-		"@forgezero/vault": "^0.1.0",
+		"@forgezero/access": "^0.1.0",
+		"@forgezero/runtime": "^0.1.2",
+		"@forgezero/vault": "^0.1.1",
 		"@noble/curves": "^2.2.0",
 		"@noble/hashes": "^2.2.0",
 		"@noble/post-quantum": "^0.6.1",
 		"@scure/bip39": "^2.2.0"
 	},
 	"bin": {
-		"fz-agent": "./dist/fz-agent.js"
+		"fz-agent": "./dist/fz-agent.js",
+		"fz": "./dist/fz.js"
 	},
 	"publishConfig": {
 		"access": "public"
@@ -35,7 +37,7 @@
 		"LICENSE"
 	],
 	"license": "MIT",
-	"description": "The ForgeZero node agent \u2014 holds a project-scoped vault replica in RAM and serves it over a unix socket, so applications hold no credential.",
+	"description": "ForgeZero machine tooling: the fz operator command and fz-agent for vault access, provisioning and deployment.",
 	"keywords": [
 		"agent",
 		"forgezero",
@@ -45,13 +47,13 @@
 		"attestation",
 		"sev-snp"
 	],
-	"homepage": "https://forgezero.net/docs/agent",
+	"homepage": "https://www.forgezero.net/docs/agent",
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/axxra/forgezero.git",
+		"url": "git+https://github.com/forgezero-net/packages.git",
 		"directory": "packages/agent"
 	},
-	"bugs": "https://github.com/axxra/forgezero/issues",
+	"bugs": "https://github.com/forgezero-net/packages/issues",
 	"exports": {
 		"./provision": {
 			"types": "./dist/provision.d.ts",
@@ -65,6 +67,10 @@
 			"types": "./dist/pipeline.d.ts",
 			"default": "./dist/pipeline.js"
 		},
+		"./definition": {
+			"types": "./dist/definition.d.ts",
+			"default": "./dist/definition.js"
+		},
 		"./ssh-listen": {
 			"types": "./dist/ssh-listen.d.ts",
 			"default": "./dist/ssh-listen.js"
@@ -72,6 +78,18 @@
 		"./ssh-server": {
 			"types": "./dist/ssh-server.d.ts",
 			"default": "./dist/ssh-server.js"
+		},
+		"./compute": {
+			"types": "./dist/compute.d.ts",
+			"default": "./dist/compute.js"
+		},
+		"./provisioning-pull": {
+			"types": "./dist/provisioning-pull.d.ts",
+			"default": "./dist/provisioning-pull.js"
+		},
+		"./metal-provision": {
+			"types": "./dist/metal-provision.d.ts",
+			"default": "./dist/metal-provision.js"
 		}
 	}
 }