@forgezero/agent 0.1.151 → 0.1.153

package/dist/fz-agent.js

@@ -21,7 +21,7 @@ function fromBase64Url(value) {
   return Uint8Array.from(binary, (character) => character.charCodeAt(0));
 }
 
-// ../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_u64.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_u64.js
 var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
 var _32n = /* @__PURE__ */ BigInt(32);
 function fromBig(n, le = false) {
@@ -64,7 +64,7 @@ var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0
 var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// ../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/utils.js
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -89,18 +89,18 @@ function abytes(value, length, title = "") {
     throw new TypeError(message);
   throw new RangeError(message);
 }
-function ahash(h) {
-  if (typeof h !== "function" || typeof h.create !== "function")
-    throw new TypeError("expected hash wrapped by utils.createHasher");
-  anumber(h.outputLen);
-  anumber(h.blockLen);
-  if (h.outputLen < 1 || h.blockLen < 1)
-    throw new Error("hash blockLen / outputLen must be >= 1");
-}
 var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -122,9 +122,6 @@ function clean(...arrays) {
 function createView(arr) {
   return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
-function rotr(word, shift) {
-  return word << 32 - shift | word >>> shift;
-}
 var hasHexBuiltin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
 var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 function bytesToHex(bytes) {
@@ -184,10 +181,10 @@ function concatBytes(...arrays) {
   return res;
 }
 function checkOpts(defaults, opts, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts !== undefined)
-    aobject(opts, title);
-  const merged = Object.assign(defaults, opts);
+    aopts(opts, title);
+  const merged = Object.assign(Object.create(null), defaults, opts);
   return merged;
 }
 function createHasher(hashCons, info = {}) {
@@ -216,14 +213,7 @@ var oidNist = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/_md.js
-function Chi(a, b, c) {
-  return a & b ^ ~a & c;
-}
-function Maj(a, b, c) {
-  return a & b ^ a & c ^ b & c;
-}
-
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/_md.js
 class HashMD {
   blockLen;
   outputLen;
@@ -318,16 +308,6 @@ class HashMD {
     return this._cloneInto();
   }
 }
-var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
-  1779033703,
-  3144134277,
-  1013904242,
-  2773480762,
-  1359893119,
-  2600822924,
-  528734635,
-  1541459225
-]);
 var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   1779033703,
   4089235720,
@@ -347,163 +327,7 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/sha2.js
-var SHA256_K = /* @__PURE__ */ Uint32Array.from([
-  1116352408,
-  1899447441,
-  3049323471,
-  3921009573,
-  961987163,
-  1508970993,
-  2453635748,
-  2870763221,
-  3624381080,
-  310598401,
-  607225278,
-  1426881987,
-  1925078388,
-  2162078206,
-  2614888103,
-  3248222580,
-  3835390401,
-  4022224774,
-  264347078,
-  604807628,
-  770255983,
-  1249150122,
-  1555081692,
-  1996064986,
-  2554220882,
-  2821834349,
-  2952996808,
-  3210313671,
-  3336571891,
-  3584528711,
-  113926993,
-  338241895,
-  666307205,
-  773529912,
-  1294757372,
-  1396182291,
-  1695183700,
-  1986661051,
-  2177026350,
-  2456956037,
-  2730485921,
-  2820302411,
-  3259730800,
-  3345764771,
-  3516065817,
-  3600352804,
-  4094571909,
-  275423344,
-  430227734,
-  506948616,
-  659060556,
-  883997877,
-  958139571,
-  1322822218,
-  1537002063,
-  1747873779,
-  1955562222,
-  2024104815,
-  2227730452,
-  2361852424,
-  2428436474,
-  2756734187,
-  3204031479,
-  3329325298
-]);
-var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-
-class SHA2_32B extends HashMD {
-  A = 0;
-  B = 0;
-  C = 0;
-  D = 0;
-  E = 0;
-  F = 0;
-  G = 0;
-  H = 0;
-  constructor(outputLen, IV) {
-    super(64, outputLen, 8, false);
-    this.A = IV[0] | 0;
-    this.B = IV[1] | 0;
-    this.C = IV[2] | 0;
-    this.D = IV[3] | 0;
-    this.E = IV[4] | 0;
-    this.F = IV[5] | 0;
-    this.G = IV[6] | 0;
-    this.H = IV[7] | 0;
-  }
-  get() {
-    const { A, B, C, D, E, F, G, H } = this;
-    return [A, B, C, D, E, F, G, H];
-  }
-  set(A, B, C, D, E, F, G, H) {
-    this.A = A | 0;
-    this.B = B | 0;
-    this.C = C | 0;
-    this.D = D | 0;
-    this.E = E | 0;
-    this.F = F | 0;
-    this.G = G | 0;
-    this.H = H | 0;
-  }
-  _cloneInto(to) {
-    (to ||= new this.constructor).set(...this.get());
-    return this._cloneIntoMeta(to);
-  }
-  process(view, offset) {
-    for (let i = 0;i < 16; i++, offset += 4)
-      SHA256_W[i] = view.getUint32(offset, false);
-    for (let i = 16;i < 64; i++) {
-      const W15 = SHA256_W[i - 15];
-      const W2 = SHA256_W[i - 2];
-      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
-      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
-      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
-    }
-    let { A, B, C, D, E, F, G, H } = this;
-    for (let i = 0;i < 64; i++) {
-      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
-      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
-      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
-      const T2 = sigma0 + Maj(A, B, C) | 0;
-      H = G;
-      G = F;
-      F = E;
-      E = D + T1 | 0;
-      D = C;
-      C = B;
-      B = A;
-      A = T1 + T2 | 0;
-    }
-    A = A + this.A | 0;
-    B = B + this.B | 0;
-    C = C + this.C | 0;
-    D = D + this.D | 0;
-    E = E + this.E | 0;
-    F = F + this.F | 0;
-    G = G + this.G | 0;
-    H = H + this.H | 0;
-    this.set(A, B, C, D, E, F, G, H);
-  }
-  roundClean() {
-    clean(SHA256_W);
-  }
-  destroy() {
-    this.destroyed = true;
-    this.set(0, 0, 0, 0, 0, 0, 0, 0);
-    clean(this.buffer);
-  }
-}
-
-class _SHA256 extends SHA2_32B {
-  constructor() {
-    super(32, SHA256_IV);
-  }
-}
+// ../../node_modules/.bun/@noble+hashes@2.4.0/node_modules/@noble/hashes/sha2.js
 var K512 = /* @__PURE__ */ (() => split([
   "0x428a2f98d728ae22",
   "0x7137449123ef65cd",
@@ -727,10 +551,9 @@ class _SHA512 extends SHA2_64B {
     super(64, SHA512_IV);
   }
 }
-var sha256 = /* @__PURE__ */ createHasher(() => new _SHA256, /* @__PURE__ */ oidNist(1));
 var sha512 = /* @__PURE__ */ createHasher(() => new _SHA512, /* @__PURE__ */ oidNist(3));
 
-// ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/utils.js
+// ../../node_modules/.bun/@noble+curves@2.4.0/node_modules/@noble/curves/utils.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 function aarray(item, title, inner = () => {}) {
   if (!Array.isArray(item))
@@ -850,7 +673,7 @@ function validateObject(object, fields = {}, optFields = {}, title = "object") {
   iter(optFields, true);
 }
 
-// ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/.bun/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/modular.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
@@ -1276,7 +1099,7 @@ function Field(ORDER, opts = {}) {
   return new _Field(ORDER, opts);
 }
 
-// ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/.bun/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/curve.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
@@ -1616,7 +1439,7 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/edwards.js
+// ../../node_modules/.bun/@noble+curves@2.4.0/node_modules/@noble/curves/abstract/edwards.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var _1n4 = /* @__PURE__ */ BigInt(1);
@@ -1945,7 +1768,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   }
   function sign(msg, secretKey, options = {}) {
     validateObject(options, {}, {}, "options");
-    msg = abytes2(msg, undefined, "message");
+    msg = copyBytes(abytes2(msg, undefined, "message"));
     if (prehash)
       msg = prehash(msg);
     const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
@@ -2040,7 +1863,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
 }
 
-// ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/ed25519.js
+// ../../node_modules/.bun/@noble+curves@2.4.0/node_modules/@noble/curves/ed25519.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _1n5 = /* @__PURE__ */ BigInt(1);
 var _2n3 = /* @__PURE__ */ BigInt(2);
@@ -2116,7 +1939,7 @@ function ed(opts) {
 }
 var ed25519 = /* @__PURE__ */ ed({});
 
-// ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -2145,6 +1968,16 @@ function abytes3(value, length, title = "") {
   }
   return value;
 }
+function ahash(h) {
+  if (typeof h !== "function" || typeof h.create !== "function")
+    throw new TypeError("Hash must wrapped by utils.createHasher");
+  anumber3(h.outputLen);
+  anumber3(h.blockLen);
+  if (h.outputLen < 1)
+    throw new Error('"outputLen" must be >= 1');
+  if (h.blockLen < 1)
+    throw new Error('"blockLen" must be >= 1');
+}
 function aexists2(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("Hash instance has been destroyed");
@@ -2271,7 +2104,7 @@ var oidNist2 = (suffix) => ({
   oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
 });
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/utils.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/utils.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var abytes4 = (value, length, title) => abytes3(value, length, title);
 var anumber4 = anumber3;
@@ -2393,7 +2226,7 @@ var notImplemented2 = () => {
   throw new Error("not implemented");
 };
 
-// ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/_u64.js
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/_u64.js
 var U32_MASK642 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
 var _32n2 = /* @__PURE__ */ BigInt(32);
 function fromBig2(n, le = false) {
@@ -2432,7 +2265,7 @@ var add4H2 = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) |
 var add5L2 = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H2 = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha3.js
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha3.js
 var _0n6 = BigInt(0);
 var _1n7 = BigInt(1);
 var _2n4 = BigInt(2);
@@ -2636,7 +2469,7 @@ var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher2((opts =
 var shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist2(11));
 var shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist2(12));
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/fft.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/fft.js
 function checkU32(n) {
   if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295)
     throw new Error("wrong u32 integer:" + n);
@@ -2720,7 +2553,7 @@ var FFTCore = (F, coreOpts) => {
   };
 };
 
-// ../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/utils.js
+// ../../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/utils.js
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 var abytesDoc = abytes3;
 var randomBytes5 = randomBytes3;
@@ -2847,7 +2680,7 @@ function getMessagePrehash(hash, msg, ctx = EMPTY) {
   return concatBytes3(new Uint8Array([1, ctx.length]), ctx, hash.oid, hashed);
 }
 
-// ../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/_crystals.js
+// ../../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/_crystals.js
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 var genCrystals = (opts) => {
   const { newPoly, N, Q, F, ROOT_OF_UNITY, brvBits, isKyber } = opts;
@@ -2968,7 +2801,7 @@ var createXofShake = (shake) => (seed, blockLen) => {
 var XOF128 = /* @__PURE__ */ createXofShake(shake128);
 var XOF256 = /* @__PURE__ */ createXofShake(shake256);
 
-// ../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-dsa.js
+// ../../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-dsa.js
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 function validateInternalOpts(opts) {
   validateOpts(opts);
@@ -3483,7 +3316,7 @@ var ml_dsa65 = /* @__PURE__ */ (() => getDilithium({
   securityLevel: 192
 }))();
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/modular.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/modular.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n7 = /* @__PURE__ */ BigInt(0);
 var _1n8 = /* @__PURE__ */ BigInt(1);
@@ -3872,7 +3705,7 @@ function Field2(ORDER, opts = {}) {
   return new _Field2(ORDER, opts);
 }
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/curve.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/curve.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n8 = /* @__PURE__ */ BigInt(0);
 var _1n9 = /* @__PURE__ */ BigInt(1);
@@ -4064,7 +3897,7 @@ function createKeygen2(randomSecretKey, getPublicKey) {
   };
 }
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/edwards.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/edwards.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n9 = /* @__PURE__ */ BigInt(0);
 var _1n10 = /* @__PURE__ */ BigInt(1);
@@ -4380,7 +4213,7 @@ class PrimeEdwardsPoint2 {
   }
 }
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/montgomery.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/montgomery.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n10 = BigInt(0);
 var _1n11 = BigInt(1);
@@ -4503,7 +4336,83 @@ function montgomery(curveDef) {
   });
 }
 
-// ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/_md.js
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/hmac.js
+class _HMAC {
+  oHash;
+  iHash;
+  blockLen;
+  outputLen;
+  canXOF = false;
+  finished = false;
+  destroyed = false;
+  constructor(hash, key) {
+    ahash(hash);
+    abytes3(key, undefined, "key");
+    this.iHash = hash.create();
+    if (typeof this.iHash.update !== "function")
+      throw new Error("Expected instance of class which extends utils.Hash");
+    this.blockLen = this.iHash.blockLen;
+    this.outputLen = this.iHash.outputLen;
+    const blockLen = this.blockLen;
+    const pad = new Uint8Array(blockLen);
+    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+    for (let i = 0;i < pad.length; i++)
+      pad[i] ^= 54;
+    this.iHash.update(pad);
+    this.oHash = hash.create();
+    for (let i = 0;i < pad.length; i++)
+      pad[i] ^= 54 ^ 92;
+    this.oHash.update(pad);
+    clean2(pad);
+  }
+  update(buf) {
+    aexists2(this);
+    this.iHash.update(buf);
+    return this;
+  }
+  digestInto(out) {
+    aexists2(this);
+    aoutput2(out, this);
+    this.finished = true;
+    const buf = out.subarray(0, this.outputLen);
+    this.iHash.digestInto(buf);
+    this.oHash.update(buf);
+    this.oHash.digestInto(buf);
+    this.destroy();
+  }
+  digest() {
+    const out = new Uint8Array(this.oHash.outputLen);
+    this.digestInto(out);
+    return out;
+  }
+  _cloneInto(to) {
+    to ||= Object.create(Object.getPrototypeOf(this), {});
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    to = to;
+    to.finished = finished;
+    to.destroyed = destroyed;
+    to.blockLen = blockLen;
+    to.outputLen = outputLen;
+    to.oHash = oHash._cloneInto(to.oHash);
+    to.iHash = iHash._cloneInto(to.iHash);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  destroy() {
+    this.destroyed = true;
+    this.oHash.destroy();
+    this.iHash.destroy();
+  }
+}
+var hmac = /* @__PURE__ */ (() => {
+  const hmac_ = (hash, key, message) => new _HMAC(hash, key).update(message).digest();
+  hmac_.create = (hash, key) => new _HMAC(hash, key);
+  return hmac_;
+})();
+
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/_md.js
 function Chi2(a, b, c) {
   return a & b ^ ~a & c;
 }
@@ -4663,8 +4572,8 @@ var SHA512_IV2 = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha2.js
-var SHA256_K2 = /* @__PURE__ */ Uint32Array.from([
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
   1899447441,
   3049323471,
@@ -4730,9 +4639,9 @@ var SHA256_K2 = /* @__PURE__ */ Uint32Array.from([
   3204031479,
   3329325298
 ]);
-var SHA256_W2 = /* @__PURE__ */ new Uint32Array(64);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
 
-class SHA2_32B2 extends HashMD2 {
+class SHA2_32B extends HashMD2 {
   constructor(outputLen) {
     super(64, outputLen, 8, false);
   }
@@ -4752,18 +4661,18 @@ class SHA2_32B2 extends HashMD2 {
   }
   process(view, offset) {
     for (let i = 0;i < 16; i++, offset += 4)
-      SHA256_W2[i] = view.getUint32(offset, false);
+      SHA256_W[i] = view.getUint32(offset, false);
     for (let i = 16;i < 64; i++) {
-      const W15 = SHA256_W2[i - 15];
-      const W2 = SHA256_W2[i - 2];
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
       const s0 = rotr2(W15, 7) ^ rotr2(W15, 18) ^ W15 >>> 3;
       const s1 = rotr2(W2, 17) ^ rotr2(W2, 19) ^ W2 >>> 10;
-      SHA256_W2[i] = s1 + SHA256_W2[i - 7] + s0 + SHA256_W2[i - 16] | 0;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
     }
     let { A, B, C, D: D2, E, F: F2, G, H } = this;
     for (let i = 0;i < 64; i++) {
       const sigma1 = rotr2(E, 6) ^ rotr2(E, 11) ^ rotr2(E, 25);
-      const T1 = H + sigma1 + Chi2(E, F2, G) + SHA256_K2[i] + SHA256_W2[i] | 0;
+      const T1 = H + sigma1 + Chi2(E, F2, G) + SHA256_K[i] + SHA256_W[i] | 0;
       const sigma0 = rotr2(A, 2) ^ rotr2(A, 13) ^ rotr2(A, 22);
       const T2 = sigma0 + Maj2(A, B, C) | 0;
       H = G;
@@ -4786,7 +4695,7 @@ class SHA2_32B2 extends HashMD2 {
     this.set(A, B, C, D2, E, F2, G, H);
   }
   roundClean() {
-    clean2(SHA256_W2);
+    clean2(SHA256_W);
   }
   destroy() {
     this.destroyed = true;
@@ -4795,7 +4704,7 @@ class SHA2_32B2 extends HashMD2 {
   }
 }
 
-class _SHA2562 extends SHA2_32B2 {
+class _SHA256 extends SHA2_32B {
   A = SHA256_IV2[0] | 0;
   B = SHA256_IV2[1] | 0;
   C = SHA256_IV2[2] | 0;
@@ -4809,7 +4718,7 @@ class _SHA2562 extends SHA2_32B2 {
   }
 }
 
-class _SHA224 extends SHA2_32B2 {
+class _SHA224 extends SHA2_32B {
   A = SHA224_IV2[0] | 0;
   B = SHA224_IV2[1] | 0;
   C = SHA224_IV2[2] | 0;
@@ -5127,9 +5036,10 @@ class _SHA512_256 extends SHA2_64B2 {
     super(32);
   }
 }
+var sha256 = /* @__PURE__ */ createHasher2(() => new _SHA256, /* @__PURE__ */ oidNist2(1));
 var sha5122 = /* @__PURE__ */ createHasher2(() => new _SHA5122, /* @__PURE__ */ oidNist2(3));
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/hash-to-curve.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/hash-to-curve.js
 function i2osp(value, length) {
   asafenumber2(value);
   asafenumber2(length);
@@ -5184,7 +5094,7 @@ function expand_message_xmd(msg, DST, lenInBytes, H) {
 }
 var _DST_scalar = "HashToScalar-";
 
-// ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/ed25519.js
+// ../../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/ed25519.js
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 var _0n11 = /* @__PURE__ */ BigInt(0);
 var _1n12 = /* @__PURE__ */ BigInt(1);
@@ -5407,7 +5317,47 @@ var ristretto255_hasher = Object.freeze({
   }
 });
 
-// ../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-kem.js
+// ../../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/hkdf.js
+function extract(hash, ikm, salt) {
+  ahash(hash);
+  if (salt === undefined)
+    salt = new Uint8Array(hash.outputLen);
+  return hmac(hash, salt, ikm);
+}
+var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
+var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
+function expand(hash, prk, info, length = 32) {
+  ahash(hash);
+  anumber3(length, "length");
+  abytes3(prk, undefined, "prk");
+  const olen = hash.outputLen;
+  if (prk.length < olen)
+    throw new Error('"prk" must be at least HashLen octets');
+  if (length > 255 * olen)
+    throw new Error("Length must be <= 255*HashLen");
+  const blocks = Math.ceil(length / olen);
+  if (info === undefined)
+    info = EMPTY_BUFFER;
+  else
+    abytes3(info, undefined, "info");
+  const okm = new Uint8Array(blocks * olen);
+  const HMAC = hmac.create(hash, prk);
+  const HMACTmp = HMAC._cloneInto();
+  const T = new Uint8Array(HMAC.outputLen);
+  for (let counter = 0;counter < blocks; counter++) {
+    HKDF_COUNTER[0] = counter + 1;
+    HMACTmp.update(counter === 0 ? EMPTY_BUFFER : T).update(info).update(HKDF_COUNTER).digestInto(T);
+    okm.set(T, olen * counter);
+    HMAC._cloneInto(HMACTmp);
+  }
+  HMAC.destroy();
+  HMACTmp.destroy();
+  clean2(T, HKDF_COUNTER);
+  return okm.slice(0, length);
+}
+var hkdf = (hash, ikm, salt, info, length) => expand(hash, extract(hash, ikm, salt), info, length);
+
+// ../../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-kem.js
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 var N2 = 256;
 var Q2 = 3329;
@@ -5688,7 +5638,7 @@ var mk = (params) => createKyber({
 });
 var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS2[768]))();
 
-// ../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/hybrid.js
+// ../../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/hybrid.js
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 function ecKeygen(curve, allowZeroKey = false) {
   const lengths = curve.lengths;
@@ -5859,144 +5809,6 @@ function combineKEMS(realSeedLen, realMsgLen, expandSeed, combiner, ...kems) {
 var x25519kem = /* @__PURE__ */ ecdhKem(x25519);
 var ml_kem768_x25519 = /* @__PURE__ */ (() => combineKEMS(32, 32, expandSeedXof(shake256), (pk, ct, ss) => sha3_256(concatBytes4(ss[0], ss[1], ct[1], pk[1], asciiToBytes("\\.//^\\"))), ml_kem768, x25519kem))();
 
-// ../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/hmac.js
-class _HMAC {
-  oHash;
-  iHash;
-  blockLen;
-  outputLen;
-  canXOF = false;
-  finished = false;
-  destroyed = false;
-  constructor(hash, key) {
-    ahash(hash);
-    abytes(key, undefined, "key");
-    this.iHash = hash.create();
-    if (typeof this.iHash.update !== "function")
-      throw new Error("expected Hash instance");
-    this.blockLen = this.iHash.blockLen;
-    this.outputLen = this.iHash.outputLen;
-    const blockLen = this.blockLen;
-    const pad = new Uint8Array(blockLen);
-    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i = 0;i < pad.length; i++)
-      pad[i] ^= 54;
-    this.iHash.update(pad);
-    this.oHash = hash.create();
-    for (let i = 0;i < pad.length; i++)
-      pad[i] ^= 54 ^ 92;
-    this.oHash.update(pad);
-    clean(pad);
-  }
-  update(buf) {
-    aexists(this);
-    this.iHash.update(buf);
-    return this;
-  }
-  digestInto(out) {
-    aexists(this);
-    aoutput(out, this);
-    this.finished = true;
-    const buf = out.subarray(0, this.outputLen);
-    this.iHash.digestInto(buf);
-    this.oHash.update(buf);
-    this.oHash.digestInto(buf);
-    this.destroy();
-  }
-  digest() {
-    const out = new Uint8Array(this.oHash.outputLen);
-    this.digestInto(out);
-    return out;
-  }
-  _cloneInto(to) {
-    to ||= Object.create(Object.getPrototypeOf(this), {});
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
-    to = to;
-    to.finished = finished;
-    to.destroyed = destroyed;
-    to.blockLen = blockLen;
-    to.outputLen = outputLen;
-    to.canXOF = canXOF;
-    to.oHash = oHash._cloneInto(to.oHash);
-    to.iHash = iHash._cloneInto(to.iHash);
-    return to;
-  }
-  clone() {
-    return this._cloneInto();
-  }
-  destroy() {
-    this.destroyed = true;
-    this.oHash.destroy();
-    this.iHash.destroy();
-  }
-}
-var hmac = /* @__PURE__ */ (() => {
-  const hmac_ = (hash, key, message) => new _HMAC(hash, key).update(message).digest();
-  hmac_.create = (hash, key) => new _HMAC(hash, key);
-  return hmac_;
-})();
-
-// ../node_modules/.bun/@noble+hashes@2.3.0/node_modules/@noble/hashes/hkdf.js
-var HKDF_COUNTER = /* @__PURE__ */ Uint8Array.of(0);
-var EMPTY_BUFFER = /* @__PURE__ */ Uint8Array.of();
-function expand(hash, prk, info, length = 32, _recycled) {
-  ahash(hash);
-  anumber(length, "length");
-  abytes(prk, undefined, "prk");
-  const olen = hash.outputLen;
-  if (prk.length < olen)
-    throw new Error('"prk" must be at least HashLen octets');
-  if (length > 255 * olen)
-    throw new Error("Length must be <= 255*HashLen");
-  const blocks = Math.ceil(length / olen);
-  if (info === undefined)
-    info = EMPTY_BUFFER;
-  else
-    abytes(info, undefined, "info");
-  if (!blocks) {
-    if (_recycled)
-      clean(prk);
-    return new Uint8Array;
-  }
-  const okm = _recycled && blocks === 1 ? prk : new Uint8Array(blocks * olen);
-  const { iHash, oHash } = hmac.create(hash, prk);
-  const T = _recycled ? prk : new Uint8Array(olen);
-  const worker = blocks > 1 ? _recycled?.iHash || hash.create() : undefined;
-  for (let counter = 0;counter < blocks - 1; counter++) {
-    HKDF_COUNTER[0] = counter + 1;
-    const iWork = iHash._cloneInto(worker);
-    if (counter)
-      iWork.update(T);
-    iWork.update(info).update(HKDF_COUNTER).digestInto(T);
-    oHash._cloneInto(worker).update(T).digestInto(T);
-    okm.set(T, olen * counter);
-  }
-  HKDF_COUNTER[0] = blocks;
-  if (blocks > 1)
-    iHash.update(T);
-  iHash.update(info).update(HKDF_COUNTER).digestInto(T);
-  oHash.update(T).digestInto(T);
-  okm.set(T, olen * (blocks - 1));
-  iHash.destroy();
-  oHash.destroy();
-  worker?.destroy();
-  if (T !== okm)
-    clean(T);
-  clean(HKDF_COUNTER);
-  if (length === okm.length)
-    return okm;
-  const res = okm.slice(0, length);
-  clean(okm);
-  return res;
-}
-var hkdf = (hash, ikm, salt, info, length) => {
-  ahash(hash);
-  if (salt === undefined)
-    salt = new Uint8Array(hash.outputLen);
-  const HMAC = hmac.create(hash, salt).update(ikm);
-  return expand(hash, HMAC.digest(), info, length, HMAC);
-};
-
 // ../runtime/dist/identity.js
 var ENCODER = new TextEncoder;
 var b64 = toBase64Url;
@@ -8265,13 +8077,15 @@ async function runPipeline(options) {
     const outcome = exitCode === 0 ? "ok" : "failed";
     if (outcome === "failed")
       failed = true;
-    steps.push({
+    const recorded = {
       name: step.name,
       outcome,
       exitCode,
       log: redact(output, values),
       durationMs: now() - started
-    });
+    };
+    steps.push(recorded);
+    await options.onStep?.(recorded);
   }
   return { pipeline: pipeline.name, ok: !failed, assurance, steps };
 }
@@ -9880,6 +9694,7 @@ async function runDeploymentPlan(options) {
           const record2 = { id: step2.id, stage: stage2.id, action: step2.uses, status: "skipped", attempts: 0, outputs: {}, changed: false };
           state.steps.set(step2.id, record2);
           records.push(record2);
+          await options.onStep?.(record2);
         }
         continue;
       }
@@ -9896,6 +9711,7 @@ async function runDeploymentPlan(options) {
       })();
       records.push(...stageRecords);
       for (const record2 of stageRecords) {
+        await options.onStep?.(record2);
         const step2 = stage2.steps.find((candidate) => candidate.id === record2.id);
         if (record2.status === "succeeded")
           successful2.push({ record: record2, step: step2, stage: stage2 });
@@ -10610,6 +10426,7 @@ function createDeploymentManager(options) {
           return { changed: true, outputs: { activeSlot: state.activeSlot, publicPort: state.publicPort } };
         }
       };
+      const livePlanSteps = [];
       const run2 = await runDeploymentPlan({
         plan,
         workflow: "deploy",
@@ -10638,7 +10455,18 @@ function createDeploymentManager(options) {
           memoryMiB: resolvedTargets[0].allocation.resources.memoryMiB,
           storageGiB: resolvedTargets[0].allocation.resources.storageGiB
         },
-        shouldRun: (step2) => step2.scope.kind === "release-executor" || step2.scope.kind === "elected-one" ? request.releaseExecutor === true : step2.scope.kind === "topology-role" ? targetNames.has(step2.scope.target) && assigned?.topology?.role === step2.scope.role : targetNames.has(step2.scope.target)
+        shouldRun: (step2) => step2.scope.kind === "release-executor" || step2.scope.kind === "elected-one" ? request.releaseExecutor === true : step2.scope.kind === "topology-role" ? targetNames.has(step2.scope.target) && assigned?.topology?.role === step2.scope.role : targetNames.has(step2.scope.target),
+        onStep: async (step2) => {
+          livePlanSteps.push({
+            phase: `${plan.name}:deploy:${step2.stage}`.slice(0, 128),
+            step: step2.id.slice(0, 128),
+            outcome: step2.status === "succeeded" || step2.status === "compensated" ? "ok" : step2.status === "skipped" ? "skipped" : "failed",
+            exitCode: step2.status === "succeeded" || step2.status === "compensated" ? 0 : step2.status === "skipped" ? null : 1,
+            durationMs: Math.max(0, (step2.finishedAtTs ?? step2.startedAtTs ?? 0) - (step2.startedAtTs ?? 0)),
+            ...step2.error?.message ? { detail: step2.error.message.slice(0, 2000) } : {}
+          });
+          await request.onProgress?.({ steps: [...livePlanSteps] });
+        }
       });
       const phase = {
         pipeline: `${plan.name}:deploy`,
@@ -10755,6 +10583,7 @@ function createDeploymentManager(options) {
       })
     ].filter((pipeline) => pipeline.steps.length > 0);
     const phases = [];
+    const liveExecutionSteps = [];
     let serviceActivated = false;
     const activateSelectedService = async () => {
       if (!selectedProfile.service || serviceActivated)
@@ -10774,7 +10603,23 @@ function createDeploymentManager(options) {
     for (const pipeline of pipelines) {
       if (pipeline.phase === "health")
         await activateSelectedService();
-      const result = await runPipeline({ pipeline, secret, exec: phaseExec, attest });
+      const result = await runPipeline({
+        pipeline,
+        secret,
+        exec: phaseExec,
+        attest,
+        onStep: async (step2) => {
+          liveExecutionSteps.push({
+            phase: pipeline.name.slice(0, 128),
+            step: step2.name.slice(0, 128),
+            outcome: step2.outcome,
+            exitCode: step2.exitCode,
+            durationMs: Math.max(0, Math.min(step2.durationMs, 86400000)),
+            ...step2.outcome === "failed" && step2.log.trim() ? { detail: step2.log.trim().slice(0, 2000) } : {}
+          });
+          await request.onProgress?.({ steps: [...liveExecutionSteps] });
+        }
+      });
       phases.push(result);
       if (!result.ok) {
         const failedStep = result.steps.find((step2) => step2.outcome === "failed");
@@ -11081,7 +10926,15 @@ async function deployClaim(options, claim) {
       releaseExecutor: claim.releaseExecutor,
       ...claim.assignment ? { assignment: claim.assignment } : {},
       ...claim.connectivityCapabilities ? { connectivityCapabilities: claim.connectivityCapabilities } : {},
-      ...claim.credentialBindings ? { credentialBindings: claim.credentialBindings } : {}
+      ...claim.credentialBindings ? { credentialBindings: claim.credentialBindings } : {},
+      onProgress: async (execution) => {
+        await postSigned(options, "progress", {
+          runKey: claim.runKey,
+          claimToken: claim.claimToken,
+          execution
+        });
+        options.onEvent?.("deployment-progress", { runKey: claim.runKey, execution });
+      }
     }).result;
     result = options.telemetry ? await options.telemetry.observe("deployment.run", run2) : await run2();
   } finally {
@@ -11632,7 +11485,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.151";
+var VERSION2 = "0.1.153";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {
@@ -12158,6 +12011,8 @@ var validateMetalClaim = (claim) => {
   });
 };
 async function executeMetalAdmission(claim, options) {
+  const progress = async (stage2) => options.onMetalAdmissionProgress?.(stage2);
+  await progress("validating-target");
   validateMetalClaim(claim);
   const api = new URL(options.platformApiUrl);
   if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash) {
@@ -12187,19 +12042,23 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
         env: { ...command.env, DISPLAY: "forgezero:0", SSH_ASKPASS: askpass, SSH_ASKPASS_REQUIRE: "force", FZ_SSH_PASSWORD: password }
       });
     }
+    await progress("resolving-host");
     const sourceHost = claim.target.host.includes(":") ? `[${claim.target.host}]` : claim.target.host;
     const resolved = await resolvePinnedGitTarget(`ssh://${claim.target.user}@${sourceHost}:${claim.target.port}/`, options.resolveHost);
     if (!resolved || resolved.protocol !== "ssh")
       throw new SshBootstrapError("TARGET_ADDRESS_REFUSED");
     pinned = resolved;
+    await progress("verifying-host-key");
     const observedHost = await pinnedKnownHost(claim, pinned, directory, exec);
     claim.target.hostKeySha256 = observedHost.fingerprint;
     const knownHosts = observedHost.path;
     const ssh = sshOptions(claim, pinned, knownHosts, sshKeyPath);
     const destination = target(claim, pinned);
+    await progress("opening-ssh");
     remoteDirectory = await checked(exec, ["ssh", ...ssh, destination, "--", "mktemp", "-d", "/tmp/forgezero-metal-admission.XXXXXXXX"], "SSH_UNREACHABLE");
     if (!/^\/tmp\/forgezero-metal-admission\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
+    await progress("installing-managed-key");
     const passwd = await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/getent", "passwd", claim.target.user]);
     const home = passwd.split(":")[5] ?? "";
     if (!home.startsWith("/") || /[\r\n]/.test(home))
@@ -12214,6 +12073,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     writeFileSync5(authorizedPath, authorized, { mode: 384, flag: "wx" });
     await checked(exec, ["scp", ...scpOptions(claim, pinned, knownHosts, sshKeyPath), authorizedPath, `${destination}:${remoteDirectory}/authorized_keys`], "SSH_IDENTITY_INSTALL_FAILED");
     await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-m", "0600", `${remoteDirectory}/authorized_keys`, `${home}/.ssh/authorized_keys`]);
+    await progress("checking-host-policy");
     await remote(exec, ssh, destination, "METAL_STORAGE_UNAVAILABLE", ["/usr/bin/sudo", "-n", "/usr/sbin/vgs", "fzvg"]);
     await remote(exec, ssh, destination, "METAL_NETWORK_UNAVAILABLE", ["/usr/bin/sudo", "-n", "/usr/sbin/ip", "link", "show", "fzbr0"]);
     const topology = await remote(exec, ssh, destination, "METAL_CPU_TOPOLOGY_INVALID", [
@@ -12223,6 +12083,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
     const provisioning = deriveMetalAdmissionProvisioning(topology);
     const fzCliPath = options.fzCliPath ?? fileURLToPath(new URL("./fz.js", import.meta.url));
     const fzAgentPath = options.fzAgentPath ?? fileURLToPath(new URL("./fz-agent.js", import.meta.url));
+    await progress("copying-agent");
     for (const [source, name] of [[fzCliPath, "fz.js"], [fzAgentPath, "fz-agent.js"]]) {
       if (!readFileSync5(source).length)
         throw new SshBootstrapError("PACKAGE_ARTIFACT_MISSING");
@@ -12263,6 +12124,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
       configPath,
       `${destination}:${remoteDirectory}/metal.json`
     ], "SCP_FAILED");
+    await progress("installing-runtime");
     const bunVersion = await remote(exec, ssh, destination, "REMOTE_BUN_CHECK_FAILED", ["/usr/local/bin/bun", "--version"]).catch(() => "");
     if (bunVersion !== PINNED_BUN_VERSION) {
       await remote(exec, ssh, destination, "REMOTE_PREREQUISITES_FAILED", ["/usr/bin/sudo", "-n", "/usr/bin/apt-get", "update", "-qq"]);
@@ -12285,6 +12147,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
       await remote(exec, ssh, destination, "REMOTE_BUN_INSTALL_FAILED", ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0755", `${remoteDirectory}/bun-release/bun-linux-x64/bun`, "/usr/local/lib/forgezero/runtime/bun"]);
       await remote(exec, ssh, destination, "REMOTE_BUN_INSTALL_FAILED", ["/usr/bin/sudo", "-n", "/usr/bin/ln", "-sfn", "/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun"]);
     }
+    await progress("bootstrapping-agent");
     await remote(exec, ssh, destination, "REMOTE_METAL_BOOTSTRAP_FAILED", [
       "/usr/bin/sudo",
       "-n",
@@ -12296,6 +12159,7 @@ process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
       `${remoteDirectory}/metal.json`,
       "--apply"
     ], true);
+    await progress("verifying-proof");
     const proofRequest = {
       jobKey: claim.jobKey,
       tenantKey: claim.tenantKey,
@@ -12390,7 +12254,14 @@ async function pullMetalAdmissionOnce(options) {
   };
   renew();
   try {
-    const proof = await executeMetalAdmission(claim, options);
+    const proof = await executeMetalAdmission(claim, {
+      ...options,
+      onMetalAdmissionProgress: (stage2) => metalPost(options, "progress", {
+        jobKey: claim.jobKey,
+        claimToken: claim.claimToken,
+        stage: stage2
+      })
+    });
     stopped = true;
     clearTimer(timer);
     await renewal;
@@ -20990,12 +20861,12 @@ if (import.meta.main) {
   const bootstrapEnabled = process.env.FZ_BOOTSTRAP_PULL === "true";
   const bootstrapCredential = process.env.FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL;
   const bootstrapKeyPath = bootstrapCredential && process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/${bootstrapCredential}` : undefined;
-  if (bootstrapEnabled && (!binding || !nodeApiUrl || !process.env.FZ_API || !bootstrapKeyPath || !existsSync23(bootstrapKeyPath) || !process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT)) {
-    throw new Error("agent: bootstrap runner requires enrolment, API, local SSH credential and target OTLP coordinate");
+  if (bootstrapEnabled && (!binding || !nodeApiUrl || !process.env.FZ_PUBLIC_API_URL || !bootstrapKeyPath || !existsSync23(bootstrapKeyPath) || !process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT)) {
+    throw new Error("agent: bootstrap runner requires enrolment, public API, local SSH credential and target OTLP coordinate");
   }
   const bootstrapPull = bootstrapEnabled ? startSshBootstrapPull({
     apiUrl: nodeApiUrl,
-    platformApiUrl: process.env.FZ_API,
+    platformApiUrl: process.env.FZ_PUBLIC_API_URL,
     nodeKey,
     keys,
     sshKeyPath: bootstrapKeyPath,
@@ -21007,7 +20878,7 @@ if (import.meta.main) {
     console.log("[agent] PQ-authenticated delegated SSH bootstrap claims enabled");
   const metalAdmissionPull = bootstrapEnabled ? startMetalAdmissionPull({
     apiUrl: nodeApiUrl,
-    platformApiUrl: process.env.FZ_API,
+    platformApiUrl: process.env.FZ_PUBLIC_API_URL,
     nodeKey,
     keys,
     sshKeyPath: bootstrapKeyPath,