@forgezero/agent 0.1.25 → 0.1.27

package/dist/index.d.ts

@@ -27,6 +27,15 @@ export { DEFAULT_METAL_HELPER_SOCKET, requestMetalProvision, startMetalHelper }
 export { DEFAULT_LIFECYCLE_HELPER_SOCKET, executeLifecycleAction, loadLifecycleProfile, requestLifecycleAction, startLifecycleHelper, validateLifecycleProfile } from './lifecycle-helper';
 export type { LifecycleCommandResult, LifecycleExec, LifecycleProfile } from './lifecycle-helper';
 export { materializeWarpMdm, renderWarpMdm } from './warp-config';
+export { compareVersions, restoreAgentRelease, selectAgentRelease, stageAgentRelease, validateAgentRelease, DEFAULT_AGENT_RELEASE_ROOT, DEFAULT_AGENT_UPDATE_SOCKET, MAX_AGENT_TARBALL_BYTES } from './agent-update';
+export type { AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResult } from './agent-update';
+export { activateAgentRelease, probeAgentSocket, requestAgentUpdate, startAgentUpdateHelper, AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_RECEIPT } from './agent-update-helper';
+export type { AgentUpdateRequest, AgentUpdateResponse } from './agent-update-helper';
+export { DEFAULT_SOFTWARE_HELPER_SOCKET, requestSoftware, startSoftwareHelper, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH } from './software-helper';
+export { ensureSoftwareRequirements, observeSoftwareHost, validateSoftwareRequirements } from './software';
+export type { SoftwareCommandResult, SoftwareExec, SoftwareObservation, SoftwareRequirement } from './software';
+export { heartbeatAgentOnce, observeAgentHost, startAgentHeartbeat } from './agent-heartbeat';
+export type { AgentHeartbeatOptions, AgentHeartbeatResponse, AgentObservation } from './agent-heartbeat';
 export { DEFAULT_DEPLOYMENT_RUNNER_SOCKET, requestDeploymentCommand, startDeploymentRunner } from './deployment-runner';
 export { createSnpAttestationSource } from './snp-attestation';
 export type { SnpAttestationOptions } from './snp-attestation';
@@ -45,6 +54,8 @@ export { assertSupportedGuestImage, SUPPORTED_GUEST_IMAGE } from './ubuntu';
 export declare function loadOrCreateSeed(path: string): Uint8Array;
 export interface AgentConfig {
     socketPath?: string;
+    /** systemd-owned listener fd; preserves the application endpoint across replacement. */
+    listenFd?: number;
     seedPath?: string;
     /** Prefer this already-unsealed systemd credential over a persistent file. */
     seedCredential?: string;
@@ -82,6 +93,8 @@ export declare const DEFAULT_SOCKET_PATH = "/run/forgezero/vault.sock";
 export declare const DEFAULT_SEED_PATH = "/var/lib/forgezero/node.seed";
 export declare const DEFAULT_SEED_CREDENTIAL = "agent-seed";
 export declare const DEFAULT_ENROLMENT_STATE_PATH = "/var/lib/forgezero/enrolment.json";
+/** Resolve the one descriptor systemd passes for the application Vault socket. */
+export declare function systemdListenFd(environment?: Record<string, string | undefined>, pid?: number): number | undefined;
 /**
  * Read a systemd credential made available only to this unit.
  *

package/dist/node-vault.js

@@ -10,30 +10,44 @@ class CacheError extends Error {
 var DEFAULT_TTL_MS = 60000;
 var DEFAULT_MAX_STALE_MS = 300000;
 function createSecretCache(options) {
-  const entries = new Map;
+  let entries = new Map;
   const now = options.now ?? (() => Date.now());
   const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
   const maxStaleMs = options.maxStaleMs ?? DEFAULT_MAX_STALE_MS;
   let cursor = 0;
   let replicated = false;
   let lastSyncOkMs = now();
-  const loadScope = async () => {
+  const fetchScope = async () => {
+    const next = new Map;
     if (!options.list)
-      return { loaded: 0, failed: [] };
+      return { entries: next, loaded: 0, failed: [] };
     const names = await options.list();
     const failed = [];
-    let loaded = 0;
     for (const name of names) {
       try {
         const result = await options.fetch(name);
-        entries.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
-        loaded += 1;
+        next.set(name, { value: result.value, version: result.version, fetchedAtMs: now() });
       } catch {
         failed.push(name);
       }
     }
+    return { entries: next, loaded: next.size, failed };
+  };
+  const loadScope = async () => {
+    if (!options.list)
+      return { loaded: 0, failed: [] };
+    const snapshot = await fetchScope();
+    entries = snapshot.entries;
+    replicated = snapshot.failed.length === 0;
+    return { loaded: snapshot.loaded, failed: snapshot.failed };
+  };
+  const refreshScope = async () => {
+    const snapshot = await fetchScope();
+    if (snapshot.failed.length > 0) {
+      throw new CacheError("FETCH_FAILED", `Could not refresh ${snapshot.failed.length} assigned vault ${snapshot.failed.length === 1 ? "entry" : "entries"}.`);
+    }
+    entries = snapshot.entries;
     replicated = true;
-    return { loaded, failed };
   };
   return {
     names: () => [...entries.keys()],
@@ -67,13 +81,26 @@ function createSecretCache(options) {
       const result = await options.changes(cursor);
       if (result.resync) {
         const dropped = [...entries.keys()];
-        entries.clear();
+        if (options.list) {
+          await refreshScope();
+        } else {
+          entries.clear();
+        }
         cursor = 0;
         lastSyncOkMs = now();
-        if (options.list)
-          await loadScope();
         return { invalidated: dropped, cursor: 0, resync: true };
       }
+      if (options.list && result.changed.length > 0) {
+        const held = new Set(entries.keys());
+        await refreshScope();
+        cursor = result.version;
+        lastSyncOkMs = now();
+        return {
+          invalidated: result.changed.filter((name) => held.has(name) || entries.has(name)),
+          cursor,
+          resync: false
+        };
+      }
       const invalidated = [];
       for (const name of result.changed) {
         if (entries.delete(name))

package/dist/provision.d.ts

@@ -127,12 +127,25 @@ export declare const DEPLOYMENT_GROUP = "forgezero-deploy";
 export declare const VAULT_GROUP = "forgezero-vault";
 export declare const LIFECYCLE_GROUP = "forgezero-lifecycle";
 export declare const DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
+export declare const AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
 export declare const DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 export declare const ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 export declare const LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
 export declare const LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
 export declare const WARP_CONFIG_UNIT_PATH = "/etc/systemd/system/forgezero-warp-config.service";
 export declare const WARP_SERVICE_DROP_IN_PATH = "/etc/systemd/system/warp-svc.service.d/forgezero.conf";
+/** Root may execute only package-owned OS strategies selected by id + version. */
+export declare function softwareHelperUnit(options: Pick<UnitOptions, 'binPath'>): string;
+/** Fixed root boundary for verified, health-gated Agent replacement. */
+export declare function agentUpdateHelperUnit(options: Pick<UnitOptions, 'binPath'>): string;
+/**
+ * PID 1 owns the stable application endpoint.
+ *
+ * New connections wait in the kernel while the credential-bearing Agent drains
+ * and a health-gated replacement starts. This is supervision, not a background
+ * terminal, and it works identically on platform and tenant computes.
+ */
+export declare function agentSocketUnit(options: Pick<UnitOptions, 'socketPath'>): string;
 export declare function warpConfigUnit(options: Pick<UnitOptions, 'binPath' | 'warpOrganization' | 'warpClientIdCredentialPath' | 'warpClientSecretCredentialPath'>): string;
 export declare function warpServiceDropIn(): string;
 export declare function lifecycleHelperUnit(options: Pick<UnitOptions, 'binPath' | 'lifecycleProfilePath' | 'lifecycleHelperSocketPath'>): string;