@forgezero/agent 0.1.31 → 0.1.33

package/dist/git-egress.d.ts

@@ -0,0 +1,35 @@
+export type GitNetworkProtocol = 'https' | 'ssh';
+export interface GitNetworkTarget {
+    protocol: GitNetworkProtocol;
+    hostname: string;
+    port: number;
+    /** The exact name (and optional port) whose SSH key was accepted by the operator. */
+    hostKeyAlias?: string;
+}
+export interface PinnedGitTarget extends GitNetworkTarget {
+    /** Public addresses captured in one DNS answer and reused for the whole Git operation. */
+    addresses: readonly string[];
+}
+export type GitHostResolver = (hostname: string) => Promise<readonly string[]>;
+export declare class GitEgressError extends Error {
+    constructor(message: string);
+}
+/**
+ * True only for ordinary globally routable unicast destinations.
+ *
+ * This intentionally rejects documentation, benchmarking, transition,
+ * multicast and address-translation ranges as well as RFC1918/link-local
+ * space. A Git forge has no operational reason to live on one of them, and
+ * allowing them turns a repository URL into a network probe.
+ */
+export declare function isPublicGitAddress(value: string): boolean;
+/** Parse the only remote protocols the credential-bearing Agent permits. */
+export declare function gitNetworkTarget(repository: string): GitNetworkTarget | null;
+export declare const resolveSystemGitHost: GitHostResolver;
+/**
+ * Resolve once, reject the complete answer if any address is not public, and
+ * return only the captured addresses. Git must then be forced to use these
+ * values rather than resolving the hostname again.
+ */
+export declare function resolvePinnedGitTarget(repository: string, resolveHost?: GitHostResolver): Promise<PinnedGitTarget | null>;
+export declare const curlResolveValue: (target: PinnedGitTarget) => string;

package/dist/index.d.ts

@@ -29,11 +29,16 @@ export type { LifecycleCommandResult, LifecycleExec, LifecycleProfile } from './
 export { materializeWarpMdm, renderWarpMdm } from './warp-config';
 export { compareVersions, restoreAgentRelease, selectAgentRelease, stageAgentRelease, validateAgentRelease, DEFAULT_AGENT_RELEASE_ROOT, DEFAULT_AGENT_UPDATE_SOCKET, MAX_AGENT_TARBALL_BYTES } from './agent-update';
 export type { AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResult } from './agent-update';
-export { activateAgentRelease, probeAgentSocket, requestAgentUpdate, startAgentUpdateHelper, AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_RECEIPT } from './agent-update-helper';
-export type { AgentUpdateRequest, AgentUpdateResponse } from './agent-update-helper';
+export { activateAgentRelease, probeAgentSocket, readAgentUpdateReceipt, recoverInterruptedAgentUpdate, requestAgentUpdate, startAgentUpdateHelper, AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_JOURNAL, AGENT_UPDATE_RECEIPT } from './agent-update-helper';
+export type { AgentUpdateOutcome, AgentUpdateReceipt, AgentUpdateRequest, AgentUpdateResponse } from './agent-update-helper';
 export { DEFAULT_SOFTWARE_HELPER_SOCKET, requestSoftware, startSoftwareHelper, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH } from './software-helper';
 export { ensureSoftwareRequirements, observeSoftwareHost, validateSoftwareRequirements, OS_CATALOG, SOFTWARE_CATALOG } from './software';
 export type { CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec, SoftwareId, SoftwareObservation, SoftwareRequirement } from './software';
+export { AGENT_EGRESS_TABLE, BLOCKED_IPV4, BLOCKED_IPV6, SYSTEMD_RESOLVED_ADDRESS, SYSTEMD_RESOLVED_STUB, applyAgentEgressPolicy, normalizeEgressTcpPorts, renderAgentEgressNft, superviseAgentEgressPolicy, systemdAgentEgressDirectives, verifyAgentEgressPolicy } from './egress-policy';
+export type { EgressCommand, EgressCommandResult } from './egress-policy';
+export type { LoopbackEgressGrant } from './egress-policy';
+export { AGENT_TELEMETRY_EVENTS, AGENT_TELEMETRY_OPERATIONS, AGENT_TELEMETRY_OUTCOMES, createAgentTelemetry, resolveAgentTelemetryConfig } from './telemetry';
+export type { AgentOperationObservation, AgentTelemetry, AgentTelemetryConfig, AgentTelemetryEvent, AgentTelemetryOperation, AgentTelemetryOutcome, AgentTelemetryState } from './telemetry';
 export { heartbeatAgentOnce, observeAgentHost, startAgentHeartbeat } from './agent-heartbeat';
 export type { AgentHeartbeatOptions, AgentHeartbeatResponse, AgentObservation } from './agent-heartbeat';
 export { DEFAULT_DEPLOYMENT_RUNNER_SOCKET, requestDeploymentCommand, startDeploymentRunner } from './deployment-runner';
@@ -57,6 +62,8 @@ export interface AgentConfig {
     /** systemd-owned listener fd; preserves the application endpoint across replacement. */
     listenFd?: number;
     seedPath?: string;
+    /** Explicit development-only permission to persist a seed file. */
+    allowFileSeed?: boolean;
     /** Prefer this already-unsealed systemd credential over a persistent file. */
     seedCredential?: string;
     /** Injected by tests or an embedding process; never persisted by the agent. */
@@ -92,6 +99,16 @@ export interface AgentConfig {
 export declare const DEFAULT_SOCKET_PATH = "/run/forgezero/vault.sock";
 export declare const DEFAULT_SEED_PATH = "/var/lib/forgezero/node.seed";
 export declare const DEFAULT_SEED_CREDENTIAL = "agent-seed";
+/**
+ * Resolve identity custody without a silent production downgrade. A missing
+ * systemd credential is an outage to fix, not permission to create plaintext
+ * identity material under /var/lib.
+ */
+export declare function configuredAgentSeed(options: {
+    credential?: string;
+    path?: string;
+    allowFileSeed?: boolean;
+}): Uint8Array;
 export declare const DEFAULT_ENROLMENT_STATE_PATH = "/var/lib/forgezero/enrolment.json";
 /** Resolve the one descriptor systemd passes for the application Vault socket. */
 export declare function systemdListenFd(environment?: Record<string, string | undefined>, pid?: number): number | undefined;

package/dist/metal-helper-socket.js

@@ -166,6 +166,7 @@ import {
   writeFileSync
 } from "node:fs";
 import { dirname, isAbsolute, join } from "node:path";
+import { isIP } from "node:net";
 var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -215,6 +216,14 @@ function validateMetalProfile(profile) {
       throw new MetalProvisionError("metal paths must be absolute");
   }
   new URL(profile.apiUrl);
+  let telemetryEndpoint;
+  try {
+    telemetryEndpoint = new URL(profile.agentTelemetryEndpoint);
+  } catch {
+    throw new MetalProvisionError("Agent telemetry endpoint must be an absolute public HTTPS URL");
+  }
+  if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
+    throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
   if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
     throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
@@ -331,7 +340,9 @@ var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)
     content: ${base64(content)}
 `;
 function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
+  validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
+  const telemetryEndpoint = `'${profile.agentTelemetryEndpoint.replace(/'/g, `'\\''`)}'`;
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
 # load the driver shipped by the one pinned image before the agent starts. Do
@@ -355,7 +366,7 @@ fi
 if [[ ! -x /usr/local/lib/forgezero/agent/fz-agent ]] || [[ "$(/usr/local/lib/forgezero/agent/fz-agent --version 2>/dev/null || true)" != "${profile.agentVersion}" ]]; then
   env BUN_INSTALL=${agentBun} /usr/local/bin/bun add -g --no-cache --force @forgezero/agent@${profile.agentVersion}
 fi
-env   FZ_API=${profile.apiUrl}   FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
+env   FZ_API=${profile.apiUrl}   OTEL_EXPORTER_OTLP_ENDPOINT=${telemetryEndpoint}   FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_AGENT_EGRESS_ENFORCE=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
 `;
 }
 function cloudInit(profile, claim, manifest) {

package/dist/metal-provision.d.ts

@@ -27,6 +27,8 @@ export interface MetalProvisionProfile {
     /** One-time compatibility source for pre-Agent platform guests. */
     legacyStateDir?: string;
     apiUrl: string;
+    /** Root-owned collector coordinate inherited by guests, never claim-controlled. */
+    agentTelemetryEndpoint: string;
     images: Record<string, MetalImage>;
     /** Explicit host-observed pools. No pool means no dynamic guest authority. */
     cpuPools: readonly MetalCpuPool[];

package/dist/metal-provision.js

@@ -166,6 +166,7 @@ import {
   writeFileSync
 } from "node:fs";
 import { dirname, isAbsolute, join } from "node:path";
+import { isIP } from "node:net";
 var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
 var SHA256 = /^[a-f0-9]{64}$/;
@@ -215,6 +216,14 @@ function validateMetalProfile(profile) {
       throw new MetalProvisionError("metal paths must be absolute");
   }
   new URL(profile.apiUrl);
+  let telemetryEndpoint;
+  try {
+    telemetryEndpoint = new URL(profile.agentTelemetryEndpoint);
+  } catch {
+    throw new MetalProvisionError("Agent telemetry endpoint must be an absolute public HTTPS URL");
+  }
+  if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
+    throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
   if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
     throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
@@ -331,7 +340,9 @@ var yamlFile = (path, content, permissions) => `  - path: ${JSON.stringify(path)
     content: ${base64(content)}
 `;
 function guestBootstrapScript(profile, attested = Boolean(profile.confidential), hasEnrolment = true, nodeLabel = "compute") {
+  validateMetalProfile(profile);
   const agentBun = "/usr/local/lib/forgezero/bun";
+  const telemetryEndpoint = `'${profile.agentTelemetryEndpoint.replace(/'/g, `'\\''`)}'`;
   const attestationSetup = attested ? `# The report device is not part of the encryption path, so a guest can appear
 # healthy and encrypted while attestation is silently impossible. Install and
 # load the driver shipped by the one pinned image before the agent starts. Do
@@ -355,7 +366,7 @@ fi
 if [[ ! -x /usr/local/lib/forgezero/agent/fz-agent ]] || [[ "$(/usr/local/lib/forgezero/agent/fz-agent --version 2>/dev/null || true)" != "${profile.agentVersion}" ]]; then
   env BUN_INSTALL=${agentBun} /usr/local/bin/bun add -g --no-cache --force @forgezero/agent@${profile.agentVersion}
 fi
-env   FZ_API=${profile.apiUrl}   FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
+env   FZ_API=${profile.apiUrl}   OTEL_EXPORTER_OTLP_ENDPOINT=${telemetryEndpoint}   FZ_AGENT_BIN=/usr/local/lib/forgezero/agent/fz-agent   FZ_AGENT_USER=forgezero-agent   FZ_SOCKET_PATH=/run/forgezero/vault.sock   FZ_SEED_CREDENTIAL_PATH=/etc/forgezero/creds/agent-seed.cred   FZ_GIT_CREDENTIAL_PATH=/etc/forgezero/creds/git-deploy-key.cred   FZ_GIT_PUBLIC_KEY_PATH=/etc/forgezero/git/deploy.pub   FZ_DEPLOY_ROOT=/opt/forgezero   FZ_DEPLOY_PULL=${hasEnrolment ? "true" : "false"}   FZ_AGENT_EGRESS_ENFORCE=${hasEnrolment ? "true" : "false"}   FZ_NODE_LABEL=${nodeLabel}   ${agentBun}/bin/fz agent install --apply${hasEnrolment ? " --enrol" : ""}
 `;
 }
 function cloudInit(profile, claim, manifest) {

package/dist/migration-pull.d.ts

@@ -1,4 +1,5 @@
 import type { NodeKeyPair } from '@forgezero/runtime/identity';
+import type { AgentOperationTelemetry } from './telemetry-runtime';
 export type MigrationNetwork = 'private-lan' | 'cloudflare-warp';
 export type MigrationEvidenceProfile = 'forgezero-platform' | 'tenant-managed';
 export type MigrationAction = 'network-ready' | 'database-member-ready' | 'api-ready' | 'source-drained' | 'source-stopped';
@@ -37,6 +38,7 @@ export interface MigrationPullOptions {
     setTimer?: (callback: () => void, ms: number) => unknown;
     clearTimer?: (handle: unknown) => void;
     onEvent?: (event: string, detail?: unknown) => void;
+    telemetry?: AgentOperationTelemetry;
 }
 export type MigrationPullResult = {
     status: 'idle';

package/dist/migration-pull.js

@@ -74,6 +74,7 @@ class MigrationClaimLostError extends Error {
     this.name = "MigrationClaimLostError";
   }
 }
+var remoteOutcome = (cause) => cause instanceof SignedNodeHttpError && cause.status < 500 ? "refused" : "retryable";
 var post = (options, operation, body) => postSignedNode(options, `v1/node/migrations/${operation}`, body);
 async function complete(options, body) {
   const attempts = Math.max(1, Math.min(options.completionAttempts ?? 5, 10));
@@ -94,7 +95,8 @@ async function complete(options, body) {
   throw last;
 }
 async function pullMigrationOnce(options) {
-  const response = await post(options, "claim", {});
+  const claimWork = () => post(options, "claim", {});
+  const response = options.telemetry ? await options.telemetry.observe("migration.claim", claimWork, (value) => value.claim ? "success" : "idle", remoteOutcome) : await claimWork();
   if (!response.claim)
     return { status: "idle" };
   const claim = response.claim;
@@ -114,10 +116,11 @@ async function pullMigrationOnce(options) {
       if (stopped || renewal)
         return;
       let retry;
-      renewal = post(options, "renew", {
+      const renew = () => post(options, "renew", {
         migrationKey: claim.migrationKey,
         claimToken: claim.claimToken
-      }).then((value) => {
+      });
+      renewal = (options.telemetry ? options.telemetry.observe("migration.renew", renew, () => "success", remoteOutcome) : renew()).then((value) => {
         expires = value.claimExpiresAtTs;
       }).catch((cause) => {
         if (cause instanceof SignedNodeHttpError && cause.status < 500) {
@@ -135,7 +138,8 @@ async function pullMigrationOnce(options) {
   schedule();
   let evidence;
   try {
-    evidence = await options.run(claim);
+    const run = () => options.run(claim);
+    evidence = options.telemetry ? await options.telemetry.observe("migration.run", run) : await run();
   } catch (cause) {
     stopped = true;
     clearTimer(timer);
@@ -143,12 +147,16 @@ async function pullMigrationOnce(options) {
     if (lost)
       throw lost;
     const reason = (cause instanceof Error ? cause.message : String(cause)).slice(0, 2000);
-    await complete(options, {
+    const acknowledge2 = () => complete(options, {
       migrationKey: claim.migrationKey,
       claimToken: claim.claimToken,
       ok: false,
       detail: reason
     });
+    if (options.telemetry) {
+      await options.telemetry.observe("migration.complete", acknowledge2, () => "success", remoteOutcome);
+    } else
+      await acknowledge2();
     return { status: "failed", claim, reason };
   }
   stopped = true;
@@ -156,12 +164,16 @@ async function pullMigrationOnce(options) {
   await renewal;
   if (lost)
     throw lost;
-  await complete(options, {
+  const acknowledge = () => complete(options, {
     migrationKey: claim.migrationKey,
     claimToken: claim.claimToken,
     ok: true,
     evidence
   });
+  if (options.telemetry) {
+    await options.telemetry.observe("migration.complete", acknowledge, () => "success", remoteOutcome);
+  } else
+    await acknowledge();
   return { status: "completed", claim, evidence };
 }
 function startMigrationPull(options) {

package/dist/node-vault.d.ts

@@ -1,6 +1,7 @@
 import type { NodeKeyPair } from '@forgezero/runtime/identity';
 import { type SecretCache } from './cache';
 import { type SignedNodeHttpOptions } from './signed-node-http';
+import type { AgentOperationTelemetry } from './telemetry-runtime';
 export interface NodeVaultOptions extends Omit<SignedNodeHttpOptions, 'apiUrl'> {
     /** Tenant node base, for example https://api.example/api/t/acme. */
     apiUrl: string;
@@ -26,6 +27,7 @@ export interface NodeVaultSyncOptions {
     setTimer?: (callback: () => void, ms: number) => unknown;
     clearTimer?: (handle: unknown) => void;
     onEvent?: (event: string, detail?: unknown) => void;
+    telemetry?: AgentOperationTelemetry;
 }
 /** Poll rotation cursors without overlapping calls; stop waits for the active sync. */
 export declare function startNodeVaultSync(cache: SecretCache, options?: NodeVaultSyncOptions): {

package/dist/node-vault.js

@@ -261,7 +261,8 @@ function startNodeVaultSync(cache, options = {}) {
   const tick = () => {
     if (stopped || active)
       return;
-    active = cache.sync().then((result) => options.onEvent?.("synced", result)).catch((cause) => options.onEvent?.("sync-failed", cause)).finally(() => {
+    const sync = () => cache.sync();
+    active = (options.telemetry ? options.telemetry.observe("vault.sync", sync) : sync()).then((result) => options.onEvent?.("synced", result)).catch((cause) => options.onEvent?.("sync-failed", cause)).finally(() => {
       active = null;
       schedule();
     });

package/dist/provision.d.ts

@@ -92,6 +92,12 @@ export interface UnitOptions {
     deploymentCredentials?: Record<string, string>;
     /** Enable authenticated outbound deployment claims after enrolment. */
     pullDeployments?: boolean;
+    /** Production/deployed service boundary. Omit for an ordinary local developer install. */
+    enforceEgress?: boolean;
+    /** Provisioning-owned runner health endpoints; repository commands cannot change them. */
+    runnerLoopbackPorts?: readonly number[];
+    /** Vetted public TCP surface for project commands. Defaults to HTTPS only. */
+    runnerPublicTcpPorts?: readonly number[];
     /** Enable PQ-authenticated lifecycle claims through a constrained root helper. */
     pullMigrations?: boolean;
     /** Root-owned declarative lifecycle profile; never supplied by a migration claim. */
@@ -121,6 +127,8 @@ export interface UnitOptions {
     nodeLabel?: string;
     /** Stable API ingress identity bound by the signed one-time enrolment. */
     nodeHostname?: string;
+    /** Provisioning-owned public HTTPS OTLP coordinate. Production fails closed when absent. */
+    telemetryEndpoint?: string;
 }
 export declare const DEPLOYMENT_RUNNER_USER = "forgezero-runner";
 export declare const DEPLOYMENT_GROUP = "forgezero-deploy";
@@ -135,6 +143,10 @@ export declare const LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero
 export declare const LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
 export declare const WARP_CONFIG_UNIT_PATH = "/etc/systemd/system/forgezero-warp-config.service";
 export declare const WARP_SERVICE_DROP_IN_PATH = "/etc/systemd/system/warp-svc.service.d/forgezero.conf";
+export declare const AGENT_EGRESS_UNIT_PATH = "/etc/systemd/system/forgezero-agent-egress.service";
+export declare const DEFAULT_RUNNER_PUBLIC_TCP_PORTS: readonly [443];
+/** Root-owned policy monitor. The credential-bearing Agent is bound to it. */
+export declare function agentEgressUnit(options: Pick<UnitOptions, 'binPath' | 'user' | 'repository' | 'pullDeployments' | 'runnerLoopbackPorts' | 'runnerPublicTcpPorts'>): string;
 /** Root may execute only package-owned OS strategies selected by id + version. */
 export declare function softwareHelperUnit(options: Pick<UnitOptions, 'binPath'>): string;
 /** Fixed root boundary for verified, health-gated Agent replacement. */
@@ -165,7 +177,7 @@ export declare function lifecycleHelperUnit(options: Pick<UnitOptions, 'binPath'
  * the oneshot skip; a failed exchange keeps the encrypted token for a retry.
  */
 export declare function agentEnrolmentUnit(options: UnitOptions): string;
-export declare function deploymentRunnerUnit(options: Pick<UnitOptions, 'binPath' | 'deployRoot' | 'user'>): string;
+export declare function deploymentRunnerUnit(options: Pick<UnitOptions, 'binPath' | 'deployRoot' | 'user' | 'enforceEgress' | 'runnerLoopbackPorts'>): string;
 /**
  * A systemd unit for the agent.
  *