@forgezero/agent 0.1.86 → 0.1.87

package/dist/provision.d.ts

@@ -80,6 +80,10 @@ export declare const reasonFor: (mode: AgentMode) => string;
 export interface UnitOptions {
     mode: AgentMode;
     socketPath: string;
+    /** Internal blue/green handover unit; never enables outbound claim intake. */
+    handoverCandidate?: boolean;
+    /** Internal exact backend override used by the candidate generation. */
+    backendSocketPath?: string;
     /** Legacy/dev fallback only. Production uses `seedCredentialPath`. */
     seedPath?: string;
     /** Host-bound encrypted credential loaded by systemd for this unit only. */
@@ -158,6 +162,7 @@ export declare const LIFECYCLE_GROUP = "forgezero-lifecycle";
 export declare const DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
 export declare const AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
 export declare const AGENT_SOCKET_PROXY_UNIT_PATH = "/etc/systemd/system/forgezero-agent-proxy.service";
+export declare const AGENT_CANDIDATE_UNIT_PATH = "/etc/systemd/system/forgezero-agent-candidate.service";
 export declare const DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 export declare const ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 export declare const LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
@@ -171,7 +176,7 @@ export declare function agentEgressUnit(options: Pick<UnitOptions, 'binPath' | '
 /** Root may execute only package-owned OS strategies selected by id + version. */
 export declare function softwareHelperUnit(options: Pick<UnitOptions, 'binPath' | 'deployRoot'>): string;
 /** Fixed root boundary for verified, health-gated Agent replacement. */
-export declare function agentUpdateHelperUnit(options: Pick<UnitOptions, 'binPath'>): string;
+export declare function agentUpdateHelperUnit(options: Pick<UnitOptions, 'binPath' | 'socketPath'>): string;
 /**
  * PID 1 owns the stable application endpoint.
  *
@@ -187,6 +192,10 @@ export declare function agentSocketUnit(options: Pick<UnitOptions, 'socketPath'>
  */
 export declare function agentSocketProxyUnit(options: Pick<UnitOptions, 'socketPath' | 'user'>): string;
 export declare function agentBackendSocketPath(publicSocketPath: string): string;
+/** Stable symlink resolved by systemd-socket-proxyd for every new connection. */
+export declare function agentRoutingSocketPath(publicSocketPath: string): string;
+/** Isolated backend owned only by the verified candidate generation. */
+export declare function agentCandidateSocketPath(publicSocketPath: string): string;
 export declare function warpConfigUnit(options: Pick<UnitOptions, 'binPath' | 'warpOrganization' | 'warpClientIdCredentialPath' | 'warpClientSecretCredentialPath'>): string;
 export declare function warpServiceDropIn(): string;
 export declare function lifecycleHelperUnit(options: Pick<UnitOptions, 'binPath' | 'lifecycleProfilePath' | 'lifecycleHelperSocketPath'>): string;
@@ -208,6 +217,12 @@ export declare function deploymentRunnerUnit(options: Pick<UnitOptions, 'binPath
  * filesystem read-only.
  */
 export declare function agentUnit(options: UnitOptions): string;
+/**
+ * A separately supervised, credential-equivalent candidate. It loads and proves
+ * the durable node binding and RAM Vault replica, but candidate mode never
+ * starts heartbeat, claim, migration, bootstrap or deployment intake.
+ */
+export declare function agentCandidateUnit(options: UnitOptions): string;
 export interface Step {
     /** Stable display, never executed. */
     command: string;