Consumer Tennis HQ cloud agent (remote sandbox)
Token env FACTORY_WAGER_TOKEN
Vault pass://factorywager/FactoryWager Registry Token/password
Registry https://registry.factory-wager.com/
Status artifact
/registry/tennis/agent-auth.json
(status: configured)
Portal /portal/tennis/ ·
/portal/env/
Give a cloud agent (remote sandbox) a Bearer token so it can:
@factorywager/* (and related scopes) from the FactoryWager
registry when scoped install is configured.serve-public or direct R2 publish — not Pages).The public read plane on Pages does not require the token for GETs.
| Check | Value |
|---|---|
| Vault item | factorywager / FactoryWager Registry Token |
| Monorepo inject | env.template → FACTORY_WAGER_TOKEN= |
| Vault map note | config/vault-map.toml [env.FACTORY_WAGER_TOKEN].note |
| Portal mark | bun run tennis:agent-auth:bake → public/registry/tennis/agent-auth.json |
| Operator handoff | ~/.reasonix/tennis-hq-registry-token.env (mode 600, not committed) |
| Tennis HQ app | king-zippy-umbra-acre/.env.local (gitignored) + bunfig.toml scopes |
Do not put the secret in git, portal HTML, or agent chat logs that get committed.
# 1) Inject token (from operator / vault / CI secret) — never hardcode in repo
export FACTORY_WAGER_TOKEN='…' # same value as vault "FactoryWager Registry Token"
export REGISTRY_URL='https://registry.factory-wager.com/'
# 2) bunfig.toml (project or sandbox)
# [install.scopes]
# "@factorywager" = { url = "https://registry.factory-wager.com/", token = "$FACTORY_WAGER_TOKEN" }
# "@factory-wager" = { url = "https://registry.factory-wager.com/", token = "$FACTORY_WAGER_TOKEN" }
# "@factory" = { url = "https://registry.factory-wager.com/", token = "$FACTORY_WAGER_TOKEN" }
# 3) Optional .npmrc
# //registry.factory-wager.com/:_authToken=${FACTORY_WAGER_TOKEN}
# registry=https://registry.factory-wager.com/
# 4) Smoke read plane (no token required)
curl -fsS "$REGISTRY_URL/api/registry/health"
SDK write path (when publish origin is reachable):
import { RegistryClient } from '@factorywager/registry-client';
const client = new RegistryClient({
baseUrl: Bun.env.REGISTRY_URL ?? 'https://registry.factory-wager.com',
apiKey: Bun.env.FACTORY_WAGER_TOKEN,
});
// await client.publish(name, version, tarballBlob, { tags: ['latest'] });
# Vault → shell (no secret printed by map commands)
bun run portal-cli secret get 'pass://factorywager/FactoryWager Registry Token/password'
# Or monorepo inject (writes .env — keep gitignored)
bun run proton:inject:factorywager:reasonix
# Local handoff file for agents (created when provisioning Tennis HQ)
# ~/.reasonix/tennis-hq-registry-token.env
set -a && source ~/.reasonix/tennis-hq-registry-token.env && set +a
| Surface | Command / path |
|---|---|
| Agent auth bake | bun run tennis:agent-auth:bake / tennis:agent-auth:check |
| Vault map bake | bun run env:inventory:bake → /registry/vault-map.json |
| Tennis board | /portal/tennis/ loads agent-auth KPI |
| Tenant packages | /registry/tennis/registry.json (bun run ops:seed:toc / seed tenants) |