@forgezero/agent 0.1.26 → 0.1.27

package/dist/index.d.ts

@@ -27,6 +27,15 @@ export { DEFAULT_METAL_HELPER_SOCKET, requestMetalProvision, startMetalHelper }
 export { DEFAULT_LIFECYCLE_HELPER_SOCKET, executeLifecycleAction, loadLifecycleProfile, requestLifecycleAction, startLifecycleHelper, validateLifecycleProfile } from './lifecycle-helper';
 export type { LifecycleCommandResult, LifecycleExec, LifecycleProfile } from './lifecycle-helper';
 export { materializeWarpMdm, renderWarpMdm } from './warp-config';
+export { compareVersions, restoreAgentRelease, selectAgentRelease, stageAgentRelease, validateAgentRelease, DEFAULT_AGENT_RELEASE_ROOT, DEFAULT_AGENT_UPDATE_SOCKET, MAX_AGENT_TARBALL_BYTES } from './agent-update';
+export type { AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResult } from './agent-update';
+export { activateAgentRelease, probeAgentSocket, requestAgentUpdate, startAgentUpdateHelper, AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_RECEIPT } from './agent-update-helper';
+export type { AgentUpdateRequest, AgentUpdateResponse } from './agent-update-helper';
+export { DEFAULT_SOFTWARE_HELPER_SOCKET, requestSoftware, startSoftwareHelper, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH } from './software-helper';
+export { ensureSoftwareRequirements, observeSoftwareHost, validateSoftwareRequirements } from './software';
+export type { SoftwareCommandResult, SoftwareExec, SoftwareObservation, SoftwareRequirement } from './software';
+export { heartbeatAgentOnce, observeAgentHost, startAgentHeartbeat } from './agent-heartbeat';
+export type { AgentHeartbeatOptions, AgentHeartbeatResponse, AgentObservation } from './agent-heartbeat';
 export { DEFAULT_DEPLOYMENT_RUNNER_SOCKET, requestDeploymentCommand, startDeploymentRunner } from './deployment-runner';
 export { createSnpAttestationSource } from './snp-attestation';
 export type { SnpAttestationOptions } from './snp-attestation';
@@ -45,6 +54,8 @@ export { assertSupportedGuestImage, SUPPORTED_GUEST_IMAGE } from './ubuntu';
 export declare function loadOrCreateSeed(path: string): Uint8Array;
 export interface AgentConfig {
     socketPath?: string;
+    /** systemd-owned listener fd; preserves the application endpoint across replacement. */
+    listenFd?: number;
     seedPath?: string;
     /** Prefer this already-unsealed systemd credential over a persistent file. */
     seedCredential?: string;
@@ -82,6 +93,8 @@ export declare const DEFAULT_SOCKET_PATH = "/run/forgezero/vault.sock";
 export declare const DEFAULT_SEED_PATH = "/var/lib/forgezero/node.seed";
 export declare const DEFAULT_SEED_CREDENTIAL = "agent-seed";
 export declare const DEFAULT_ENROLMENT_STATE_PATH = "/var/lib/forgezero/enrolment.json";
+/** Resolve the one descriptor systemd passes for the application Vault socket. */
+export declare function systemdListenFd(environment?: Record<string, string | undefined>, pid?: number): number | undefined;
 /**
  * Read a systemd credential made available only to this unit.
  *

package/dist/provision.d.ts

@@ -127,12 +127,25 @@ export declare const DEPLOYMENT_GROUP = "forgezero-deploy";
 export declare const VAULT_GROUP = "forgezero-vault";
 export declare const LIFECYCLE_GROUP = "forgezero-lifecycle";
 export declare const DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
+export declare const AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
 export declare const DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 export declare const ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 export declare const LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
 export declare const LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
 export declare const WARP_CONFIG_UNIT_PATH = "/etc/systemd/system/forgezero-warp-config.service";
 export declare const WARP_SERVICE_DROP_IN_PATH = "/etc/systemd/system/warp-svc.service.d/forgezero.conf";
+/** Root may execute only package-owned OS strategies selected by id + version. */
+export declare function softwareHelperUnit(options: Pick<UnitOptions, 'binPath'>): string;
+/** Fixed root boundary for verified, health-gated Agent replacement. */
+export declare function agentUpdateHelperUnit(options: Pick<UnitOptions, 'binPath'>): string;
+/**
+ * PID 1 owns the stable application endpoint.
+ *
+ * New connections wait in the kernel while the credential-bearing Agent drains
+ * and a health-gated replacement starts. This is supervision, not a background
+ * terminal, and it works identically on platform and tenant computes.
+ */
+export declare function agentSocketUnit(options: Pick<UnitOptions, 'socketPath'>): string;
 export declare function warpConfigUnit(options: Pick<UnitOptions, 'binPath' | 'warpOrganization' | 'warpClientIdCredentialPath' | 'warpClientSecretCredentialPath'>): string;
 export declare function warpServiceDropIn(): string;
 export declare function lifecycleHelperUnit(options: Pick<UnitOptions, 'binPath' | 'lifecycleProfilePath' | 'lifecycleHelperSocketPath'>): string;