@forgezero/agent 0.1.65 → 0.1.68

package/README.md

@@ -43,6 +43,7 @@ Every row links to the detailed explanation and named-import/example area below.
 | @forgezero/agent/migration-pull | PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. | Bun/Node host | [Details + example](#forgezero-agent-migration-pull) |
 | @forgezero/agent/lifecycle-helper | The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. | Bun/Node host | [Details + example](#forgezero-agent-lifecycle-helper) |
 | @forgezero/agent/provision | The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. | Bun/Node host | [Details + example](#forgezero-agent-provision) |
+| @forgezero/agent/platform-genesis | Offline authority adapter for the brief pre-API period. It validates exactly three reviewed generic guest requests and converts them to the same Metal claims the live API issues; environment and product tier are not provisioning inputs. | Bun/Node host | [Details + example](#forgezero-agent-platform-genesis) |
 | @forgezero/agent/subscribe | Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. | Bun/Node host | [Details + example](#forgezero-agent-subscribe) |
 | @forgezero/agent/ssh-listen | The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. | Bun/Node host | [Details + example](#forgezero-agent-ssh-listen) |
 | @forgezero/agent/ssh-server | Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. | Bun/Node host | [Details + example](#forgezero-agent-ssh-server) |
@@ -67,14 +68,14 @@ Every row links to the detailed explanation and named-import/example area below.
 | @forgezero/agent/deploy-compiler | Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. | Bun/Node host | [Details + example](#forgezero-agent-deploy-compiler) |
 | @forgezero/agent/deploy-file | Read and validate a checked-out .fz deployment file without executing project input. | Bun/Node host | [Details + example](#forgezero-agent-deploy-file) |
 | @forgezero/agent/metal-bootstrap | Physical-metal bootstrap planning, application and status evidence. | Bun/Node host | [Details + example](#forgezero-agent-metal-bootstrap) |
-| @forgezero/agent/metal-provision | Validated confidential guest provisioning profiles and cloud-init rendering. | Bun/Node host | [Details + example](#forgezero-agent-metal-provision) |
+| @forgezero/agent/metal-provision | The single constrained compute materializer for platform genesis, platform scaling and tenant compute. It executes caller-supplied OS, CPU, memory, disk, bandwidth, network and confidentiality coordinates after capacity and image validation; it owns no environment or product-tier shape. | Bun/Node host | [Details + example](#forgezero-agent-metal-provision) |
 | @forgezero/agent/platform-bootstrap-runtime | Pure platform bootstrap validation, render and resumable phase-state contracts. | Bun/Node host | [Details + example](#forgezero-agent-platform-bootstrap-runtime) |
 | @forgezero/agent/project-context | Project identity and repository context validation for operator and managed runs. | Bun/Node host | [Details + example](#forgezero-agent-project-context) |
 | @forgezero/agent/provisioning-pull | Signed provisioning work claim, renewal, execution and acknowledgement. | Bun/Node host | [Details + example](#forgezero-agent-provisioning-pull) |
 | @forgezero/agent/schema/deploy-v3.json | Published JSON Schema for deployment definition version 3 with exact argv execution. | Bun/Node host | [Details + example](#forgezero-agent-schema-deploy-v3-json) |
 | @forgezero/agent/software | Exact managed-software inventory, requirement and evidence contracts. | Bun/Node host | [Details + example](#forgezero-agent-software) |
 | @forgezero/agent/software-helper | Root-owned fixed installation/update boundary for declared software. | Bun/Node host | [Details + example](#forgezero-agent-software-helper) |
-| @forgezero/agent/ubuntu | Ubuntu host validation and deterministic systemd/unit rendering helpers. | Bun/Node host | [Details + example](#forgezero-agent-ubuntu) |
+| @forgezero/agent/ubuntu | The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. | Bun/Node host | [Details + example](#forgezero-agent-ubuntu) |
 | fz-agent (replica) | The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. | Bun/Node host | [Details + example](#fz-agent-replica) |
 
 ## Commands
@@ -170,137 +171,345 @@ application -> local Unix socket -> project-scoped Vault replica
 <a id="forgezero-agent-migration-pull"></a>
 ## @forgezero/agent/migration-pull
 
-PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. Named value imports: pullMigrationOnce, startMigrationPull. Named type imports: MigrationAction, MigrationEvidence, MigrationEvidenceProfile, MigrationNetwork, MigrationPullOptions, MigrationPullResult, RemoteMigrationClaim. Import only the names used by this file.
+PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { pullMigrationOnce, startMigrationPull } from '@forgezero/agent/migration-pull';
-import type { MigrationAction, MigrationEvidence, MigrationEvidenceProfile, MigrationNetwork, MigrationPullOptions, MigrationPullResult } from '@forgezero/agent/migration-pull';
-import type { RemoteMigrationClaim } from '@forgezero/agent/migration-pull';
+import {
+  pullMigrationOnce,
+  startMigrationPull,
+} from '@forgezero/agent/migration-pull';
+
+import type {
+  MigrationAction,
+  MigrationEvidence,
+  MigrationEvidenceProfile,
+  MigrationNetwork,
+  MigrationPullOptions,
+  MigrationPullResult,
+  RemoteMigrationClaim,
+} from '@forgezero/agent/migration-pull';
 ```
 
 <a id="forgezero-agent-lifecycle-helper"></a>
 ## @forgezero/agent/lifecycle-helper
 
-The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. Named value imports: DEFAULT_LIFECYCLE_HELPER_SOCKET, executeLifecycleAction, loadLifecycleProfile, requestLifecycleAction, spawnLifecycleCommand, startLifecycleHelper, validateLifecycleProfile. Named type imports: LifecycleCommandResult, LifecycleExec, LifecycleProfile. Import only the names used by this file.
+The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. This entry exposes 7 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEFAULT_LIFECYCLE_HELPER_SOCKET, executeLifecycleAction, loadLifecycleProfile, requestLifecycleAction, spawnLifecycleCommand, startLifecycleHelper } from '@forgezero/agent/lifecycle-helper';
-import { validateLifecycleProfile } from '@forgezero/agent/lifecycle-helper';
-import type { LifecycleCommandResult, LifecycleExec, LifecycleProfile } from '@forgezero/agent/lifecycle-helper';
+import {
+  DEFAULT_LIFECYCLE_HELPER_SOCKET,
+  executeLifecycleAction,
+  loadLifecycleProfile,
+  requestLifecycleAction,
+  spawnLifecycleCommand,
+  startLifecycleHelper,
+  validateLifecycleProfile,
+} from '@forgezero/agent/lifecycle-helper';
+
+import type {
+  LifecycleCommandResult,
+  LifecycleExec,
+  LifecycleProfile,
+} from '@forgezero/agent/lifecycle-helper';
 ```
 
 <a id="forgezero-agent-provision"></a>
 ## @forgezero/agent/provision
 
-The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. Named value imports: AGENT_EGRESS_UNIT_PATH, AGENT_SOCKET_PROXY_UNIT_PATH, AGENT_SOCKET_UNIT_PATH, APPLICATION_RUNTIME_USER, CAPABILITY_CHECKS, DEFAULT_RUNNER_PUBLIC_TCP_PORTS, DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_SOCKET, DEPLOYMENT_RUNNER_UNIT_PATH, DEPLOYMENT_RUNNER_USER, ENROLMENT_UNIT_PATH, LIFECYCLE_GROUP, LIFECYCLE_HELPER_SOCKET, LIFECYCLE_HELPER_UNIT_PATH, UNIT_PATH, VAULT_GROUP, WARP_CONFIG_UNIT_PATH, WARP_SERVICE_DROP_IN_PATH, agentBackendSocketPath, agentEgressUnit, agentEnrolmentUnit, agentSocketProxyUnit, agentSocketUnit, agentUnit, agentUpdateHelperUnit, atLeast, deploymentRunnerUnit, lifecycleHelperUnit, modeFor, planProvision, reasonFor, softwareHelperUnit, warpConfigUnit, warpServiceDropIn. Named type imports: AgentMode, Capabilities, CapabilityId, CapabilityOperation, Check, DirectorySpec, FixedHostCommand, ProvisionOperation, ProvisionPlan, Step, UnitOptions. Import only the names used by this file.
+The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. This entry exposes 34 named value exports and 11 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { AGENT_EGRESS_UNIT_PATH, AGENT_SOCKET_PROXY_UNIT_PATH, AGENT_SOCKET_UNIT_PATH, APPLICATION_RUNTIME_USER, CAPABILITY_CHECKS, DEFAULT_RUNNER_PUBLIC_TCP_PORTS } from '@forgezero/agent/provision';
-import { DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_SOCKET, DEPLOYMENT_RUNNER_UNIT_PATH, DEPLOYMENT_RUNNER_USER, ENROLMENT_UNIT_PATH, LIFECYCLE_GROUP } from '@forgezero/agent/provision';
-import { LIFECYCLE_HELPER_SOCKET, LIFECYCLE_HELPER_UNIT_PATH, UNIT_PATH, VAULT_GROUP, WARP_CONFIG_UNIT_PATH, WARP_SERVICE_DROP_IN_PATH } from '@forgezero/agent/provision';
-import { agentBackendSocketPath, agentEgressUnit, agentEnrolmentUnit, agentSocketProxyUnit, agentSocketUnit, agentUnit } from '@forgezero/agent/provision';
-import { agentUpdateHelperUnit, atLeast, deploymentRunnerUnit, lifecycleHelperUnit, modeFor, planProvision } from '@forgezero/agent/provision';
-import { reasonFor, softwareHelperUnit, warpConfigUnit, warpServiceDropIn } from '@forgezero/agent/provision';
-import type { AgentMode, Capabilities, CapabilityId, CapabilityOperation, Check, DirectorySpec } from '@forgezero/agent/provision';
-import type { FixedHostCommand, ProvisionOperation, ProvisionPlan, Step, UnitOptions } from '@forgezero/agent/provision';
+import {
+  AGENT_EGRESS_UNIT_PATH,
+  AGENT_SOCKET_PROXY_UNIT_PATH,
+  AGENT_SOCKET_UNIT_PATH,
+  APPLICATION_RUNTIME_USER,
+  CAPABILITY_CHECKS,
+  DEFAULT_RUNNER_PUBLIC_TCP_PORTS,
+  DEPLOYMENT_GROUP,
+  DEPLOYMENT_RUNNER_SOCKET,
+  DEPLOYMENT_RUNNER_UNIT_PATH,
+  DEPLOYMENT_RUNNER_USER,
+  ENROLMENT_UNIT_PATH,
+  LIFECYCLE_GROUP,
+  LIFECYCLE_HELPER_SOCKET,
+  LIFECYCLE_HELPER_UNIT_PATH,
+  UNIT_PATH,
+  VAULT_GROUP,
+  WARP_CONFIG_UNIT_PATH,
+  WARP_SERVICE_DROP_IN_PATH,
+  agentBackendSocketPath,
+  agentEgressUnit,
+  agentEnrolmentUnit,
+  agentSocketProxyUnit,
+  agentSocketUnit,
+  agentUnit,
+  agentUpdateHelperUnit,
+  atLeast,
+  deploymentRunnerUnit,
+  lifecycleHelperUnit,
+  modeFor,
+  planProvision,
+  reasonFor,
+  softwareHelperUnit,
+  warpConfigUnit,
+  warpServiceDropIn,
+} from '@forgezero/agent/provision';
+
+import type {
+  AgentMode,
+  Capabilities,
+  CapabilityId,
+  CapabilityOperation,
+  Check,
+  DirectorySpec,
+  FixedHostCommand,
+  ProvisionOperation,
+  ProvisionPlan,
+  Step,
+  UnitOptions,
+} from '@forgezero/agent/provision';
+```
+
+<a id="forgezero-agent-platform-genesis"></a>
+## @forgezero/agent/platform-genesis
+
+Offline authority adapter for the brief pre-API period. It validates exactly three reviewed generic guest requests and converts them to the same Metal claims the live API issues; environment and product tier are not provisioning inputs. This entry exposes 4 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+
+```text
+import {
+  platformCommunityRehearsalClaims,
+  platformCommunityRehearsalDeletionClaims,
+  platformGenesisClaims,
+  validatePlatformGenesisGuests,
+} from '@forgezero/agent/platform-genesis';
+
+import type {
+  PlatformGenesisGuest,
+} from '@forgezero/agent/platform-genesis';
 ```
 
 <a id="forgezero-agent-subscribe"></a>
 ## @forgezero/agent/subscribe
 
-Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. Named value imports: backoffMs, subscribe. Named type imports: ChangeFrame, SocketLike, SubscribeOptions, Subscriber. Import only the names used by this file.
+Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { backoffMs, subscribe } from '@forgezero/agent/subscribe';
-import type { ChangeFrame, SocketLike, SubscribeOptions, Subscriber } from '@forgezero/agent/subscribe';
+import {
+  backoffMs,
+  subscribe,
+} from '@forgezero/agent/subscribe';
+
+import type {
+  ChangeFrame,
+  SocketLike,
+  SubscribeOptions,
+  Subscriber,
+} from '@forgezero/agent/subscribe';
 ```
 
 <a id="forgezero-agent-ssh-listen"></a>
 ## @forgezero/agent/ssh-listen
 
-The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. Named value imports: MAX_MESSAGE_BYTES, startSshAgent. Named type imports: SshListenOptions. Import only the names used by this file.
+The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. This entry exposes 2 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { MAX_MESSAGE_BYTES, startSshAgent } from '@forgezero/agent/ssh-listen';
-import type { SshListenOptions } from '@forgezero/agent/ssh-listen';
+import {
+  MAX_MESSAGE_BYTES,
+  startSshAgent,
+} from '@forgezero/agent/ssh-listen';
+
+import type {
+  SshListenOptions,
+} from '@forgezero/agent/ssh-listen';
 ```
 
 <a id="forgezero-agent-ssh-server"></a>
 ## @forgezero/agent/ssh-server
 
-Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. Named value imports: MAX_MESSAGE_BYTES, SSH_AGENT_FAILURE, SSH_AGENT_IDENTITIES_ANSWER, SSH_AGENT_SIGN_RESPONSE, SSH_AGENT_SUCCESS, SshAgentError, describeIdentities, frame, handleMessage, readMessage. Named type imports: AgentBackend, AgentIdentity. Import only the names used by this file.
+Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. This entry exposes 10 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { MAX_MESSAGE_BYTES, SSH_AGENT_FAILURE, SSH_AGENT_IDENTITIES_ANSWER, SSH_AGENT_SIGN_RESPONSE, SSH_AGENT_SUCCESS, SshAgentError } from '@forgezero/agent/ssh-server';
-import { describeIdentities, frame, handleMessage, readMessage } from '@forgezero/agent/ssh-server';
-import type { AgentBackend, AgentIdentity } from '@forgezero/agent/ssh-server';
+import {
+  MAX_MESSAGE_BYTES,
+  SSH_AGENT_FAILURE,
+  SSH_AGENT_IDENTITIES_ANSWER,
+  SSH_AGENT_SIGN_RESPONSE,
+  SSH_AGENT_SUCCESS,
+  SshAgentError,
+  describeIdentities,
+  frame,
+  handleMessage,
+  readMessage,
+} from '@forgezero/agent/ssh-server';
+
+import type {
+  AgentBackend,
+  AgentIdentity,
+} from '@forgezero/agent/ssh-server';
 ```
 
 <a id="forgezero-agent-pipeline"></a>
 ## @forgezero/agent/pipeline
 
-CI/CD on the compute: secrets reach the step that named them and nothing else, attestation gates the run, and a required attestation that fails is a refusal rather than a downgrade. Named value imports: PipelineError, redact, runPipeline. Named type imports: Pipeline, PipelineStep, RunOptions, RunResult, StepOutcome, StepResult. Import only the names used by this file.
+CI/CD on the compute: secrets reach the step that named them and nothing else, attestation gates the run, and a required attestation that fails is a refusal rather than a downgrade. This entry exposes 3 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { PipelineError, redact, runPipeline } from '@forgezero/agent/pipeline';
-import type { Pipeline, PipelineStep, RunOptions, RunResult, StepOutcome, StepResult } from '@forgezero/agent/pipeline';
+import {
+  PipelineError,
+  redact,
+  runPipeline,
+} from '@forgezero/agent/pipeline';
+
+import type {
+  Pipeline,
+  PipelineStep,
+  RunOptions,
+  RunResult,
+  StepOutcome,
+  StepResult,
+} from '@forgezero/agent/pipeline';
 ```
 
 <a id="forgezero-agent-agent-heartbeat"></a>
 ## @forgezero/agent/agent-heartbeat
 
-Signed node health publication with bounded renewal and shutdown withdrawal. Named value imports: heartbeatAgentOnce, observeAgentHost, startAgentHeartbeat. Named type imports: AgentHeartbeatOptions, AgentHeartbeatResponse, AgentObservation. Import only the names used by this file.
+Signed node health publication with bounded renewal and shutdown withdrawal. This entry exposes 3 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { heartbeatAgentOnce, observeAgentHost, startAgentHeartbeat } from '@forgezero/agent/agent-heartbeat';
-import type { AgentHeartbeatOptions, AgentHeartbeatResponse, AgentObservation } from '@forgezero/agent/agent-heartbeat';
+import {
+  heartbeatAgentOnce,
+  observeAgentHost,
+  startAgentHeartbeat,
+} from '@forgezero/agent/agent-heartbeat';
+
+import type {
+  AgentHeartbeatOptions,
+  AgentHeartbeatResponse,
+  AgentObservation,
+} from '@forgezero/agent/agent-heartbeat';
 ```
 
 <a id="forgezero-agent-agent-update"></a>
 ## @forgezero/agent/agent-update
 
-Verified Agent update planning against the platform release coordinate. Named value imports: DEFAULT_AGENT_RELEASE_ROOT, DEFAULT_AGENT_UPDATE_SOCKET, MAX_AGENT_TARBALL_BYTES, compareVersions, restoreAgentRelease, selectAgentRelease, stageAgentRelease, validateAgentRelease. Named type imports: AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResult. Import only the names used by this file.
+Verified Agent update planning against the platform release coordinate. This entry exposes 8 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEFAULT_AGENT_RELEASE_ROOT, DEFAULT_AGENT_UPDATE_SOCKET, MAX_AGENT_TARBALL_BYTES, compareVersions, restoreAgentRelease, selectAgentRelease } from '@forgezero/agent/agent-update';
-import { stageAgentRelease, validateAgentRelease } from '@forgezero/agent/agent-update';
-import type { AgentRelease, StagedAgentRelease, UpdateCommand, UpdateCommandResult } from '@forgezero/agent/agent-update';
+import {
+  DEFAULT_AGENT_RELEASE_ROOT,
+  DEFAULT_AGENT_UPDATE_SOCKET,
+  MAX_AGENT_TARBALL_BYTES,
+  compareVersions,
+  restoreAgentRelease,
+  selectAgentRelease,
+  stageAgentRelease,
+  validateAgentRelease,
+} from '@forgezero/agent/agent-update';
+
+import type {
+  AgentRelease,
+  StagedAgentRelease,
+  UpdateCommand,
+  UpdateCommandResult,
+} from '@forgezero/agent/agent-update';
 ```
 
 <a id="forgezero-agent-agent-update-helper"></a>
 ## @forgezero/agent/agent-update-helper
 
-Root-owned fixed update operations with registry origin and integrity validation. Named value imports: AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_JOURNAL, AGENT_UPDATE_RECEIPT, activateAgentRelease, probeAgentSocket, readAgentUpdateReceipt, recoverInterruptedAgentUpdate, requestAgentUpdate, startAgentUpdateHelper. Named type imports: AgentUpdateOutcome, AgentUpdateReceipt, AgentUpdateRequest, AgentUpdateResponse. Import only the names used by this file.
+Root-owned fixed update operations with registry origin and integrity validation. This entry exposes 10 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { AGENT_UPDATE_GROUP, AGENT_UPDATE_HELPER_UNIT_PATH, AGENT_UPDATE_JOURNAL, AGENT_UPDATE_RECEIPT, activateAgentRelease, probeAgentSocket } from '@forgezero/agent/agent-update-helper';
-import { readAgentUpdateReceipt, recoverInterruptedAgentUpdate, requestAgentUpdate, startAgentUpdateHelper } from '@forgezero/agent/agent-update-helper';
-import type { AgentUpdateOutcome, AgentUpdateReceipt, AgentUpdateRequest, AgentUpdateResponse } from '@forgezero/agent/agent-update-helper';
+import {
+  AGENT_UPDATE_GROUP,
+  AGENT_UPDATE_HELPER_UNIT_PATH,
+  AGENT_UPDATE_JOURNAL,
+  AGENT_UPDATE_RECEIPT,
+  activateAgentRelease,
+  probeAgentSocket,
+  readAgentUpdateReceipt,
+  recoverInterruptedAgentUpdate,
+  requestAgentUpdate,
+  startAgentUpdateHelper,
+} from '@forgezero/agent/agent-update-helper';
+
+import type {
+  AgentUpdateOutcome,
+  AgentUpdateReceipt,
+  AgentUpdateRequest,
+  AgentUpdateResponse,
+} from '@forgezero/agent/agent-update-helper';
 ```
 
 <a id="forgezero-agent-bootstrap"></a>
 ## @forgezero/agent/bootstrap
 
-Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. Named value imports: BOOTSTRAP_STATE_PATH, PLATFORM_BOOTSTRAP_PROFILES, applyBootstrap, bootstrapIdentityDigest, bootstrapStatus, localBootstrapHost, planBootstrap, planBootstrapAgentInstall, readBootstrapConfig, resolveInstalledBootstrapKind, validateBootstrapConfig, validateEnrolledComputeBootstrapSecrets, validatePlatformBootstrapSecrets. Named type imports: BootstrapAgentInstallPhase, BootstrapConfig, BootstrapEnvironment, BootstrapHost, BootstrapPlan, BootstrapResult, BootstrapSecrets, BootstrapStatus, BootstrapStep, DatabaseAgencyParticipation, DatabaseBootstrapRole, EnrolledComputeActivationConfig, EnrolledComputeBootstrapSecrets, InstalledBootstrapKind, PlatformBootstrapConfig, PlatformBootstrapProfile, PlatformBootstrapSecrets, PlatformEnrolmentSource. Import only the names used by this file.
+Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. This entry exposes 13 named value exports and 18 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { BOOTSTRAP_STATE_PATH, PLATFORM_BOOTSTRAP_PROFILES, applyBootstrap, bootstrapIdentityDigest, bootstrapStatus, localBootstrapHost } from '@forgezero/agent/bootstrap';
-import { planBootstrap, planBootstrapAgentInstall, readBootstrapConfig, resolveInstalledBootstrapKind, validateBootstrapConfig, validateEnrolledComputeBootstrapSecrets } from '@forgezero/agent/bootstrap';
-import { validatePlatformBootstrapSecrets } from '@forgezero/agent/bootstrap';
-import type { BootstrapAgentInstallPhase, BootstrapConfig, BootstrapEnvironment, BootstrapHost, BootstrapPlan, BootstrapResult } from '@forgezero/agent/bootstrap';
-import type { BootstrapSecrets, BootstrapStatus, BootstrapStep, DatabaseAgencyParticipation, DatabaseBootstrapRole, EnrolledComputeActivationConfig } from '@forgezero/agent/bootstrap';
-import type { EnrolledComputeBootstrapSecrets, InstalledBootstrapKind, PlatformBootstrapConfig, PlatformBootstrapProfile, PlatformBootstrapSecrets, PlatformEnrolmentSource } from '@forgezero/agent/bootstrap';
+import {
+  BOOTSTRAP_STATE_PATH,
+  PLATFORM_BOOTSTRAP_PROFILES,
+  applyBootstrap,
+  bootstrapIdentityDigest,
+  bootstrapStatus,
+  localBootstrapHost,
+  planBootstrap,
+  planBootstrapAgentInstall,
+  readBootstrapConfig,
+  resolveInstalledBootstrapKind,
+  validateBootstrapConfig,
+  validateEnrolledComputeBootstrapSecrets,
+  validatePlatformBootstrapSecrets,
+} from '@forgezero/agent/bootstrap';
+
+import type {
+  BootstrapAgentInstallPhase,
+  BootstrapConfig,
+  BootstrapEnvironment,
+  BootstrapHost,
+  BootstrapPlan,
+  BootstrapResult,
+  BootstrapSecrets,
+  BootstrapStatus,
+  BootstrapStep,
+  DatabaseAgencyParticipation,
+  DatabaseBootstrapRole,
+  EnrolledComputeActivationConfig,
+  EnrolledComputeBootstrapSecrets,
+  InstalledBootstrapKind,
+  PlatformBootstrapConfig,
+  PlatformBootstrapProfile,
+  PlatformBootstrapSecrets,
+  PlatformEnrolmentSource,
+} from '@forgezero/agent/bootstrap';
 ```
 
 <a id="forgezero-agent-bootstrap-bundle"></a>
 ## @forgezero/agent/bootstrap-bundle
 
-Owner-only exact-revision Git bundle and SHA-256 manifest for credential-free release generation one. Named value imports: BOOTSTRAP_BUNDLE_FORMAT, BOOTSTRAP_BUNDLE_KIND, MAX_BOOTSTRAP_BUNDLE_BYTES, buildBootstrapBundle, parseBootstrapBundleManifest, readBootstrapBundle, sha256File. Named type imports: BootstrapBundleBuildInput, BootstrapBundleBuildResult, BootstrapBundleCommand, BootstrapBundleCommandResult, BootstrapBundleManifest. Import only the names used by this file.
+Owner-only exact-revision Git bundle and SHA-256 manifest for credential-free release generation one. This entry exposes 8 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { BOOTSTRAP_BUNDLE_FORMAT, BOOTSTRAP_BUNDLE_KIND, MAX_BOOTSTRAP_BUNDLE_BYTES, buildBootstrapBundle, parseBootstrapBundleManifest, readBootstrapBundle } from '@forgezero/agent/bootstrap-bundle';
-import { sha256File } from '@forgezero/agent/bootstrap-bundle';
-import type { BootstrapBundleBuildInput, BootstrapBundleBuildResult, BootstrapBundleCommand, BootstrapBundleCommandResult, BootstrapBundleManifest } from '@forgezero/agent/bootstrap-bundle';
+import {
+  BOOTSTRAP_BUNDLE_FORMAT,
+  BOOTSTRAP_BUNDLE_KIND,
+  MAX_BOOTSTRAP_BUNDLE_BYTES,
+  bootstrapBundleBranch,
+  buildBootstrapBundle,
+  parseBootstrapBundleManifest,
+  readBootstrapBundle,
+  sha256File,
+} from '@forgezero/agent/bootstrap-bundle';
+
+import type {
+  BootstrapBundleBuildInput,
+  BootstrapBundleBuildResult,
+  BootstrapBundleCommand,
+  BootstrapBundleCommandResult,
+  BootstrapBundleManifest,
+} from '@forgezero/agent/bootstrap-bundle';
 ```
 
 ## @forgezero/agent/bootstrap-bundle — Build release generation one without a deploy key
@@ -308,7 +517,10 @@ import type { BootstrapBundleBuildInput, BootstrapBundleBuildResult, BootstrapBu
 The builder refuses tracked drift, resolves one exact commit, creates an owner-only Git bundle and writes a byte-count/SHA-256 manifest. Bootstrap consumes the artifact after activation.
 
 ```text
-import { buildBootstrapBundle, readBootstrapBundle } from '@forgezero/agent/bootstrap-bundle';
+import {
+  buildBootstrapBundle,
+  readBootstrapBundle,
+} from '@forgezero/agent/bootstrap-bundle';
 
 const built = await buildBootstrapBundle({
   repositoryRoot: '/work/forgezero-api', branch: 'main',
@@ -320,15 +532,50 @@ await readBootstrapBundle(built.bundlePath, built.manifestPath);
 <a id="forgezero-agent-operator-bootstrap"></a>
 ## @forgezero/agent/operator-bootstrap
 
-Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. Named value imports: applyOperatorMetalBootstrap, applyOperatorPlatformBootstrap, applyOperatorPlatformFleetBootstrap, createOperatorSshHop, planOperatorMetalBootstrap, planOperatorPlatformBootstrap, planOperatorPlatformFleetBootstrap, readOperatorMetalBootstrapRequest, readOperatorPlatformBootstrapFleetRequest, readOperatorPlatformBootstrapRequest, writeOperatorMetalBootstrapRequest, writeOperatorPlatformBootstrapFleetRequest, writeOperatorPlatformBootstrapRequest. Named type imports: OperatorCommand, OperatorCommandResult, OperatorMetalBootstrapMode, OperatorMetalBootstrapPlan, OperatorMetalBootstrapRequest, OperatorPlatformBootstrapFleetOutcome, OperatorPlatformBootstrapFleetPlan, OperatorPlatformBootstrapFleetRequest, OperatorPlatformBootstrapFleetResult, OperatorPlatformBootstrapMode, OperatorPlatformBootstrapOptions, OperatorPlatformBootstrapPlan, OperatorPlatformBootstrapRequest, OperatorSshHop. Import only the names used by this file.
+Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. This entry exposes 19 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { applyOperatorMetalBootstrap, applyOperatorPlatformBootstrap, applyOperatorPlatformFleetBootstrap, createOperatorSshHop, planOperatorMetalBootstrap, planOperatorPlatformBootstrap } from '@forgezero/agent/operator-bootstrap';
-import { planOperatorPlatformFleetBootstrap, readOperatorMetalBootstrapRequest, readOperatorPlatformBootstrapFleetRequest, readOperatorPlatformBootstrapRequest, writeOperatorMetalBootstrapRequest, writeOperatorPlatformBootstrapFleetRequest } from '@forgezero/agent/operator-bootstrap';
-import { writeOperatorPlatformBootstrapRequest } from '@forgezero/agent/operator-bootstrap';
-import type { OperatorCommand, OperatorCommandResult, OperatorMetalBootstrapMode, OperatorMetalBootstrapPlan, OperatorMetalBootstrapRequest, OperatorPlatformBootstrapFleetOutcome } from '@forgezero/agent/operator-bootstrap';
-import type { OperatorPlatformBootstrapFleetPlan, OperatorPlatformBootstrapFleetRequest, OperatorPlatformBootstrapFleetResult, OperatorPlatformBootstrapMode, OperatorPlatformBootstrapOptions, OperatorPlatformBootstrapPlan } from '@forgezero/agent/operator-bootstrap';
-import type { OperatorPlatformBootstrapRequest, OperatorSshHop } from '@forgezero/agent/operator-bootstrap';
+import {
+  applyOperatorMetalBootstrap,
+  applyOperatorPlatformBootstrap,
+  applyOperatorPlatformFleetBootstrap,
+  collectOperatorGuestHostKeys,
+  createOperatorSshHop,
+  operatorPlatformFleetCoordinates,
+  planOperatorMetalBootstrap,
+  planOperatorPlatformBootstrap,
+  planOperatorPlatformFleetBootstrap,
+  readOperatorGuestHostKeyEvidence,
+  readOperatorMetalBootstrapRequest,
+  readOperatorPlatformBootstrapFleetRequest,
+  readOperatorPlatformBootstrapRequest,
+  verifyOperatorPlatformFleet,
+  withOperatorGuestTransport,
+  writeOperatorGuestHostKeyEvidence,
+  writeOperatorMetalBootstrapRequest,
+  writeOperatorPlatformBootstrapFleetRequest,
+  writeOperatorPlatformBootstrapRequest,
+} from '@forgezero/agent/operator-bootstrap';
+
+import type {
+  OperatorCommand,
+  OperatorCommandResult,
+  OperatorGuestHostKeyEvidence,
+  OperatorGuestTransport,
+  OperatorMetalBootstrapMode,
+  OperatorMetalBootstrapPlan,
+  OperatorMetalBootstrapRequest,
+  OperatorPlatformBootstrapFleetOutcome,
+  OperatorPlatformBootstrapFleetPlan,
+  OperatorPlatformBootstrapFleetRequest,
+  OperatorPlatformBootstrapFleetResult,
+  OperatorPlatformBootstrapMode,
+  OperatorPlatformBootstrapOptions,
+  OperatorPlatformBootstrapPlan,
+  OperatorPlatformBootstrapRequest,
+  OperatorPlatformFleetCoordinates,
+  OperatorSshHop,
+} from '@forgezero/agent/operator-bootstrap';
 ```
 
 ## @forgezero/agent/operator-bootstrap — Run the same typed platform bootstrap from an operator laptop
@@ -344,11 +591,21 @@ fz bootstrap platform remote apply --bootstrap-config /secure/forgezero/developm
 <a id="forgezero-agent-host-maintenance"></a>
 ## @forgezero/agent/host-maintenance
 
-Closed host maintenance plans for staging transaction rehearsal and fleet-fenced schema consolidation through fixed transient systemd units. Named value imports: applyHostMaintenance, planHostMaintenance. Named type imports: HostMaintenanceOperation, HostMaintenancePlan, HostMaintenanceRequest, HostMaintenanceResult, HostMaintenanceRuntime. Import only the names used by this file.
+Closed host maintenance plans for staging transaction rehearsal and fleet-fenced schema consolidation through fixed transient systemd units. This entry exposes 2 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { applyHostMaintenance, planHostMaintenance } from '@forgezero/agent/host-maintenance';
-import type { HostMaintenanceOperation, HostMaintenancePlan, HostMaintenanceRequest, HostMaintenanceResult, HostMaintenanceRuntime } from '@forgezero/agent/host-maintenance';
+import {
+  applyHostMaintenance,
+  planHostMaintenance,
+} from '@forgezero/agent/host-maintenance';
+
+import type {
+  HostMaintenanceOperation,
+  HostMaintenancePlan,
+  HostMaintenanceRequest,
+  HostMaintenanceResult,
+  HostMaintenanceRuntime,
+} from '@forgezero/agent/host-maintenance';
 ```
 
 ## @forgezero/agent/host-maintenance — Plan a fixed supervised host operation
@@ -356,7 +613,9 @@ import type { HostMaintenanceOperation, HostMaintenancePlan, HostMaintenanceRequ
 The library discovers only a trusted blue/green slot, attaches fixed credential names and returns exact argv as reviewable data. The public fz host commands use the same operation and require root only for apply.
 
 ```text
-import { planHostMaintenance } from '@forgezero/agent/host-maintenance';
+import {
+  planHostMaintenance,
+} from '@forgezero/agent/host-maintenance';
 
 const plan = planHostMaintenance({ operation: 'schema-plan' });
 console.log(plan.argv);
@@ -365,97 +624,248 @@ console.log(plan.argv);
 <a id="forgezero-agent-capacity-calibration"></a>
 ## @forgezero/agent/capacity-calibration
 
-One-time target-local safe-concurrency calibration with private evidence. Named value imports: calibrateHttpConcurrency, localCalibrationEndpoint, validateCapacityCalibrationOptions. Named type imports: CapacityCalibration, CapacityCalibrationOptions, CapacityStage, ValidatedCapacityCalibrationOptions. Import only the names used by this file.
+One-time target-local safe-concurrency calibration with private evidence. This entry exposes 3 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { calibrateHttpConcurrency, localCalibrationEndpoint, validateCapacityCalibrationOptions } from '@forgezero/agent/capacity-calibration';
-import type { CapacityCalibration, CapacityCalibrationOptions, CapacityStage, ValidatedCapacityCalibrationOptions } from '@forgezero/agent/capacity-calibration';
+import {
+  calibrateHttpConcurrency,
+  localCalibrationEndpoint,
+  validateCapacityCalibrationOptions,
+} from '@forgezero/agent/capacity-calibration';
+
+import type {
+  CapacityCalibration,
+  CapacityCalibrationOptions,
+  CapacityStage,
+  ValidatedCapacityCalibrationOptions,
+} from '@forgezero/agent/capacity-calibration';
 ```
 
 <a id="forgezero-agent-cloudflare-bootstrap"></a>
 ## @forgezero/agent/cloudflare-bootstrap
 
-Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. Named value imports: applyCloudflareBootstrap, cloudflareHostHandoffPath, deriveCloudflareRealtimeSecrets, finalizeCloudflareBootstrapAcceptance, planCloudflareBootstrap, readCloudflareBootstrapAcceptanceEvidence, readCloudflareConnectorHandoff, readCloudflareHostHandoff, runAttendedCloudflareBootstrap, validateCloudflareBootstrapCoordinates, validateCloudflareBootstrapTokens, verifyCloudflareBootstrapAcceptance, writeOwnerBootstrapOutput. Named type imports: AttendedCloudflareBootstrapRequest, CloudflareBootstrapAcceptanceEvidence, CloudflareBootstrapAcceptedNode, CloudflareBootstrapCoordinates, CloudflareBootstrapDependencies, CloudflareBootstrapEvidence, CloudflareBootstrapFinalizeRequest, CloudflareBootstrapNodeCoordinates, CloudflareBootstrapOutput, CloudflareBootstrapPhaseRunner, CloudflareBootstrapPlan, CloudflareBootstrapTokens, CloudflareConnectorHandoff, CloudflareHostHandoff, CloudflareMeshCoordinates, CloudflareRealtimeCoordinates. Import only the names used by this file.
+Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. This entry exposes 13 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { applyCloudflareBootstrap, cloudflareHostHandoffPath, deriveCloudflareRealtimeSecrets, finalizeCloudflareBootstrapAcceptance, planCloudflareBootstrap, readCloudflareBootstrapAcceptanceEvidence } from '@forgezero/agent/cloudflare-bootstrap';
-import { readCloudflareConnectorHandoff, readCloudflareHostHandoff, runAttendedCloudflareBootstrap, validateCloudflareBootstrapCoordinates, validateCloudflareBootstrapTokens, verifyCloudflareBootstrapAcceptance } from '@forgezero/agent/cloudflare-bootstrap';
-import { writeOwnerBootstrapOutput } from '@forgezero/agent/cloudflare-bootstrap';
-import type { AttendedCloudflareBootstrapRequest, CloudflareBootstrapAcceptanceEvidence, CloudflareBootstrapAcceptedNode, CloudflareBootstrapCoordinates, CloudflareBootstrapDependencies, CloudflareBootstrapEvidence } from '@forgezero/agent/cloudflare-bootstrap';
-import type { CloudflareBootstrapFinalizeRequest, CloudflareBootstrapNodeCoordinates, CloudflareBootstrapOutput, CloudflareBootstrapPhaseRunner, CloudflareBootstrapPlan, CloudflareBootstrapTokens } from '@forgezero/agent/cloudflare-bootstrap';
-import type { CloudflareConnectorHandoff, CloudflareHostHandoff, CloudflareMeshCoordinates, CloudflareRealtimeCoordinates } from '@forgezero/agent/cloudflare-bootstrap';
+import {
+  applyCloudflareBootstrap,
+  cloudflareHostHandoffPath,
+  deriveCloudflareRealtimeSecrets,
+  finalizeCloudflareBootstrapAcceptance,
+  planCloudflareBootstrap,
+  readCloudflareBootstrapAcceptanceEvidence,
+  readCloudflareConnectorHandoff,
+  readCloudflareHostHandoff,
+  runAttendedCloudflareBootstrap,
+  validateCloudflareBootstrapCoordinates,
+  validateCloudflareBootstrapTokens,
+  verifyCloudflareBootstrapAcceptance,
+  writeOwnerBootstrapOutput,
+} from '@forgezero/agent/cloudflare-bootstrap';
+
+import type {
+  AttendedCloudflareBootstrapRequest,
+  CloudflareBootstrapAcceptanceEvidence,
+  CloudflareBootstrapAcceptedNode,
+  CloudflareBootstrapCoordinates,
+  CloudflareBootstrapDependencies,
+  CloudflareBootstrapEvidence,
+  CloudflareBootstrapFinalizeRequest,
+  CloudflareBootstrapNodeCoordinates,
+  CloudflareBootstrapOutput,
+  CloudflareBootstrapPhaseRunner,
+  CloudflareBootstrapPlan,
+  CloudflareBootstrapTokens,
+  CloudflareConnectorHandoff,
+  CloudflareHostHandoff,
+  CloudflareMeshCoordinates,
+  CloudflareRealtimeCoordinates,
+} from '@forgezero/agent/cloudflare-bootstrap';
 ```
 
 <a id="forgezero-agent-cloudflare-edge"></a>
 ## @forgezero/agent/cloudflare-edge
 
-Strict Cloudflare REST operations used by the attended bootstrap controller. Named value imports: configureCloudflareEdge, configureCloudflareRealtimeSecrets, discoverCloudflareBootstrapResources, ensureCloudflareMeshConnector, ensureCloudflarePrivateDatabaseRoute, ensureCloudflarePrivateRoute, ensureCloudflareTunnel, ensureCloudflareWarpDatabaseInclude, ensureCloudflareWarpNetworkIncludes, removeCloudflarePrivateDatabaseRoute, removeCloudflarePrivateRoute, removeCloudflareWarpDatabaseInclude, retrieveCloudflareConnectorTokens, verifyCloudflareWorkerDurableObjects. Named type imports: CloudflareBootstrapDiscovery, CloudflareDurableObjectNamespace, CloudflareEdgeConfig, CloudflareMeshConnector, CloudflarePrivateRoute, CloudflarePrivateRouteConfig, CloudflareTunnel, CloudflareWarpIncludeConfig. Import only the names used by this file.
+Strict Cloudflare REST operations used by the attended bootstrap controller. This entry exposes 14 named value exports and 8 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { configureCloudflareEdge, configureCloudflareRealtimeSecrets, discoverCloudflareBootstrapResources, ensureCloudflareMeshConnector, ensureCloudflarePrivateDatabaseRoute, ensureCloudflarePrivateRoute } from '@forgezero/agent/cloudflare-edge';
-import { ensureCloudflareTunnel, ensureCloudflareWarpDatabaseInclude, ensureCloudflareWarpNetworkIncludes, removeCloudflarePrivateDatabaseRoute, removeCloudflarePrivateRoute, removeCloudflareWarpDatabaseInclude } from '@forgezero/agent/cloudflare-edge';
-import { retrieveCloudflareConnectorTokens, verifyCloudflareWorkerDurableObjects } from '@forgezero/agent/cloudflare-edge';
-import type { CloudflareBootstrapDiscovery, CloudflareDurableObjectNamespace, CloudflareEdgeConfig, CloudflareMeshConnector, CloudflarePrivateRoute, CloudflarePrivateRouteConfig } from '@forgezero/agent/cloudflare-edge';
-import type { CloudflareTunnel, CloudflareWarpIncludeConfig } from '@forgezero/agent/cloudflare-edge';
+import {
+  configureCloudflareEdge,
+  configureCloudflareRealtimeSecrets,
+  discoverCloudflareBootstrapResources,
+  ensureCloudflareMeshConnector,
+  ensureCloudflarePrivateDatabaseRoute,
+  ensureCloudflarePrivateRoute,
+  ensureCloudflareTunnel,
+  ensureCloudflareWarpDatabaseInclude,
+  ensureCloudflareWarpNetworkIncludes,
+  removeCloudflarePrivateDatabaseRoute,
+  removeCloudflarePrivateRoute,
+  removeCloudflareWarpDatabaseInclude,
+  retrieveCloudflareConnectorTokens,
+  verifyCloudflareWorkerDurableObjects,
+} from '@forgezero/agent/cloudflare-edge';
+
+import type {
+  CloudflareBootstrapDiscovery,
+  CloudflareDurableObjectNamespace,
+  CloudflareEdgeConfig,
+  CloudflareMeshConnector,
+  CloudflarePrivateRoute,
+  CloudflarePrivateRouteConfig,
+  CloudflareTunnel,
+  CloudflareWarpIncludeConfig,
+} from '@forgezero/agent/cloudflare-edge';
 ```
 
 <a id="forgezero-agent-mesh-connector"></a>
 ## @forgezero/agent/mesh-connector
 
-Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. Named value imports: configureMeshConnector, readMeshConnectorCredential. Named type imports: MeshConnectorCommandResult, MeshConnectorExec. Import only the names used by this file.
+Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. This entry exposes 2 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { configureMeshConnector, readMeshConnectorCredential } from '@forgezero/agent/mesh-connector';
-import type { MeshConnectorCommandResult, MeshConnectorExec } from '@forgezero/agent/mesh-connector';
+import {
+  configureMeshConnector,
+  readMeshConnectorCredential,
+} from '@forgezero/agent/mesh-connector';
+
+import type {
+  MeshConnectorCommandResult,
+  MeshConnectorExec,
+} from '@forgezero/agent/mesh-connector';
 ```
 
 <a id="forgezero-agent-compute"></a>
 ## @forgezero/agent/compute
 
-Compute claim, renewal, execution and completion client contracts. Named value imports: ComputeError, deviceInUse, guestUnit, parseCensus, qemuArgv, shapeEgressCommands, shapeEgressUnitDirectives, tapFor, unitName. Named type imports: GuestSpec, RunningGuest. Import only the names used by this file.
+Compute claim, renewal, execution and completion client contracts. This entry exposes 9 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { ComputeError, deviceInUse, guestUnit, parseCensus, qemuArgv, shapeEgressCommands } from '@forgezero/agent/compute';
-import { shapeEgressUnitDirectives, tapFor, unitName } from '@forgezero/agent/compute';
-import type { GuestSpec, RunningGuest } from '@forgezero/agent/compute';
+import {
+  ComputeError,
+  deviceInUse,
+  guestUnit,
+  parseCensus,
+  qemuArgv,
+  shapeEgressCommands,
+  shapeEgressUnitDirectives,
+  tapFor,
+  unitName,
+} from '@forgezero/agent/compute';
+
+import type {
+  GuestSpec,
+  RunningGuest,
+} from '@forgezero/agent/compute';
 ```
 
 <a id="forgezero-agent-credential-schema"></a>
 ## @forgezero/agent/credential-schema
 
-Canonical systemd credential names and validation shared by bootstrap and services. Named value imports: AGENT_CREDENTIAL_LOCATIONS, AGENT_CREDENTIAL_POLICY, CLOUDFLARE_CREDENTIAL_NAMES, CLOUDFLARE_CREDENTIAL_SCHEMA, METAL_SYSTEMD_CREDENTIALS, credentialBinding, deploymentCredentialSchema. Named type imports: AgentCredentialLocation, DeploymentCredentialBinding, DeploymentCredentialSchema. Import only the names used by this file.
+Canonical systemd credential names and validation shared by bootstrap and services. This entry exposes 7 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { AGENT_CREDENTIAL_LOCATIONS, AGENT_CREDENTIAL_POLICY, CLOUDFLARE_CREDENTIAL_NAMES, CLOUDFLARE_CREDENTIAL_SCHEMA, METAL_SYSTEMD_CREDENTIALS, credentialBinding } from '@forgezero/agent/credential-schema';
-import { deploymentCredentialSchema } from '@forgezero/agent/credential-schema';
-import type { AgentCredentialLocation, DeploymentCredentialBinding, DeploymentCredentialSchema } from '@forgezero/agent/credential-schema';
+import {
+  AGENT_CREDENTIAL_LOCATIONS,
+  AGENT_CREDENTIAL_POLICY,
+  CLOUDFLARE_CREDENTIAL_NAMES,
+  CLOUDFLARE_CREDENTIAL_SCHEMA,
+  METAL_SYSTEMD_CREDENTIALS,
+  credentialBinding,
+  deploymentCredentialSchema,
+} from '@forgezero/agent/credential-schema';
+
+import type {
+  AgentCredentialLocation,
+  DeploymentCredentialBinding,
+  DeploymentCredentialSchema,
+} from '@forgezero/agent/credential-schema';
 ```
 
 <a id="forgezero-agent-definition"></a>
 ## @forgezero/agent/definition
 
-Legacy version 3 JSON deployment compatibility contract. Named value imports: DEPLOY_SCHEMA_URL, DefinitionError, PIPELINE_VERSION, parseDeployDefinition, phasePipeline, validateDeploymentService. Named type imports: DeployDefinition, DeployStep, DeploymentPortAllocation, DeploymentService, PipelineProfile. Import only the names used by this file.
+Legacy version 3 JSON deployment compatibility contract. This entry exposes 6 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEPLOY_SCHEMA_URL, DefinitionError, PIPELINE_VERSION, parseDeployDefinition, phasePipeline, validateDeploymentService } from '@forgezero/agent/definition';
-import type { DeployDefinition, DeployStep, DeploymentPortAllocation, DeploymentService, PipelineProfile } from '@forgezero/agent/definition';
+import {
+  DEPLOY_SCHEMA_URL,
+  DefinitionError,
+  PIPELINE_VERSION,
+  parseDeployDefinition,
+  phasePipeline,
+  validateDeploymentService,
+} from '@forgezero/agent/definition';
+
+import type {
+  DeployDefinition,
+  DeployStep,
+  DeploymentPortAllocation,
+  DeploymentService,
+  PipelineProfile,
+} from '@forgezero/agent/definition';
 ```
 
 <a id="forgezero-agent-deploy"></a>
 ## @forgezero/agent/deploy
 
-Typed deployment authoring builders, built-in provider requirements and versioned action constructors. Named value imports: actions, application, conditions, credential, database, defineDeployment, input, providers, ref, requirement, stage, step, target, workflow. Named type imports: ApplicationComponent, ApplicationRuntime, ArangoDbProviderConfig, BunProviderConfig, CloudflaredProviderConfig, ComponentDefinition, Condition, ConditionOperand, CredentialDefinition, DatabaseComponent, DeploymentSource, DockerProviderConfig, HealthDefinition, InputDefinition, JsonObject, JsonPrimitive, JsonValue, NetworkDefinition, NginxProviderConfig, OpenSshProviderConfig, RequirementDefinition, ResolvableJsonObject, ResolvableJsonValue, ResourceDefinition, RetryDefinition, StageDefinition, StepScope, StorageMount, SystemdProviderConfig, TargetDefinition, UfwProviderConfig, ValueReference, WarpProviderConfig, WorkflowDefinition, WorkflowStepDefinition. Import only the names used by this file.
+Typed deployment authoring builders, built-in provider requirements and versioned action constructors. This entry exposes 14 named value exports and 35 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { actions, application, conditions, credential, database, defineDeployment } from '@forgezero/agent/deploy';
-import { input, providers, ref, requirement, stage, step } from '@forgezero/agent/deploy';
-import { target, workflow } from '@forgezero/agent/deploy';
-import type { ApplicationComponent, ApplicationRuntime, ArangoDbProviderConfig, BunProviderConfig, CloudflaredProviderConfig, ComponentDefinition } from '@forgezero/agent/deploy';
-import type { Condition, ConditionOperand, CredentialDefinition, DatabaseComponent, DeploymentSource, DockerProviderConfig } from '@forgezero/agent/deploy';
-import type { HealthDefinition, InputDefinition, JsonObject, JsonPrimitive, JsonValue, NetworkDefinition } from '@forgezero/agent/deploy';
-import type { NginxProviderConfig, OpenSshProviderConfig, RequirementDefinition, ResolvableJsonObject, ResolvableJsonValue, ResourceDefinition } from '@forgezero/agent/deploy';
-import type { RetryDefinition, StageDefinition, StepScope, StorageMount, SystemdProviderConfig, TargetDefinition } from '@forgezero/agent/deploy';
-import type { UfwProviderConfig, ValueReference, WarpProviderConfig, WorkflowDefinition, WorkflowStepDefinition } from '@forgezero/agent/deploy';
+import {
+  actions,
+  application,
+  conditions,
+  credential,
+  database,
+  defineDeployment,
+  input,
+  providers,
+  ref,
+  requirement,
+  stage,
+  step,
+  target,
+  workflow,
+} from '@forgezero/agent/deploy';
+
+import type {
+  ApplicationComponent,
+  ApplicationRuntime,
+  ArangoDbProviderConfig,
+  BunProviderConfig,
+  CloudflaredProviderConfig,
+  ComponentDefinition,
+  Condition,
+  ConditionOperand,
+  CredentialDefinition,
+  DatabaseComponent,
+  DeploymentSource,
+  DockerProviderConfig,
+  HealthDefinition,
+  InputDefinition,
+  JsonObject,
+  JsonPrimitive,
+  JsonValue,
+  NetworkDefinition,
+  NginxProviderConfig,
+  OpenSshProviderConfig,
+  RequirementDefinition,
+  ResolvableJsonObject,
+  ResolvableJsonValue,
+  ResourceDefinition,
+  RetryDefinition,
+  StageDefinition,
+  StepScope,
+  StorageMount,
+  SystemdProviderConfig,
+  TargetDefinition,
+  UfwProviderConfig,
+  ValueReference,
+  WarpProviderConfig,
+  WorkflowDefinition,
+  WorkflowStepDefinition,
+} from '@forgezero/agent/deploy';
 ```
 
 ## @forgezero/agent/deploy — Author a typed native or Docker deployment
@@ -463,7 +873,15 @@ import type { UfwProviderConfig, ValueReference, WarpProviderConfig, WorkflowDef
 TypeScript is authoring only. The checked-in canonical plan is what Agents validate and execute. Docker is additive: native Bun/ArangoDB remains available, while container applications must declare hard CPU, memory and PID limits, storage class, loopback ingress and a fixed health gate.
 
 ```text
-import { actions, application, defineDeployment, providers, stage, target, workflow } from '@forgezero/agent/deploy';
+import {
+  actions,
+  application,
+  defineDeployment,
+  providers,
+  stage,
+  target,
+  workflow,
+} from '@forgezero/agent/deploy';
 
 export default defineDeployment({
   apiVersion: 'deploy.forgezero.net/v1', kind: 'Deployment',
@@ -490,23 +908,50 @@ export default defineDeployment({
 <a id="forgezero-agent-deploy-plan"></a>
 ## @forgezero/agent/deploy-plan
 
-Runtime validation, canonicalization and semantic digest for inert deployment plans. Named value imports: DEPLOY_PLAN_FORMAT, DEPLOY_PLAN_VERSION, DeploymentPlanError, canonicalJson, compileDeployment, deploymentPlanDigest, deploymentSourceDigest, parseDeploymentPlan. Named type imports: DeploymentPlan, PlannedStage, PlannedStep, PlannedWorkflow. Import only the names used by this file.
+Runtime validation, canonicalization and semantic digest for inert deployment plans. This entry exposes 8 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEPLOY_PLAN_FORMAT, DEPLOY_PLAN_VERSION, DeploymentPlanError, canonicalJson, compileDeployment, deploymentPlanDigest } from '@forgezero/agent/deploy-plan';
-import { deploymentSourceDigest, parseDeploymentPlan } from '@forgezero/agent/deploy-plan';
-import type { DeploymentPlan, PlannedStage, PlannedStep, PlannedWorkflow } from '@forgezero/agent/deploy-plan';
+import {
+  DEPLOY_PLAN_FORMAT,
+  DEPLOY_PLAN_VERSION,
+  DeploymentPlanError,
+  canonicalJson,
+  compileDeployment,
+  deploymentPlanDigest,
+  deploymentSourceDigest,
+  parseDeploymentPlan,
+} from '@forgezero/agent/deploy-plan';
+
+import type {
+  DeploymentPlan,
+  PlannedStage,
+  PlannedStep,
+  PlannedWorkflow,
+} from '@forgezero/agent/deploy-plan';
 ```
 
 <a id="forgezero-agent-deploy-plan-runner"></a>
 ## @forgezero/agent/deploy-plan-runner
 
-Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. Named value imports: DeploymentActionError, evaluateCondition, runDeploymentPlan. Named type imports: ActionContext, ActionExecutionResult, ActionFailureKind, ActionHandler, PlanRunResult, PlanStepStatus, RunDeploymentPlanOptions, StepExecutionRecord. Import only the names used by this file.
+Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. This entry exposes 3 named value exports and 8 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DeploymentActionError, evaluateCondition, runDeploymentPlan } from '@forgezero/agent/deploy-plan-runner';
-import type { ActionContext, ActionExecutionResult, ActionFailureKind, ActionHandler, PlanRunResult, PlanStepStatus } from '@forgezero/agent/deploy-plan-runner';
-import type { RunDeploymentPlanOptions, StepExecutionRecord } from '@forgezero/agent/deploy-plan-runner';
+import {
+  DeploymentActionError,
+  evaluateCondition,
+  runDeploymentPlan,
+} from '@forgezero/agent/deploy-plan-runner';
+
+import type {
+  ActionContext,
+  ActionExecutionResult,
+  ActionFailureKind,
+  ActionHandler,
+  PlanRunResult,
+  PlanStepStatus,
+  RunDeploymentPlanOptions,
+  StepExecutionRecord,
+} from '@forgezero/agent/deploy-plan-runner';
 ```
 
 ## @forgezero/agent/deploy-plan-runner — Extend the plan with a namespaced action
@@ -514,8 +959,12 @@ import type { RunDeploymentPlanOptions, StepExecutionRecord } from '@forgezero/a
 Public projects can define a versioned action coordinate and install an exact handler. Built-in forgezero.* coordinates stay closed; unknown built-ins fail validation.
 
 ```text
-import { actions } from '@forgezero/agent/deploy';
-import { runDeploymentPlan } from '@forgezero/agent/deploy-plan-runner';
+import {
+  actions,
+} from '@forgezero/agent/deploy';
+import {
+  runDeploymentPlan,
+} from '@forgezero/agent/deploy-plan-runner';
 
 const notify = actions.extension('example.notifications/publish@1', { channel: 'deployments' }, {
   scope: { kind: 'release-executor' },
@@ -531,79 +980,188 @@ await runDeploymentPlan({
 <a id="forgezero-agent-deploy-compiler"></a>
 ## @forgezero/agent/deploy-compiler
 
-Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. Named value imports: DEPLOY_PLAN_FILE, DEPLOY_SOURCE_FILE, compileDeploymentProject, defaultTypeScriptDeployment, initializeTypeScriptDeployment, inspectCompiledDeployment, loadDeploymentSource. Named type imports: DeploymentCompilation. Import only the names used by this file.
+Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. This entry exposes 7 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEPLOY_PLAN_FILE, DEPLOY_SOURCE_FILE, compileDeploymentProject, defaultTypeScriptDeployment, initializeTypeScriptDeployment, inspectCompiledDeployment } from '@forgezero/agent/deploy-compiler';
-import { loadDeploymentSource } from '@forgezero/agent/deploy-compiler';
-import type { DeploymentCompilation } from '@forgezero/agent/deploy-compiler';
+import {
+  DEPLOY_PLAN_FILE,
+  DEPLOY_SOURCE_FILE,
+  compileDeploymentProject,
+  defaultTypeScriptDeployment,
+  initializeTypeScriptDeployment,
+  inspectCompiledDeployment,
+  loadDeploymentSource,
+} from '@forgezero/agent/deploy-compiler';
+
+import type {
+  DeploymentCompilation,
+} from '@forgezero/agent/deploy-compiler';
 ```
 
 <a id="forgezero-agent-deploy-file"></a>
 ## @forgezero/agent/deploy-file
 
-Read and validate a checked-out .fz deployment file without executing project input. Named value imports: DEPLOY_FILE, DEPLOY_SCHEMA_URL, DEPLOY_TODO_PREFIX, defaultDeployFile, deployDefinitionDigest, initializeDeployFile, inspectDeployFile. Named type imports: DeployFileSummary, InitializedDeployFile. Import only the names used by this file.
+Read and validate a checked-out .fz deployment file without executing project input. This entry exposes 7 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEPLOY_FILE, DEPLOY_SCHEMA_URL, DEPLOY_TODO_PREFIX, defaultDeployFile, deployDefinitionDigest, initializeDeployFile } from '@forgezero/agent/deploy-file';
-import { inspectDeployFile } from '@forgezero/agent/deploy-file';
-import type { DeployFileSummary, InitializedDeployFile } from '@forgezero/agent/deploy-file';
+import {
+  DEPLOY_FILE,
+  DEPLOY_SCHEMA_URL,
+  DEPLOY_TODO_PREFIX,
+  defaultDeployFile,
+  deployDefinitionDigest,
+  initializeDeployFile,
+  inspectDeployFile,
+} from '@forgezero/agent/deploy-file';
+
+import type {
+  DeployFileSummary,
+  InitializedDeployFile,
+} from '@forgezero/agent/deploy-file';
 ```
 
 <a id="forgezero-agent-metal-bootstrap"></a>
 ## @forgezero/agent/metal-bootstrap
 
-Physical-metal bootstrap planning, application and status evidence. Named value imports: METAL_BOOTSTRAP_STATE_PATH, MetalBootstrapError, applyMetalBootstrap, metalBootstrapStatus, normalizeMetalPublicIdentity, planMetalBootstrap, readMetalBootstrapConfig, renderMetalUnits, validateMetalBootstrapConfig, validateOwnerOnlyPath. Named type imports: MetalBootstrapApplyOptions, MetalBootstrapConfig, MetalBootstrapExec, MetalBootstrapPlan, MetalBootstrapResult, MetalBootstrapStatus. Import only the names used by this file.
+Physical-metal bootstrap planning, application and status evidence. This entry exposes 10 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { METAL_BOOTSTRAP_STATE_PATH, MetalBootstrapError, applyMetalBootstrap, metalBootstrapStatus, normalizeMetalPublicIdentity, planMetalBootstrap } from '@forgezero/agent/metal-bootstrap';
-import { readMetalBootstrapConfig, renderMetalUnits, validateMetalBootstrapConfig, validateOwnerOnlyPath } from '@forgezero/agent/metal-bootstrap';
-import type { MetalBootstrapApplyOptions, MetalBootstrapConfig, MetalBootstrapExec, MetalBootstrapPlan, MetalBootstrapResult, MetalBootstrapStatus } from '@forgezero/agent/metal-bootstrap';
+import {
+  METAL_BOOTSTRAP_STATE_PATH,
+  MetalBootstrapError,
+  applyMetalBootstrap,
+  metalBootstrapStatus,
+  normalizeMetalPublicIdentity,
+  planMetalBootstrap,
+  readMetalBootstrapConfig,
+  renderMetalUnits,
+  validateMetalBootstrapConfig,
+  validateOwnerOnlyPath,
+} from '@forgezero/agent/metal-bootstrap';
+
+import type {
+  MetalBootstrapApplyOptions,
+  MetalBootstrapConfig,
+  MetalBootstrapExec,
+  MetalBootstrapPlan,
+  MetalBootstrapResult,
+  MetalBootstrapStatus,
+} from '@forgezero/agent/metal-bootstrap';
 ```
 
 <a id="forgezero-agent-metal-provision"></a>
 ## @forgezero/agent/metal-provision
 
-Validated confidential guest provisioning profiles and cloud-init rendering. Named value imports: MetalProvisionError, allocateAddress, allocateCpuPool, cloudInit, guestBootstrapOperations, guestNameFor, macForAddress, provisionMetalGuest, removeMetalGuest, tapNameFor, validateMetalProfile. Named type imports: GuestManifest, MetalCommandResult, MetalCpuPool, MetalExec, MetalImage, MetalProvisionProfile. Import only the names used by this file.
+The single constrained compute materializer for platform genesis, platform scaling and tenant compute. It executes caller-supplied OS, CPU, memory, disk, bandwidth, network and confidentiality coordinates after capacity and image validation; it owns no environment or product-tier shape. This entry exposes 11 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { MetalProvisionError, allocateAddress, allocateCpuPool, cloudInit, guestBootstrapOperations, guestNameFor } from '@forgezero/agent/metal-provision';
-import { macForAddress, provisionMetalGuest, removeMetalGuest, tapNameFor, validateMetalProfile } from '@forgezero/agent/metal-provision';
-import type { GuestManifest, MetalCommandResult, MetalCpuPool, MetalExec, MetalImage, MetalProvisionProfile } from '@forgezero/agent/metal-provision';
+import {
+  MetalProvisionError,
+  allocateAddress,
+  allocateCpuPool,
+  cloudInit,
+  guestBootstrapOperations,
+  guestNameFor,
+  macForAddress,
+  provisionMetalGuest,
+  removeMetalGuest,
+  tapNameFor,
+  validateMetalProfile,
+} from '@forgezero/agent/metal-provision';
+
+import type {
+  GuestManifest,
+  MetalCommandResult,
+  MetalCpuPool,
+  MetalExec,
+  MetalImage,
+  MetalProvisionProfile,
+} from '@forgezero/agent/metal-provision';
 ```
 
 <a id="forgezero-agent-platform-bootstrap-runtime"></a>
 ## @forgezero/agent/platform-bootstrap-runtime
 
-Pure platform bootstrap validation, render and resumable phase-state contracts. Named value imports: activatePlatformRelease, planLocalOtlpProof, planPlatformActivation, platformApiCredentialSpecs, renderPlatformActivationFiles, renderPlatformApiUnits, renderPlatformNginx, renderPlatformSharedEnvironment, validatePlatformSharedEnvironment. Named type imports: ActivationBoundary, ApiRuntimeRenderOptions, ApiSlot, LocalOtlpProofPlan, PlatformActivationCommandResult, PlatformActivationConfig, PlatformActivationExec, PlatformBootstrapEmail, PlatformDatabaseRole, PlatformSharedEnvironment, PlatformSoftwareProfile, SystemdCredentialSpec. Import only the names used by this file.
+Pure platform bootstrap validation, render and resumable phase-state contracts. This entry exposes 10 named value exports and 14 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { activatePlatformRelease, planLocalOtlpProof, planPlatformActivation, platformApiCredentialSpecs, renderPlatformActivationFiles, renderPlatformApiUnits } from '@forgezero/agent/platform-bootstrap-runtime';
-import { renderPlatformNginx, renderPlatformSharedEnvironment, validatePlatformSharedEnvironment } from '@forgezero/agent/platform-bootstrap-runtime';
-import type { ActivationBoundary, ApiRuntimeRenderOptions, ApiSlot, LocalOtlpProofPlan, PlatformActivationCommandResult, PlatformActivationConfig } from '@forgezero/agent/platform-bootstrap-runtime';
-import type { PlatformActivationExec, PlatformBootstrapEmail, PlatformDatabaseRole, PlatformSharedEnvironment, PlatformSoftwareProfile, SystemdCredentialSpec } from '@forgezero/agent/platform-bootstrap-runtime';
+import {
+  activatePlatformRelease,
+  planLocalOtlpProof,
+  planPlatformActivation,
+  platformApiCredentialSpecs,
+  renderPlatformActivationFiles,
+  renderPlatformApiUnits,
+  renderPlatformNginx,
+  renderPlatformSharedEnvironment,
+  validatePlatformInitialInventory,
+  validatePlatformSharedEnvironment,
+} from '@forgezero/agent/platform-bootstrap-runtime';
+
+import type {
+  ActivationBoundary,
+  ApiRuntimeRenderOptions,
+  ApiSlot,
+  LocalOtlpProofPlan,
+  PlatformActivationCommandResult,
+  PlatformActivationConfig,
+  PlatformActivationExec,
+  PlatformBootstrapEmail,
+  PlatformDatabaseRole,
+  PlatformInitialInventory,
+  PlatformInitialInventoryCompute,
+  PlatformSharedEnvironment,
+  PlatformSoftwareProfile,
+  SystemdCredentialSpec,
+} from '@forgezero/agent/platform-bootstrap-runtime';
 ```
 
 <a id="forgezero-agent-project-context"></a>
 ## @forgezero/agent/project-context
 
-Project identity and repository context validation for operator and managed runs. Named value imports: PROJECT_CONTEXT_VERSION, ProjectContextError, checkProjectContext, defaultProjectContext, initializeProjectContext, parseProjectContext, projectContextFiles, renderProjectContext, syncProjectContext. Named type imports: ContextCheck, ContextFile, ProjectContextManifest, ProjectTruthSource. Import only the names used by this file.
+Project identity and repository context validation for operator and managed runs. This entry exposes 9 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { PROJECT_CONTEXT_VERSION, ProjectContextError, checkProjectContext, defaultProjectContext, initializeProjectContext, parseProjectContext } from '@forgezero/agent/project-context';
-import { projectContextFiles, renderProjectContext, syncProjectContext } from '@forgezero/agent/project-context';
-import type { ContextCheck, ContextFile, ProjectContextManifest, ProjectTruthSource } from '@forgezero/agent/project-context';
+import {
+  PROJECT_CONTEXT_VERSION,
+  ProjectContextError,
+  checkProjectContext,
+  defaultProjectContext,
+  initializeProjectContext,
+  parseProjectContext,
+  projectContextFiles,
+  renderProjectContext,
+  syncProjectContext,
+} from '@forgezero/agent/project-context';
+
+import type {
+  ContextCheck,
+  ContextFile,
+  ProjectContextManifest,
+  ProjectTruthSource,
+} from '@forgezero/agent/project-context';
 ```
 
 <a id="forgezero-agent-provisioning-pull"></a>
 ## @forgezero/agent/provisioning-pull
 
-Signed provisioning work claim, renewal, execution and acknowledgement. Named value imports: pullProvisioningOnce, startProvisioningPull. Named type imports: CreateRemoteProvisionClaim, GuestAccess, ProvisionPullResult, ProvisionResult, ProvisionRunner, ProvisioningPullOptions, RemoteProvisionClaim. Import only the names used by this file.
+Signed provisioning work claim, renewal, execution and acknowledgement. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { pullProvisioningOnce, startProvisioningPull } from '@forgezero/agent/provisioning-pull';
-import type { CreateRemoteProvisionClaim, GuestAccess, ProvisionPullResult, ProvisionResult, ProvisionRunner, ProvisioningPullOptions } from '@forgezero/agent/provisioning-pull';
-import type { RemoteProvisionClaim } from '@forgezero/agent/provisioning-pull';
+import {
+  pullProvisioningOnce,
+  startProvisioningPull,
+} from '@forgezero/agent/provisioning-pull';
+
+import type {
+  CreateRemoteProvisionClaim,
+  GuestAccess,
+  ProvisionPullResult,
+  ProvisionResult,
+  ProvisionRunner,
+  ProvisioningPullOptions,
+  RemoteProvisionClaim,
+} from '@forgezero/agent/provisioning-pull';
 ```
 
 <a id="forgezero-agent-schema-deploy-v3-json"></a>
@@ -630,32 +1188,66 @@ if (!validate(deploymentDefinition)) throw new Error(JSON.stringify(validate.err
 <a id="forgezero-agent-software"></a>
 ## @forgezero/agent/software
 
-Exact managed-software inventory, requirement and evidence contracts. Named value imports: BUN_RELEASE_SHA256, OS_CATALOG, PINNED_BUN_VERSION, SOFTWARE_CATALOG, ensureSoftwareRequirements, executeSoftwareOperation, observeSoftwareHost, runSoftwareCommand, softwareSpawnFailure, validateSoftwareRequirements. Named type imports: CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec, SoftwareId, SoftwareObservation, SoftwareOperation, SoftwareRequirement. Import only the names used by this file.
+Exact managed-software inventory, requirement and evidence contracts. This entry exposes 10 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { BUN_RELEASE_SHA256, OS_CATALOG, PINNED_BUN_VERSION, SOFTWARE_CATALOG, ensureSoftwareRequirements, executeSoftwareOperation } from '@forgezero/agent/software';
-import { observeSoftwareHost, runSoftwareCommand, softwareSpawnFailure, validateSoftwareRequirements } from '@forgezero/agent/software';
-import type { CatalogStatus, DeploymentChannel, OsCatalogEntry, SoftwareCatalogEntry, SoftwareCommandResult, SoftwareExec } from '@forgezero/agent/software';
-import type { SoftwareId, SoftwareObservation, SoftwareOperation, SoftwareRequirement } from '@forgezero/agent/software';
+import {
+  BUN_RELEASE_SHA256,
+  OS_CATALOG,
+  PINNED_BUN_VERSION,
+  SOFTWARE_CATALOG,
+  ensureSoftwareRequirements,
+  executeSoftwareOperation,
+  observeSoftwareHost,
+  runSoftwareCommand,
+  softwareSpawnFailure,
+  validateSoftwareRequirements,
+} from '@forgezero/agent/software';
+
+import type {
+  CatalogStatus,
+  DeploymentChannel,
+  OsCatalogEntry,
+  SoftwareCatalogEntry,
+  SoftwareCommandResult,
+  SoftwareExec,
+  SoftwareId,
+  SoftwareObservation,
+  SoftwareOperation,
+  SoftwareRequirement,
+} from '@forgezero/agent/software';
 ```
 
 <a id="forgezero-agent-software-helper"></a>
 ## @forgezero/agent/software-helper
 
-Root-owned fixed installation/update boundary for declared software. Named value imports: DEFAULT_SOFTWARE_HELPER_SOCKET, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH, requestContainerActivation, requestContainerBuild, requestServiceActivation, requestSoftware, startSoftwareHelper. Named type imports: none. Import only the names used by this file.
+Root-owned fixed installation/update boundary for declared software. This entry exposes 8 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { DEFAULT_SOFTWARE_HELPER_SOCKET, SOFTWARE_HELPER_GROUP, SOFTWARE_HELPER_UNIT_PATH, requestContainerActivation, requestContainerBuild, requestServiceActivation } from '@forgezero/agent/software-helper';
-import { requestSoftware, startSoftwareHelper } from '@forgezero/agent/software-helper';
+import {
+  DEFAULT_SOFTWARE_HELPER_SOCKET,
+  SOFTWARE_HELPER_GROUP,
+  SOFTWARE_HELPER_UNIT_PATH,
+  requestContainerActivation,
+  requestContainerBuild,
+  requestServiceActivation,
+  requestSoftware,
+  startSoftwareHelper,
+} from '@forgezero/agent/software-helper';
 ```
 
 <a id="forgezero-agent-ubuntu"></a>
 ## @forgezero/agent/ubuntu
 
-Ubuntu host validation and deterministic systemd/unit rendering helpers. Named value imports: SUPPORTED_GUEST_IMAGE, assertSupportedGuestImage. Named type imports: none. Import only the names used by this file.
+The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. This entry exposes 4 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
-import { SUPPORTED_GUEST_IMAGE, assertSupportedGuestImage } from '@forgezero/agent/ubuntu';
+import {
+  SUPPORTED_GUEST_IMAGE,
+  SUPPORTED_GUEST_IMAGES,
+  assertSupportedGuestImage,
+  supportedGuestImage,
+} from '@forgezero/agent/ubuntu';
 ```
 
 <a id="fz-agent-replica"></a>
@@ -715,7 +1307,9 @@ generate-request | fz api post /workspace/action --data -
 Nothing. With no agent, this needs FORGEZERO_API_KEY in the environment. With the agent, it does not — and the key that would have been on the box does not exist. `@forgezero/vault` prefers the socket automatically.
 
 ```text
-import { ForgeZero } from '@forgezero/vault';
+import {
+  ForgeZero,
+} from '@forgezero/vault';
 
 const fz = new ForgeZero({ project: 'altpilot', environment: 'production' });
 await fz.get('STRIPE_KEY');