@forgezero/agent 0.1.99 → 0.1.101

package/README.md

@@ -11,7 +11,7 @@ The node agent deploys on a compute; tenant mode also holds one complete project
 
 ## Package overview
 
-Every managed compute. It owns node identity, attestation and repository pipelines. An SNP compute may hold its assigned whole project across environments in RAM after current attestation. Ordinary compute is API-only unless an administrator explicitly records the versioned non-TEE risk acceptance for that concrete machine. Platform mode never replicates realm-wide API authority beside the process that already holds unlocked realm seeds. Supported runtimes: bun, node. Package root: @forgezero/agent. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
+Every managed compute. It owns node identity, attestation and repository pipelines. An SNP compute may hold its assigned whole project across environments in RAM after current attestation. Ordinary compute is API-only unless an administrator explicitly records the versioned non-TEE risk acceptance for that concrete machine. Platform mode never replicates realm-wide API authority beside the process that already holds unlocked realm seeds. Supported runtimes: bun, node. Package root: @forgezero/agent. Consumer documentation is curated with each module's explicit public flag; the complete internal/export inventory remains in the typed SSOT and declaration files.
 
 ```text
 bun add -g @forgezero/agent
@@ -29,1124 +29,37 @@ The five packages are installation boundaries. Choose a package by who installs
 | @forgezero/runtime | Portable runtime primitives for queries, jobs, events, schemas and finance. | bun, node | [Open](https://www.forgezero.net/docs/runtime) |
 | @forgezero/agent | Operator CLI and managed-node agent for bootstrap, deploy and lifecycle. | bun, node | [Open](https://www.forgezero.net/docs/agent) |
 
-## @forgezero/agent public imports and commands
+## @forgezero/agent supported imports and commands
 
-Every row links to the detailed explanation and named-import/example area below. This table and those details are generated from the package inventory and emitted declarations.
+These are supported consumer entry points, not every internal module shipped for ForgeZero managed installation. Each row links to its task-oriented usage.
 
 | public entry | short description | runtime | details |
 |---|---|---|---|
-| fz | The operator command: keys, status, genesis, unlock, run, and agent install. | Bun/Node host | [Reference + usage](#fz) |
-| fz run | The fallback for software that cannot read the local socket: start a process with scoped vault values in its environment. | Bun/Node host | [Reference + usage](#fz-run) |
-| fz agent install | Provision the same hardened agent service locally that the platform provisions remotely. | Bun/Node host | [Reference + usage](#fz-agent-install) |
-| fz-agent | The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project scope. Vault synchronization succeeds only when the API sees current SNP evidence or an audited versioned non-TEE acceptance; ordinary compute otherwise remains API-only and a revocation clears its resident cache. | Bun/Node host | [Reference + usage](#fz-agent) |
-| fz-agent (socket) | identity, sign, attest, get, sync and held — the whole interface an application sees. | Bun/Node host | [Reference + usage](#fz-agent-socket) |
-| @forgezero/agent/migration-pull | PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. | Bun/Node host | [Reference + usage](#forgezero-agent-migration-pull) |
-| @forgezero/agent/lifecycle-helper | The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. | Bun/Node host | [Reference + usage](#forgezero-agent-lifecycle-helper) |
-| @forgezero/agent/provision | The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. | Bun/Node host | [Reference + usage](#forgezero-agent-provision) |
-| @forgezero/agent/platform-genesis | Offline authority adapter for the brief pre-API period. It validates exactly three reviewed generic guest requests and converts them to the same Metal claims the live API issues; environment and product tier are not provisioning inputs. | Bun/Node host | [Reference + usage](#forgezero-agent-platform-genesis) |
-| @forgezero/agent/subscribe | Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. | Bun/Node host | [Reference + usage](#forgezero-agent-subscribe) |
-| @forgezero/agent/ssh-listen | The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. | Bun/Node host | [Reference + usage](#forgezero-agent-ssh-listen) |
-| @forgezero/agent/ssh-server | Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. | Bun/Node host | [Reference + usage](#forgezero-agent-ssh-server) |
-| @forgezero/agent/pipeline | CI/CD on the compute: secrets reach the step that named them and nothing else, attestation gates the run, and a required attestation that fails is a refusal rather than a downgrade. | Bun/Node host | [Reference + usage](#forgezero-agent-pipeline) |
-| @forgezero/agent/agent-heartbeat | Signed node health publication with bounded renewal and shutdown withdrawal. | Bun/Node host | [Reference + usage](#forgezero-agent-agent-heartbeat) |
-| @forgezero/agent/agent-update | Verified Agent update planning against the platform release coordinate. | Bun/Node host | [Reference + usage](#forgezero-agent-agent-update) |
-| @forgezero/agent/agent-update-helper | Root-owned fixed update operations with registry origin and integrity validation. | Bun/Node host | [Reference + usage](#forgezero-agent-agent-update-helper) |
-| @forgezero/agent/bootstrap | Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-bootstrap) |
-| @forgezero/agent/bootstrap-bundle | Owner-only exact-revision Git bundle and SHA-256 manifest for credential-free release generation one. | Bun/Node host | [Reference + usage](#forgezero-agent-bootstrap-bundle) |
-| @forgezero/agent/operator-bootstrap | Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. | Bun/Node host | [Reference + usage](#forgezero-agent-operator-bootstrap) |
-| @forgezero/agent/host-maintenance | Closed host maintenance plans for staging transaction rehearsal and fleet-fenced schema consolidation through fixed transient systemd units. | Bun/Node host | [Reference + usage](#forgezero-agent-host-maintenance) |
-| @forgezero/agent/capacity-calibration | One-time target-local safe-concurrency calibration with private evidence. | Bun/Node host | [Reference + usage](#forgezero-agent-capacity-calibration) |
-| @forgezero/agent/cloudflare-bootstrap | Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. | Bun/Node host | [Reference + usage](#forgezero-agent-cloudflare-bootstrap) |
-| @forgezero/agent/cloudflare-edge | Strict Cloudflare REST operations used by the attended bootstrap controller. | Bun/Node host | [Reference + usage](#forgezero-agent-cloudflare-edge) |
-| @forgezero/agent/mesh-connector | Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. | Bun/Node host | [Reference + usage](#forgezero-agent-mesh-connector) |
-| @forgezero/agent/compute | Compute claim, renewal, execution and completion client contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-compute) |
-| @forgezero/agent/credential-schema | Canonical systemd credential names and validation shared by bootstrap and services. | Bun/Node host | [Reference + usage](#forgezero-agent-credential-schema) |
-| @forgezero/agent/definition | Legacy version 3 JSON deployment compatibility contract. | Bun/Node host | [Reference + usage](#forgezero-agent-definition) |
 | @forgezero/agent/deploy | Typed deployment authoring builders, built-in provider requirements and versioned action constructors. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy) |
-| @forgezero/agent/deployment-targets | Bounded input resolution and stable compute-target assignment for typed plans; emits requirements and slots rather than physical hostnames. | Bun/Node host | [Reference + usage](#forgezero-agent-deployment-targets) |
-| @forgezero/agent/deployment-connectivity | Root-owned convergence of exact private routes, routed-port firewall rules and per-target Cloudflare Tunnel or Mesh connector capabilities without exposing the project management token to a compute. | Bun/Node host | [Reference + usage](#forgezero-agent-deployment-connectivity) |
-| @forgezero/agent/deployment-topology | Pure per-Metal relay election and hierarchical peer assignment: one or two Metals stay direct-private, while three or more grant Mesh/WARP only to relay and standby. | Bun/Node host | [Reference + usage](#forgezero-agent-deployment-topology) |
-| @forgezero/agent/deploy-plan | Runtime validation, canonicalization and semantic digest for inert deployment plans. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-plan) |
-| @forgezero/agent/deploy-plan-runner | Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-plan-runner) |
-| @forgezero/agent/deploy-compiler | Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-compiler) |
-| @forgezero/agent/deploy-file | Read and validate a checked-out .fz deployment file without executing project input. | Bun/Node host | [Reference + usage](#forgezero-agent-deploy-file) |
-| @forgezero/agent/metal-bootstrap | Physical-metal bootstrap planning, application and status evidence. | Bun/Node host | [Reference + usage](#forgezero-agent-metal-bootstrap) |
-| @forgezero/agent/metal-provision | The single constrained compute materializer for platform genesis, platform scaling and tenant compute. It executes caller-supplied OS, CPU, memory, disk, bandwidth, network and confidentiality coordinates after capacity and image validation; it owns no environment or product-tier shape. | Bun/Node host | [Reference + usage](#forgezero-agent-metal-provision) |
-| @forgezero/agent/platform-bootstrap-runtime | Pure platform bootstrap validation, render and resumable phase-state contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-platform-bootstrap-runtime) |
-| @forgezero/agent/project-context | Project identity and repository context validation for operator and managed runs. | Bun/Node host | [Reference + usage](#forgezero-agent-project-context) |
-| @forgezero/agent/provisioning-pull | Signed provisioning work claim, renewal, execution and acknowledgement. | Bun/Node host | [Reference + usage](#forgezero-agent-provisioning-pull) |
 | @forgezero/agent/schema/deploy-v3.json | Published JSON Schema for deployment definition version 3 with exact argv execution. | Bun/Node host | [Reference + usage](#forgezero-agent-schema-deploy-v3-json) |
-| @forgezero/agent/software | Exact managed-software inventory, requirement and evidence contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-software) |
-| @forgezero/agent/software-helper | Root-owned fixed installation/update boundary for declared software. | Bun/Node host | [Reference + usage](#forgezero-agent-software-helper) |
-| @forgezero/agent/ubuntu | The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. | Bun/Node host | [Reference + usage](#forgezero-agent-ubuntu) |
-| fz-agent (replica) | The authorized project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, cleared when local authority is revoked, and refusing a read it can no longer vouch for. | Bun/Node host | [Reference + usage](#fz-agent-replica) |
 
 ## Commands
 
 bun add -g @forgezero/agent — Install the version-matched fz operator CLI and fz-agent daemon.
 fz deploy init — Create a typed forgezero.deploy.ts and its canonical inert execution plan.
-fz deploy init --runtime containerd --os ubuntu-24.04 --replicas 1 --cpu-cores 2 --memory-mib 2048 --storage-gib 20 --reuse require — Create one ordinary containerd/runc compute definition with exact reserved resources; existing eligible project capacity is required.
-fz deploy init --runtime kata-snp --os ubuntu-26.04 --replicas 1 --cpu-cores 2 --memory-mib 4096 --storage-gib 40 --reuse require — Create one Kata QEMU SEV-SNP definition on existing eligible capacity. Use reuse prefer only with the explicit provisioning and spend-ceiling flags shown by fz deploy init --help.
 fz deploy compile — Compile and validate TypeScript deployment intent into .fz/deploy.plan.json.
 fz deploy check — Refuse stale plans, unsafe provider/action coordinates and unresolved deployment blockers.
-fz bootstrap platform launch --profile development --apply — Run the one attended ForgeZero launch: public topology and bundle are derived; answer only email settings, hidden provider tokens and APPLY.
-fz bootstrap platform fleet apply --bootstrap-config /secure/forgezero/development/genesis/platform-fleet-remote.json — Resume or diagnose an already generated fleet plan; this is not the normal first-launch path.
-fz bootstrap platform --help — Inspect attended platform bootstrap inputs before applying them.
-fz bootstrap metal --help — Inspect the identity-only physical provisioner bootstrap.
-fz host transactions|schema-plan|schema-apply — Plan fixed supervised database maintenance; add --apply only after reviewing the exact argv and credential names.
-fz status — Read installed service and bootstrap evidence.
 
 ```text
 bun add -g @forgezero/agent
 fz deploy init
-fz deploy init --runtime containerd --os ubuntu-24.04 --replicas 1 --cpu-cores 2 --memory-mib 2048 --storage-gib 20 --reuse require
-fz deploy init --runtime kata-snp --os ubuntu-26.04 --replicas 1 --cpu-cores 2 --memory-mib 4096 --storage-gib 40 --reuse require
 fz deploy compile
 fz deploy check
-fz bootstrap platform launch --profile development --apply
-fz bootstrap platform fleet apply --bootstrap-config /secure/forgezero/development/genesis/platform-fleet-remote.json
-fz bootstrap platform --help
-fz bootstrap metal --help
-fz host transactions|schema-plan|schema-apply
-fz status
-```
-
-<a id="fz"></a>
-## fz
-
-The operator command: keys, status, genesis, unlock, run, and agent install. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
-
-```text
-fz --help
-```
-
-## fz — Keep project truth synchronized
-
-One versioned ForgeZero manifest generates thin AI-tool adapters and CI rejects drift.
-
-```text
-fz project init
-fz project sync
-fz project check
-```
-
-<a id="fz-run"></a>
-## fz run
-
-The fallback for software that cannot read the local socket: start a process with scoped vault values in its environment. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
-
-```text
-fz run --help
-```
-
-## fz run — Inspect before use
-
-This is a command entry. Read its typed option contract before an operation; apply-capable commands remain plans unless their explicit apply flag is supplied.
-
-```text
-fz run --help
-```
-
-<a id="fz-agent-install"></a>
-## fz agent install
-
-Provision the same hardened agent service locally that the platform provisions remotely. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
-
-```text
-fz agent install --help
-```
-
-## fz agent install — Inspect before use
-
-This is a command entry. Read its typed option contract before an operation; apply-capable commands remain plans unless their explicit apply flag is supplied.
-
-```text
-fz agent install --help
-```
-
-<a id="fz-agent"></a>
-## fz-agent
-
-The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project scope. Vault synchronization succeeds only when the API sees current SNP evidence or an audited versioned non-TEE acceptance; ordinary compute otherwise remains API-only and a revocation clears its resident cache. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
-
-```text
-fz-agent --help
-```
-
-## fz-agent — Inspect before use
-
-This is a command entry. Read its typed option contract before an operation; apply-capable commands remain plans unless their explicit apply flag is supplied.
-
-```text
-fz-agent --help
-```
-
-<a id="fz-agent-socket"></a>
-## fz-agent (socket)
-
-identity, sign, attest, get, sync and held — the whole interface an application sees. This entry requires a Bun/Node host runtime. This is a managed runtime interface label, not an import or standalone executable.
-
-```text
-fz-agent (socket)
-# Accessed through the installed Agent boundary.
-```
-
-## fz-agent (socket) — Outbound control boundary
-
-The Metal Agent initiates outbound signed HTTPS for orchestration. Applications use the project-scoped local Unix socket; the platform never opens an inbound shell control plane.
-
-```text
-metal/compute Agent -> outbound signed HTTPS -> platform API
-application -> local Unix socket -> project-scoped Vault replica
-```
-
-<a id="forgezero-agent-migration-pull"></a>
-## @forgezero/agent/migration-pull
-
-PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  pullMigrationOnce,
-  startMigrationPull,
-} from '@forgezero/agent/migration-pull';
-
-import type {
-  MigrationAction,
-  MigrationEvidence,
-  MigrationEvidenceProfile,
-  MigrationNetwork,
-  MigrationPullOptions,
-  MigrationPullResult,
-  RemoteMigrationClaim,
-} from '@forgezero/agent/migration-pull';
-```
-
-## @forgezero/agent/migration-pull — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  pullMigrationOnce,
-} from '@forgezero/agent/migration-pull';
-
-export const selectedCapability = pullMigrationOnce;
-```
-
-<a id="forgezero-agent-lifecycle-helper"></a>
-## @forgezero/agent/lifecycle-helper
-
-The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. This entry exposes 7 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEFAULT_LIFECYCLE_HELPER_SOCKET,
-  executeLifecycleAction,
-  loadLifecycleProfile,
-  requestLifecycleAction,
-  spawnLifecycleCommand,
-  startLifecycleHelper,
-  validateLifecycleProfile,
-} from '@forgezero/agent/lifecycle-helper';
-
-import type {
-  LifecycleCommandResult,
-  LifecycleExec,
-  LifecycleProfile,
-} from '@forgezero/agent/lifecycle-helper';
-```
-
-## @forgezero/agent/lifecycle-helper — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEFAULT_LIFECYCLE_HELPER_SOCKET,
-} from '@forgezero/agent/lifecycle-helper';
-
-export const selectedCapability = DEFAULT_LIFECYCLE_HELPER_SOCKET;
-```
-
-<a id="forgezero-agent-provision"></a>
-## @forgezero/agent/provision
-
-The install plan as data, with no transport — so `fz` running locally and the platform running over SSH provision an identical machine. This entry exposes 38 named value exports and 11 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  AGENT_CANDIDATE_UNIT_PATH,
-  AGENT_EGRESS_UNIT_PATH,
-  AGENT_SOCKET_PROXY_UNIT_PATH,
-  AGENT_SOCKET_UNIT_PATH,
-  APPLICATION_RUNTIME_USER,
-  CAPABILITY_CHECKS,
-  DEFAULT_RUNNER_PUBLIC_TCP_PORTS,
-  DEPLOYMENT_GROUP,
-  DEPLOYMENT_RUNNER_SOCKET,
-  DEPLOYMENT_RUNNER_UNIT_PATH,
-  DEPLOYMENT_RUNNER_USER,
-  ENROLMENT_UNIT_PATH,
-  LIFECYCLE_GROUP,
-  LIFECYCLE_HELPER_SOCKET,
-  LIFECYCLE_HELPER_UNIT_PATH,
-  UNIT_PATH,
-  VAULT_GROUP,
-  WARP_CONFIG_UNIT_PATH,
-  WARP_SERVICE_DROP_IN_PATH,
-  agentBackendSocketPath,
-  agentCandidateSocketPath,
-  agentCandidateUnit,
-  agentEgressUnit,
-  agentEnrolmentUnit,
-  agentRoutingSocketPath,
-  agentSocketProxyUnit,
-  agentSocketUnit,
-  agentUnit,
-  agentUpdateHelperUnit,
-  atLeast,
-  deploymentRunnerUnit,
-  lifecycleHelperUnit,
-  modeFor,
-  planProvision,
-  reasonFor,
-  softwareHelperUnit,
-  warpConfigUnit,
-  warpServiceDropIn,
-} from '@forgezero/agent/provision';
-
-import type {
-  AgentMode,
-  Capabilities,
-  CapabilityId,
-  CapabilityOperation,
-  Check,
-  DirectorySpec,
-  FixedHostCommand,
-  ProvisionOperation,
-  ProvisionPlan,
-  Step,
-  UnitOptions,
-} from '@forgezero/agent/provision';
-```
-
-## @forgezero/agent/provision — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  AGENT_CANDIDATE_UNIT_PATH,
-} from '@forgezero/agent/provision';
-
-export const selectedCapability = AGENT_CANDIDATE_UNIT_PATH;
-```
-
-<a id="forgezero-agent-platform-genesis"></a>
-## @forgezero/agent/platform-genesis
-
-Offline authority adapter for the brief pre-API period. It validates exactly three reviewed generic guest requests and converts them to the same Metal claims the live API issues; environment and product tier are not provisioning inputs. This entry exposes 4 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  platformCommunityRehearsalClaims,
-  platformCommunityRehearsalDeletionClaims,
-  platformGenesisClaims,
-  validatePlatformGenesisGuests,
-} from '@forgezero/agent/platform-genesis';
-
-import type {
-  PlatformGenesisGuest,
-} from '@forgezero/agent/platform-genesis';
-```
-
-## @forgezero/agent/platform-genesis — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  platformCommunityRehearsalClaims,
-} from '@forgezero/agent/platform-genesis';
-
-export const selectedCapability = platformCommunityRehearsalClaims;
-```
-
-<a id="forgezero-agent-subscribe"></a>
-## @forgezero/agent/subscribe
-
-Realtime scope sync over a WebSocket, with the poll kept underneath it: the poll is what establishes freshness, and a change it finds that the socket never sent is proof the socket is lying. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  backoffMs,
-  subscribe,
-} from '@forgezero/agent/subscribe';
-
-import type {
-  ChangeFrame,
-  SocketLike,
-  SubscribeOptions,
-  Subscriber,
-} from '@forgezero/agent/subscribe';
-```
-
-## @forgezero/agent/subscribe — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  backoffMs,
-} from '@forgezero/agent/subscribe';
-
-export const selectedCapability = backoffMs;
-```
-
-<a id="forgezero-agent-ssh-listen"></a>
-## @forgezero/agent/ssh-listen
-
-The socket SSH_AUTH_SOCK points at. The protocol handler had nowhere to speak — an agent protocol with no socket is a parser. The containing directory is 0700 before anything binds, because the socket’s own mode is only corrected after it already exists. This entry exposes 2 named value exports and 1 named type export. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  MAX_MESSAGE_BYTES,
-  startSshAgent,
-} from '@forgezero/agent/ssh-listen';
-
-import type {
-  SshListenOptions,
-} from '@forgezero/agent/ssh-listen';
-```
-
-## @forgezero/agent/ssh-listen — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  MAX_MESSAGE_BYTES,
-} from '@forgezero/agent/ssh-listen';
-
-export const selectedCapability = MAX_MESSAGE_BYTES;
-```
-
-<a id="forgezero-agent-ssh-server"></a>
-## @forgezero/agent/ssh-server
-
-Serve the SSH agent protocol so SSH_AUTH_SOCK points at the vault — two operations implemented, and ADD_IDENTITY refused so no process can inject a key ssh would offer to every host. This entry exposes 10 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  MAX_MESSAGE_BYTES,
-  SSH_AGENT_FAILURE,
-  SSH_AGENT_IDENTITIES_ANSWER,
-  SSH_AGENT_SIGN_RESPONSE,
-  SSH_AGENT_SUCCESS,
-  SshAgentError,
-  describeIdentities,
-  frame,
-  handleMessage,
-  readMessage,
-} from '@forgezero/agent/ssh-server';
-
-import type {
-  AgentBackend,
-  AgentIdentity,
-} from '@forgezero/agent/ssh-server';
-```
-
-## @forgezero/agent/ssh-server — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  MAX_MESSAGE_BYTES,
-} from '@forgezero/agent/ssh-server';
-
-export const selectedCapability = MAX_MESSAGE_BYTES;
-```
-
-<a id="forgezero-agent-pipeline"></a>
-## @forgezero/agent/pipeline
-
-CI/CD on the compute: secrets reach the step that named them and nothing else, attestation gates the run, and a required attestation that fails is a refusal rather than a downgrade. This entry exposes 3 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  PipelineError,
-  redact,
-  runPipeline,
-} from '@forgezero/agent/pipeline';
-
-import type {
-  Pipeline,
-  PipelineStep,
-  RunOptions,
-  RunResult,
-  StepOutcome,
-  StepResult,
-} from '@forgezero/agent/pipeline';
-```
-
-## @forgezero/agent/pipeline — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  PipelineError,
-} from '@forgezero/agent/pipeline';
-
-export const selectedCapability = PipelineError;
-```
-
-<a id="forgezero-agent-agent-heartbeat"></a>
-## @forgezero/agent/agent-heartbeat
-
-Signed node health publication with bounded renewal and shutdown withdrawal. This entry exposes 3 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  heartbeatAgentOnce,
-  observeAgentHost,
-  startAgentHeartbeat,
-} from '@forgezero/agent/agent-heartbeat';
-
-import type {
-  AgentHeartbeatOptions,
-  AgentHeartbeatResponse,
-  AgentHostMetrics,
-  AgentObservation,
-} from '@forgezero/agent/agent-heartbeat';
-```
-
-## @forgezero/agent/agent-heartbeat — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  heartbeatAgentOnce,
-} from '@forgezero/agent/agent-heartbeat';
-
-export const selectedCapability = heartbeatAgentOnce;
-```
-
-<a id="forgezero-agent-agent-update"></a>
-## @forgezero/agent/agent-update
-
-Verified Agent update planning against the platform release coordinate. This entry exposes 11 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEFAULT_AGENT_CANDIDATE_LINK,
-  DEFAULT_AGENT_RELEASE_ROOT,
-  DEFAULT_AGENT_UPDATE_SOCKET,
-  MAX_AGENT_TARBALL_BYTES,
-  clearAgentCandidate,
-  compareVersions,
-  restoreAgentRelease,
-  selectAgentCandidate,
-  selectAgentRelease,
-  stageAgentRelease,
-  validateAgentRelease,
-} from '@forgezero/agent/agent-update';
-
-import type {
-  AgentRelease,
-  StagedAgentRelease,
-  UpdateCommand,
-  UpdateCommandResult,
-} from '@forgezero/agent/agent-update';
-```
-
-## @forgezero/agent/agent-update — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEFAULT_AGENT_CANDIDATE_LINK,
-} from '@forgezero/agent/agent-update';
-
-export const selectedCapability = DEFAULT_AGENT_CANDIDATE_LINK;
-```
-
-<a id="forgezero-agent-agent-update-helper"></a>
-## @forgezero/agent/agent-update-helper
-
-Root-owned fixed update operations with registry origin and integrity validation. This entry exposes 10 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  AGENT_UPDATE_GROUP,
-  AGENT_UPDATE_HELPER_UNIT_PATH,
-  AGENT_UPDATE_JOURNAL,
-  AGENT_UPDATE_RECEIPT,
-  activateAgentRelease,
-  probeAgentSocket,
-  readAgentUpdateReceipt,
-  recoverInterruptedAgentUpdate,
-  requestAgentUpdate,
-  startAgentUpdateHelper,
-} from '@forgezero/agent/agent-update-helper';
-
-import type {
-  AgentUpdateOutcome,
-  AgentUpdateReceipt,
-  AgentUpdateRequest,
-  AgentUpdateResponse,
-} from '@forgezero/agent/agent-update-helper';
-```
-
-## @forgezero/agent/agent-update-helper — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  AGENT_UPDATE_GROUP,
-} from '@forgezero/agent/agent-update-helper';
-
-export const selectedCapability = AGENT_UPDATE_GROUP;
-```
-
-<a id="forgezero-agent-bootstrap"></a>
-## @forgezero/agent/bootstrap
-
-Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. This entry exposes 13 named value exports and 18 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  BOOTSTRAP_STATE_PATH,
-  PLATFORM_BOOTSTRAP_PROFILES,
-  applyBootstrap,
-  bootstrapIdentityDigest,
-  bootstrapStatus,
-  localBootstrapHost,
-  planBootstrap,
-  planBootstrapAgentInstall,
-  readBootstrapConfig,
-  resolveInstalledBootstrapKind,
-  validateBootstrapConfig,
-  validateEnrolledComputeBootstrapSecrets,
-  validatePlatformBootstrapSecrets,
-} from '@forgezero/agent/bootstrap';
-
-import type {
-  BootstrapAgentInstallPhase,
-  BootstrapConfig,
-  BootstrapEnvironment,
-  BootstrapHost,
-  BootstrapPlan,
-  BootstrapResult,
-  BootstrapSecrets,
-  BootstrapStatus,
-  BootstrapStep,
-  DatabaseAgencyParticipation,
-  DatabaseBootstrapRole,
-  EnrolledComputeActivationConfig,
-  EnrolledComputeBootstrapSecrets,
-  InstalledBootstrapKind,
-  PlatformBootstrapConfig,
-  PlatformBootstrapProfile,
-  PlatformBootstrapSecrets,
-  PlatformEnrolmentSource,
-} from '@forgezero/agent/bootstrap';
-```
-
-## @forgezero/agent/bootstrap — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  BOOTSTRAP_STATE_PATH,
-} from '@forgezero/agent/bootstrap';
-
-export const selectedCapability = BOOTSTRAP_STATE_PATH;
-```
-
-<a id="forgezero-agent-bootstrap-bundle"></a>
-## @forgezero/agent/bootstrap-bundle
-
-Owner-only exact-revision Git bundle and SHA-256 manifest for credential-free release generation one. This entry exposes 8 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  BOOTSTRAP_BUNDLE_FORMAT,
-  BOOTSTRAP_BUNDLE_KIND,
-  MAX_BOOTSTRAP_BUNDLE_BYTES,
-  bootstrapBundleBranch,
-  buildBootstrapBundle,
-  parseBootstrapBundleManifest,
-  readBootstrapBundle,
-  sha256File,
-} from '@forgezero/agent/bootstrap-bundle';
-
-import type {
-  BootstrapBundleBuildInput,
-  BootstrapBundleBuildResult,
-  BootstrapBundleCommand,
-  BootstrapBundleCommandResult,
-  BootstrapBundleManifest,
-} from '@forgezero/agent/bootstrap-bundle';
-```
-
-## @forgezero/agent/bootstrap-bundle — Build release generation one without a deploy key
-
-The builder refuses tracked drift, resolves one exact commit, creates an owner-only Git bundle and writes a byte-count/SHA-256 manifest. Bootstrap consumes the artifact after activation.
-
-```text
-import {
-  buildBootstrapBundle,
-  readBootstrapBundle,
-} from '@forgezero/agent/bootstrap-bundle';
-
-const built = await buildBootstrapBundle({
-  repositoryRoot: '/work/forgezero-api', branch: 'main',
-  outputPath: '/secure/forgezero/production/api.bundle'
-});
-await readBootstrapBundle(built.bundlePath, built.manifestPath);
-```
-
-<a id="forgezero-agent-operator-bootstrap"></a>
-## @forgezero/agent/operator-bootstrap
-
-Pinned-host operator transport that stages owner-only handoffs and invokes the same typed platform bootstrap through the caller-approved SSH agent. This entry exposes 24 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  applyOperatorMetalBootstrap,
-  applyOperatorPlatformBootstrap,
-  applyOperatorPlatformFleetBootstrap,
-  collectOperatorGuestHostKeys,
-  createOperatorSshHop,
-  operatorMetalClusterBootstrapCode,
-  operatorPackagedAgentPath,
-  operatorPackagedFzCliPath,
-  operatorPackagedGitSshPath,
-  operatorPlatformFleetCoordinates,
-  planOperatorMetalBootstrap,
-  planOperatorPlatformBootstrap,
-  planOperatorPlatformFleetBootstrap,
-  readOperatorGuestHostKeyEvidence,
-  readOperatorMetalBootstrapRequest,
-  readOperatorPlatformBootstrapFleetRequest,
-  readOperatorPlatformBootstrapRequest,
-  redactOperatorSecretDiagnostic,
-  verifyOperatorPlatformFleet,
-  withOperatorGuestTransport,
-  writeOperatorGuestHostKeyEvidence,
-  writeOperatorMetalBootstrapRequest,
-  writeOperatorPlatformBootstrapFleetRequest,
-  writeOperatorPlatformBootstrapRequest,
-} from '@forgezero/agent/operator-bootstrap';
-
-import type {
-  OperatorCommand,
-  OperatorCommandResult,
-  OperatorGuestHostKeyEvidence,
-  OperatorGuestTransport,
-  OperatorMetalBootstrapMode,
-  OperatorMetalBootstrapPlan,
-  OperatorMetalBootstrapRequest,
-  OperatorPlatformBootstrapFleetOutcome,
-  OperatorPlatformBootstrapFleetPlan,
-  OperatorPlatformBootstrapFleetRequest,
-  OperatorPlatformBootstrapFleetResult,
-  OperatorPlatformBootstrapMode,
-  OperatorPlatformBootstrapOptions,
-  OperatorPlatformBootstrapPlan,
-  OperatorPlatformBootstrapRequest,
-  OperatorPlatformFleetCoordinates,
-  OperatorSshHop,
-} from '@forgezero/agent/operator-bootstrap';
-```
-
-## @forgezero/agent/operator-bootstrap — Launch the platform from an operator laptop
-
-The selected ForgeZero profile and pinned Metal evidence derive every public coordinate. The CLI builds the clean API bundle, retains cluster material only as an owner-host encrypted systemd credential for safe resume, deploys all three computes, seals hidden credentials, seeds inventory and prints the invitation. Low-level file commands are reserved for resume and repair.
-
-```text
-# The command prints the derived plan before its final APPLY confirmation:
-fz bootstrap platform launch --profile development --apply
-```
-
-<a id="forgezero-agent-host-maintenance"></a>
-## @forgezero/agent/host-maintenance
-
-Closed host maintenance plans for staging transaction rehearsal and fleet-fenced schema consolidation through fixed transient systemd units. This entry exposes 2 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  applyHostMaintenance,
-  planHostMaintenance,
-} from '@forgezero/agent/host-maintenance';
-
-import type {
-  HostMaintenanceOperation,
-  HostMaintenancePlan,
-  HostMaintenanceRequest,
-  HostMaintenanceResult,
-  HostMaintenanceRuntime,
-} from '@forgezero/agent/host-maintenance';
-```
-
-## @forgezero/agent/host-maintenance — Plan a fixed supervised host operation
-
-The library discovers only a trusted blue/green slot, attaches fixed credential names and returns exact argv as reviewable data. The public fz host commands use the same operation and require root only for apply.
-
-```text
-import {
-  planHostMaintenance,
-} from '@forgezero/agent/host-maintenance';
-
-const plan = planHostMaintenance({ operation: 'schema-plan' });
-console.log(plan.argv);
-```
-
-<a id="forgezero-agent-capacity-calibration"></a>
-## @forgezero/agent/capacity-calibration
-
-One-time target-local safe-concurrency calibration with private evidence. This entry exposes 3 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  calibrateHttpConcurrency,
-  localCalibrationEndpoint,
-  validateCapacityCalibrationOptions,
-} from '@forgezero/agent/capacity-calibration';
-
-import type {
-  CapacityCalibration,
-  CapacityCalibrationOptions,
-  CapacityStage,
-  HostCapacitySample,
-  ValidatedCapacityCalibrationOptions,
-} from '@forgezero/agent/capacity-calibration';
-```
-
-## @forgezero/agent/capacity-calibration — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  calibrateHttpConcurrency,
-} from '@forgezero/agent/capacity-calibration';
-
-export const selectedCapability = calibrateHttpConcurrency;
-```
-
-<a id="forgezero-agent-cloudflare-bootstrap"></a>
-## @forgezero/agent/cloudflare-bootstrap
-
-Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. This entry exposes 14 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  applyCloudflareBootstrap,
-  cloudflareHostHandoffPath,
-  deriveCloudflareRealtimeSecrets,
-  finalizeCloudflareBootstrapAcceptance,
-  planCloudflareBootstrap,
-  readCloudflareBootstrapAcceptanceEvidence,
-  readCloudflareConnectorHandoff,
-  readCloudflareHostHandoff,
-  runAttendedCloudflareBootstrap,
-  validateCloudflareBootstrapCoordinates,
-  validateCloudflareBootstrapTokens,
-  validateCloudflareBootstrapTopology,
-  verifyCloudflareBootstrapAcceptance,
-  writeOwnerBootstrapOutput,
-} from '@forgezero/agent/cloudflare-bootstrap';
-
-import type {
-  AttendedCloudflareBootstrapRequest,
-  CloudflareBootstrapAcceptanceEvidence,
-  CloudflareBootstrapAcceptedNode,
-  CloudflareBootstrapCoordinates,
-  CloudflareBootstrapDependencies,
-  CloudflareBootstrapEvidence,
-  CloudflareBootstrapFinalizeRequest,
-  CloudflareBootstrapNodeCoordinates,
-  CloudflareBootstrapOutput,
-  CloudflareBootstrapPhaseRunner,
-  CloudflareBootstrapPlan,
-  CloudflareBootstrapTokens,
-  CloudflareBootstrapTopology,
-  CloudflareConnectorHandoff,
-  CloudflareHostHandoff,
-  CloudflareMeshCoordinates,
-  CloudflareRealtimeCoordinates,
-} from '@forgezero/agent/cloudflare-bootstrap';
-```
-
-## @forgezero/agent/cloudflare-bootstrap — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  applyCloudflareBootstrap,
-} from '@forgezero/agent/cloudflare-bootstrap';
-
-export const selectedCapability = applyCloudflareBootstrap;
-```
-
-<a id="forgezero-agent-cloudflare-edge"></a>
-## @forgezero/agent/cloudflare-edge
-
-Strict Cloudflare REST operations used by the attended bootstrap controller. This entry exposes 14 named value exports and 8 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  configureCloudflareEdge,
-  configureCloudflareRealtimeSecrets,
-  discoverCloudflareBootstrapResources,
-  ensureCloudflareMeshConnector,
-  ensureCloudflarePrivateDatabaseRoute,
-  ensureCloudflarePrivateRoute,
-  ensureCloudflareTunnel,
-  ensureCloudflareWarpDatabaseInclude,
-  ensureCloudflareWarpNetworkIncludes,
-  removeCloudflarePrivateDatabaseRoute,
-  removeCloudflarePrivateRoute,
-  removeCloudflareWarpDatabaseInclude,
-  retrieveCloudflareConnectorTokens,
-  verifyCloudflareWorkerDurableObjects,
-} from '@forgezero/agent/cloudflare-edge';
-
-import type {
-  CloudflareBootstrapDiscovery,
-  CloudflareDurableObjectNamespace,
-  CloudflareEdgeConfig,
-  CloudflareMeshConnector,
-  CloudflarePrivateRoute,
-  CloudflarePrivateRouteConfig,
-  CloudflareTunnel,
-  CloudflareWarpIncludeConfig,
-} from '@forgezero/agent/cloudflare-edge';
-```
-
-## @forgezero/agent/cloudflare-edge — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  configureCloudflareEdge,
-} from '@forgezero/agent/cloudflare-edge';
-
-export const selectedCapability = configureCloudflareEdge;
-```
-
-<a id="forgezero-agent-mesh-connector"></a>
-## @forgezero/agent/mesh-connector
-
-Fixed Cloudflare Mesh/WARP connector enrollment using only the unit-loaded connector credential. This entry exposes 2 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  configureMeshConnector,
-  readMeshConnectorCredential,
-} from '@forgezero/agent/mesh-connector';
-
-import type {
-  MeshConnectorCommandResult,
-  MeshConnectorExec,
-} from '@forgezero/agent/mesh-connector';
-```
-
-## @forgezero/agent/mesh-connector — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  configureMeshConnector,
-} from '@forgezero/agent/mesh-connector';
-
-export const selectedCapability = configureMeshConnector;
-```
-
-<a id="forgezero-agent-compute"></a>
-## @forgezero/agent/compute
-
-Compute claim, renewal, execution and completion client contracts. This entry exposes 9 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  ComputeError,
-  deviceInUse,
-  guestUnit,
-  parseCensus,
-  qemuArgv,
-  shapeEgressCommands,
-  shapeEgressUnitDirectives,
-  tapFor,
-  unitName,
-} from '@forgezero/agent/compute';
-
-import type {
-  GuestSpec,
-  RunningGuest,
-} from '@forgezero/agent/compute';
-```
-
-## @forgezero/agent/compute — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  ComputeError,
-} from '@forgezero/agent/compute';
-
-export const selectedCapability = ComputeError;
-```
-
-<a id="forgezero-agent-credential-schema"></a>
-## @forgezero/agent/credential-schema
-
-Canonical systemd credential names and validation shared by bootstrap and services. This entry exposes 7 named value exports and 3 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  AGENT_CREDENTIAL_LOCATIONS,
-  AGENT_CREDENTIAL_POLICY,
-  CLOUDFLARE_CREDENTIAL_NAMES,
-  CLOUDFLARE_CREDENTIAL_SCHEMA,
-  METAL_SYSTEMD_CREDENTIALS,
-  credentialBinding,
-  deploymentCredentialSchema,
-} from '@forgezero/agent/credential-schema';
-
-import type {
-  AgentCredentialLocation,
-  DeploymentCredentialBinding,
-  DeploymentCredentialSchema,
-} from '@forgezero/agent/credential-schema';
-```
-
-## @forgezero/agent/credential-schema — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  AGENT_CREDENTIAL_LOCATIONS,
-} from '@forgezero/agent/credential-schema';
-
-export const selectedCapability = AGENT_CREDENTIAL_LOCATIONS;
-```
-
-<a id="forgezero-agent-definition"></a>
-## @forgezero/agent/definition
-
-Legacy version 3 JSON deployment compatibility contract. This entry exposes 6 named value exports and 5 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEPLOY_SCHEMA_URL,
-  DefinitionError,
-  PIPELINE_VERSION,
-  parseDeployDefinition,
-  phasePipeline,
-  validateDeploymentService,
-} from '@forgezero/agent/definition';
-
-import type {
-  DeployDefinition,
-  DeployStep,
-  DeploymentPortAllocation,
-  DeploymentService,
-  PipelineProfile,
-} from '@forgezero/agent/definition';
-```
-
-## @forgezero/agent/definition — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEPLOY_SCHEMA_URL,
-} from '@forgezero/agent/definition';
-
-export const selectedCapability = DEPLOY_SCHEMA_URL;
 ```
 
 <a id="forgezero-agent-deploy"></a>
 ## @forgezero/agent/deploy
 
-Typed deployment authoring builders, built-in provider requirements and versioned action constructors. This entry exposes 14 named value exports and 42 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Typed deployment authoring builders, built-in provider requirements and versioned action constructors. This is a supported entry point. Import only the named values used by the adjacent task example; the declaration file remains the complete API reference.
 
 ```text
 import {
   actions,
-  application,
-  conditions,
-  credential,
-  database,
-  defineDeployment,
-  input,
-  providers,
-  ref,
-  requirement,
-  stage,
-  step,
-  target,
-  workflow,
-} from '@forgezero/agent/deploy';
-
-import type {
-  ApplicationComponent,
-  ApplicationRuntime,
-  ArangoDbProviderConfig,
-  BunProviderConfig,
-  CloudflaredProviderConfig,
-  ComponentDefinition,
-  ComputeConnectivityDefinition,
-  ComputePoolDefinition,
-  ComputeTopologyDefinition,
-  Condition,
-  ConditionOperand,
-  ContainerdProviderConfig,
-  CredentialDefinition,
-  DatabaseComponent,
-  DeploymentSource,
-  DockerProviderConfig,
-  HealthDefinition,
-  InputDefinition,
-  IntegerValue,
-  JsonObject,
-  JsonPrimitive,
-  JsonValue,
-  KataProviderConfig,
-  NetworkDefinition,
-  NginxProviderConfig,
-  OpenSshProviderConfig,
-  RequirementDefinition,
-  ResolvableJsonObject,
-  ResolvableJsonValue,
-  ResourceDefinition,
-  RetryDefinition,
-  StageDefinition,
-  StepScope,
-  StorageMount,
-  StringValue,
-  SystemdProviderConfig,
-  TargetDefinition,
-  UfwProviderConfig,
-  ValueReference,
-  WarpProviderConfig,
-  WorkflowDefinition,
-  WorkflowStepDefinition,
 } from '@forgezero/agent/deploy';
 ```
 
@@ -1243,455 +156,6 @@ export default defineDeployment({
 });
 ```
 
-<a id="forgezero-agent-deployment-targets"></a>
-## @forgezero/agent/deployment-targets
-
-Bounded input resolution and stable compute-target assignment for typed plans; emits requirements and slots rather than physical hostnames. This entry exposes 3 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DeploymentInputError,
-  resolveDeploymentInputs,
-  resolveDeploymentTargets,
-} from '@forgezero/agent/deployment-targets';
-```
-
-## @forgezero/agent/deployment-targets — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DeploymentInputError,
-} from '@forgezero/agent/deployment-targets';
-
-export const selectedCapability = DeploymentInputError;
-```
-
-<a id="forgezero-agent-deployment-connectivity"></a>
-## @forgezero/agent/deployment-connectivity
-
-Root-owned convergence of exact private routes, routed-port firewall rules and per-target Cloudflare Tunnel or Mesh connector capabilities without exposing the project management token to a compute. This entry exposes 1 named value export and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  applyDeploymentConnectivity,
-} from '@forgezero/agent/deployment-connectivity';
-
-import type {
-  DeploymentConnectivityCapabilities,
-  DeploymentConnectivityEvidence,
-  DeploymentConnectivityHost,
-  DeploymentConnectivityIntent,
-  DeploymentConnectivityRequest,
-  DeploymentConnectivityTopology,
-} from '@forgezero/agent/deployment-connectivity';
-```
-
-## @forgezero/agent/deployment-connectivity — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  applyDeploymentConnectivity,
-} from '@forgezero/agent/deployment-connectivity';
-
-export const selectedCapability = applyDeploymentConnectivity;
-```
-
-<a id="forgezero-agent-deployment-topology"></a>
-## @forgezero/agent/deployment-topology
-
-Pure per-Metal relay election and hierarchical peer assignment: one or two Metals stay direct-private, while three or more grant Mesh/WARP only to relay and standby. This entry exposes 2 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DeploymentTopologyError,
-  planDeploymentTopology,
-} from '@forgezero/agent/deployment-topology';
-
-import type {
-  DeploymentTopologyAssignment,
-  DeploymentTopologyPlacement,
-  DeploymentTopologyRole,
-  DeploymentTopologyTransport,
-} from '@forgezero/agent/deployment-topology';
-```
-
-## @forgezero/agent/deployment-topology — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DeploymentTopologyError,
-} from '@forgezero/agent/deployment-topology';
-
-export const selectedCapability = DeploymentTopologyError;
-```
-
-<a id="forgezero-agent-deploy-plan"></a>
-## @forgezero/agent/deploy-plan
-
-Runtime validation, canonicalization and semantic digest for inert deployment plans. This entry exposes 8 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEPLOY_PLAN_FORMAT,
-  DEPLOY_PLAN_VERSION,
-  DeploymentPlanError,
-  canonicalJson,
-  compileDeployment,
-  deploymentPlanDigest,
-  deploymentSourceDigest,
-  parseDeploymentPlan,
-} from '@forgezero/agent/deploy-plan';
-
-import type {
-  DeploymentPlan,
-  PlannedStage,
-  PlannedStep,
-  PlannedWorkflow,
-} from '@forgezero/agent/deploy-plan';
-```
-
-## @forgezero/agent/deploy-plan — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEPLOY_PLAN_FORMAT,
-} from '@forgezero/agent/deploy-plan';
-
-export const selectedCapability = DEPLOY_PLAN_FORMAT;
-```
-
-<a id="forgezero-agent-deploy-plan-runner"></a>
-## @forgezero/agent/deploy-plan-runner
-
-Conditional DAG execution with bounded retry, compensation and failure policy over injected action handlers. This entry exposes 3 named value exports and 8 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DeploymentActionError,
-  evaluateCondition,
-  runDeploymentPlan,
-} from '@forgezero/agent/deploy-plan-runner';
-
-import type {
-  ActionContext,
-  ActionExecutionResult,
-  ActionFailureKind,
-  ActionHandler,
-  PlanRunResult,
-  PlanStepStatus,
-  RunDeploymentPlanOptions,
-  StepExecutionRecord,
-} from '@forgezero/agent/deploy-plan-runner';
-```
-
-## @forgezero/agent/deploy-plan-runner — Extend the plan with a namespaced action
-
-Public projects can define a versioned action coordinate and install an exact handler. Built-in forgezero.* coordinates stay closed; unknown built-ins fail validation.
-
-```text
-import {
-  actions,
-} from '@forgezero/agent/deploy';
-import {
-  runDeploymentPlan,
-} from '@forgezero/agent/deploy-plan-runner';
-
-const notify = actions.extension('example.notifications/publish@1', { channel: 'deployments' }, {
-  scope: { kind: 'release-executor' },
-  retry: { attempts: 3, backoff: { kind: 'exponential', initialMs: 250, maximumMs: 5000 }, retryOn: ['network'] }
-});
-
-await runDeploymentPlan({
-  plan, workflow: 'deploy', inputs: {},
-  actions: { 'example.notifications/publish@1': async ({ resolved }) => ({ changed: true, evidence: resolved }) }
-});
-```
-
-<a id="forgezero-agent-deploy-compiler"></a>
-## @forgezero/agent/deploy-compiler
-
-Explicit developer/CI compiler from forgezero.deploy.ts to canonical .fz/deploy.plan.json; never used to execute project TypeScript in production. This entry exposes 7 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEPLOY_PLAN_FILE,
-  DEPLOY_SOURCE_FILE,
-  compileDeploymentProject,
-  defaultTypeScriptDeployment,
-  initializeTypeScriptDeployment,
-  inspectCompiledDeployment,
-  loadDeploymentSource,
-} from '@forgezero/agent/deploy-compiler';
-
-import type {
-  DeploymentCompilation,
-  DeploymentInitOptions,
-  DeploymentInitProvisioning,
-  DeploymentInitRuntime,
-} from '@forgezero/agent/deploy-compiler';
-```
-
-## @forgezero/agent/deploy-compiler — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEPLOY_PLAN_FILE,
-} from '@forgezero/agent/deploy-compiler';
-
-export const selectedCapability = DEPLOY_PLAN_FILE;
-```
-
-<a id="forgezero-agent-deploy-file"></a>
-## @forgezero/agent/deploy-file
-
-Read and validate a checked-out .fz deployment file without executing project input. This entry exposes 7 named value exports and 2 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEPLOY_FILE,
-  DEPLOY_SCHEMA_URL,
-  DEPLOY_TODO_PREFIX,
-  defaultDeployFile,
-  deployDefinitionDigest,
-  initializeDeployFile,
-  inspectDeployFile,
-} from '@forgezero/agent/deploy-file';
-
-import type {
-  DeployFileSummary,
-  InitializedDeployFile,
-} from '@forgezero/agent/deploy-file';
-```
-
-## @forgezero/agent/deploy-file — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEPLOY_FILE,
-} from '@forgezero/agent/deploy-file';
-
-export const selectedCapability = DEPLOY_FILE;
-```
-
-<a id="forgezero-agent-metal-bootstrap"></a>
-## @forgezero/agent/metal-bootstrap
-
-Physical-metal bootstrap planning, application and status evidence. This entry exposes 10 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  METAL_BOOTSTRAP_STATE_PATH,
-  MetalBootstrapError,
-  applyMetalBootstrap,
-  metalBootstrapStatus,
-  normalizeMetalPublicIdentity,
-  planMetalBootstrap,
-  readMetalBootstrapConfig,
-  renderMetalUnits,
-  validateMetalBootstrapConfig,
-  validateOwnerOnlyPath,
-} from '@forgezero/agent/metal-bootstrap';
-
-import type {
-  MetalBootstrapApplyOptions,
-  MetalBootstrapConfig,
-  MetalBootstrapExec,
-  MetalBootstrapPlan,
-  MetalBootstrapResult,
-  MetalBootstrapStatus,
-  MetalBootstrapValidationOptions,
-} from '@forgezero/agent/metal-bootstrap';
-```
-
-## @forgezero/agent/metal-bootstrap — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  METAL_BOOTSTRAP_STATE_PATH,
-} from '@forgezero/agent/metal-bootstrap';
-
-export const selectedCapability = METAL_BOOTSTRAP_STATE_PATH;
-```
-
-<a id="forgezero-agent-metal-provision"></a>
-## @forgezero/agent/metal-provision
-
-The single constrained compute materializer for platform genesis, platform scaling and tenant compute. It executes caller-supplied OS, CPU, memory, disk, bandwidth, network and confidentiality coordinates after capacity and image validation; it owns no environment or product-tier shape. This entry exposes 11 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  MetalProvisionError,
-  allocateAddress,
-  allocateCpuPool,
-  cloudInit,
-  guestBootstrapOperations,
-  guestNameFor,
-  macForAddress,
-  provisionMetalGuest,
-  removeMetalGuest,
-  tapNameFor,
-  validateMetalProfile,
-} from '@forgezero/agent/metal-provision';
-
-import type {
-  GuestManifest,
-  MetalCommandResult,
-  MetalCpuAllocation,
-  MetalCpuPool,
-  MetalExec,
-  MetalImage,
-  MetalProvisionProfile,
-} from '@forgezero/agent/metal-provision';
-```
-
-## @forgezero/agent/metal-provision — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  MetalProvisionError,
-} from '@forgezero/agent/metal-provision';
-
-export const selectedCapability = MetalProvisionError;
-```
-
-<a id="forgezero-agent-platform-bootstrap-runtime"></a>
-## @forgezero/agent/platform-bootstrap-runtime
-
-Pure platform bootstrap validation, render and resumable phase-state contracts. This entry exposes 11 named value exports and 14 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  activatePlatformRelease,
-  assertReleaseLinksContained,
-  planLocalOtlpProof,
-  planPlatformActivation,
-  platformApiCredentialSpecs,
-  renderPlatformActivationFiles,
-  renderPlatformApiUnits,
-  renderPlatformNginx,
-  renderPlatformSharedEnvironment,
-  validatePlatformInitialInventory,
-  validatePlatformSharedEnvironment,
-} from '@forgezero/agent/platform-bootstrap-runtime';
-
-import type {
-  ActivationBoundary,
-  ApiRuntimeRenderOptions,
-  ApiSlot,
-  LocalOtlpProofPlan,
-  PlatformActivationCommandResult,
-  PlatformActivationConfig,
-  PlatformActivationExec,
-  PlatformBootstrapEmail,
-  PlatformDatabaseRole,
-  PlatformInitialInventory,
-  PlatformInitialInventoryCompute,
-  PlatformSharedEnvironment,
-  PlatformSoftwareProfile,
-  SystemdCredentialSpec,
-} from '@forgezero/agent/platform-bootstrap-runtime';
-```
-
-## @forgezero/agent/platform-bootstrap-runtime — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  activatePlatformRelease,
-} from '@forgezero/agent/platform-bootstrap-runtime';
-
-export const selectedCapability = activatePlatformRelease;
-```
-
-<a id="forgezero-agent-project-context"></a>
-## @forgezero/agent/project-context
-
-Project identity and repository context validation for operator and managed runs. This entry exposes 9 named value exports and 4 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  PROJECT_CONTEXT_VERSION,
-  ProjectContextError,
-  checkProjectContext,
-  defaultProjectContext,
-  initializeProjectContext,
-  parseProjectContext,
-  projectContextFiles,
-  renderProjectContext,
-  syncProjectContext,
-} from '@forgezero/agent/project-context';
-
-import type {
-  ContextCheck,
-  ContextFile,
-  ProjectContextManifest,
-  ProjectTruthSource,
-} from '@forgezero/agent/project-context';
-```
-
-## @forgezero/agent/project-context — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  PROJECT_CONTEXT_VERSION,
-} from '@forgezero/agent/project-context';
-
-export const selectedCapability = PROJECT_CONTEXT_VERSION;
-```
-
-<a id="forgezero-agent-provisioning-pull"></a>
-## @forgezero/agent/provisioning-pull
-
-Signed provisioning work claim, renewal, execution and acknowledgement. This entry exposes 2 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  pullProvisioningOnce,
-  startProvisioningPull,
-} from '@forgezero/agent/provisioning-pull';
-
-import type {
-  CreateRemoteProvisionClaim,
-  GuestAccess,
-  ProvisionPullResult,
-  ProvisionResult,
-  ProvisionRunner,
-  ProvisioningPullOptions,
-  RemoteProvisionClaim,
-} from '@forgezero/agent/provisioning-pull';
-```
-
-## @forgezero/agent/provisioning-pull — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  pullProvisioningOnce,
-} from '@forgezero/agent/provisioning-pull';
-
-export const selectedCapability = pullProvisioningOnce;
-```
-
 <a id="forgezero-agent-schema-deploy-v3-json"></a>
 ## @forgezero/agent/schema/deploy-v3.json
 
@@ -1713,131 +177,6 @@ const validate = new Ajv({ allErrors: true, strict: true }).compile(deploySchema
 if (!validate(deploymentDefinition)) throw new Error(JSON.stringify(validate.errors));
 ```
 
-<a id="forgezero-agent-software"></a>
-## @forgezero/agent/software
-
-Exact managed-software inventory, requirement and evidence contracts. This entry exposes 14 named value exports and 10 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  BUILDKIT_VERSION,
-  BUN_RELEASE_SHA256,
-  KATA_CONTAINERS_VERSION,
-  NERDCTL_VERSION,
-  OS_CATALOG,
-  PINNED_BUN_VERSION,
-  SOFTWARE_CATALOG,
-  ensureSoftwareRequirements,
-  executeSoftwareOperation,
-  observeSoftwareHost,
-  runSoftwareCommand,
-  softwareDownloadCommand,
-  softwareSpawnFailure,
-  validateSoftwareRequirements,
-} from '@forgezero/agent/software';
-
-import type {
-  CatalogStatus,
-  DeploymentChannel,
-  OsCatalogEntry,
-  SoftwareCatalogEntry,
-  SoftwareCommandResult,
-  SoftwareExec,
-  SoftwareId,
-  SoftwareObservation,
-  SoftwareOperation,
-  SoftwareRequirement,
-} from '@forgezero/agent/software';
-```
-
-## @forgezero/agent/software — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  BUILDKIT_VERSION,
-} from '@forgezero/agent/software';
-
-export const selectedCapability = BUILDKIT_VERSION;
-```
-
-<a id="forgezero-agent-software-helper"></a>
-## @forgezero/agent/software-helper
-
-Root-owned fixed installation/update boundary for declared software. This entry exposes 9 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  DEFAULT_SOFTWARE_HELPER_SOCKET,
-  SOFTWARE_HELPER_GROUP,
-  SOFTWARE_HELPER_UNIT_PATH,
-  requestContainerActivation,
-  requestContainerBuild,
-  requestDeploymentConnectivity,
-  requestServiceActivation,
-  requestSoftware,
-  startSoftwareHelper,
-} from '@forgezero/agent/software-helper';
-```
-
-## @forgezero/agent/software-helper — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  DEFAULT_SOFTWARE_HELPER_SOCKET,
-} from '@forgezero/agent/software-helper';
-
-export const selectedCapability = DEFAULT_SOFTWARE_HELPER_SOCKET;
-```
-
-<a id="forgezero-agent-ubuntu"></a>
-## @forgezero/agent/ubuntu
-
-The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. This entry exposes 4 named value exports and 0 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
-
-```text
-import {
-  SUPPORTED_GUEST_IMAGE,
-  SUPPORTED_GUEST_IMAGES,
-  assertSupportedGuestImage,
-  supportedGuestImage,
-} from '@forgezero/agent/ubuntu';
-```
-
-## @forgezero/agent/ubuntu — Use this entry point
-
-This minimal executable use imports one concrete value from this exact entry point without a wildcard or package-root detour. Keep the value or values the application actually needs; the full named inventory remains directly above it.
-
-```text
-import {
-  SUPPORTED_GUEST_IMAGE,
-} from '@forgezero/agent/ubuntu';
-
-export const selectedCapability = SUPPORTED_GUEST_IMAGE;
-```
-
-<a id="fz-agent-replica"></a>
-## fz-agent (replica)
-
-The authorized project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, cleared when local authority is revoked, and refusing a read it can no longer vouch for. This is a managed runtime interface label, not an import or standalone executable.
-
-```text
-fz-agent (replica)
-# Accessed through the installed Agent boundary.
-```
-
-## fz-agent (replica) — Operational interface
-
-This inventory entry names an Agent-owned runtime interface, not an importable namespace or a command to paste. Applications reach it through the installed Agent and the documented Vault client.
-
-```text
-fz-agent (replica)
-# Managed by the installed fz-agent service; no direct executable entry.
-```
-
 ## Install both machine commands
 
 One public package installs `fz` and `fz-agent` at the same version. `fz` breaks the bootstrap circle from an operator machine; `fz-agent` runs managed work. Keeping them together prevents a new bootstrap command from provisioning an old daemon protocol.