@forgezero/agent 0.1.34 → 0.1.36

package/dist/bootstrap.js

@@ -0,0 +1,3416 @@
+// @bun
+// src/cloudflare-edge.ts
+import { isIP } from "net";
+function isPrivateDatabaseAddress(value) {
+  const address = value.trim().toLowerCase();
+  const family = isIP(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    return Number.isFinite(first) && (first & 65024) === 64512;
+  }
+  return false;
+}
+function privateDatabaseHostRoute(value) {
+  const address = value.trim().toLowerCase();
+  if (!isPrivateDatabaseAddress(address)) {
+    throw new Error("database address must be an RFC 1918 IPv4 or unique-local IPv6 address");
+  }
+  return `${address}/${isIP(address) === 4 ? 32 : 128}`;
+}
+var endpoint = "https://api.cloudflare.com/client/v4";
+async function cf(config, path, init = {}, fetcher = fetch) {
+  const response = await fetcher(`${endpoint}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${config.apiToken}`,
+      "content-type": "application/json",
+      ...init.headers
+    }
+  });
+  const body = await response.json();
+  if (!response.ok || body.success !== true) {
+    throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
+  }
+  return body.result;
+}
+async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (current) {
+    if (current.tunnel_id !== config.tunnelId) {
+      throw new Error(`private route ${config.network} already belongs to another Tunnel`);
+    }
+    return { route: current, created: false };
+  }
+  const route = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({
+      network: config.network,
+      tunnel_id: config.tunnelId,
+      comment: config.comment.slice(0, 100),
+      ...config.virtualNetworkId ? { virtual_network_id: config.virtualNetworkId } : {}
+    })
+  }, fetcher);
+  return { route, created: true };
+}
+async function ensureCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return ensureCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function removeCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route) => !route.deleted_at && route.network === config.network && (route.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (!current)
+    return { removed: false };
+  if (current.tunnel_id !== config.tunnelId) {
+    throw new Error(`private route ${config.network} belongs to another Tunnel`);
+  }
+  await cf(config, `${path}/${encodeURIComponent(current.id)}`, { method: "DELETE" }, fetcher);
+  return { removed: true, route: current };
+}
+async function removeCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return removeCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function ensureCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  if (entries.some((entry) => entry.address === route))
+    return { entries, created: false };
+  const next = [...entries, { address: route, description: config.description.slice(0, 100) }];
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, created: true };
+}
+async function removeCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  const next = entries.filter((entry) => entry.address !== route);
+  if (next.length === entries.length)
+    return { entries, removed: false };
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, removed: true };
+}
+async function configureCloudflareEdge(config, fetcher = fetch) {
+  const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
+  const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
+  const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
+  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  await cf(tunnelAuth, tunnelPath, {
+    method: "PUT",
+    body: JSON.stringify({ config: { ingress: [
+      { hostname: config.hostname, service: config.service },
+      ...otherHosts,
+      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+    ] } })
+  }, fetcher);
+  const dnsPath = `/zones/${config.zoneId}/dns_records`;
+  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  if (records.length > 1) {
+    throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
+  }
+  const record = {
+    type: "CNAME",
+    name: config.hostname,
+    content: `${config.tunnelId}.cfargotunnel.com`,
+    proxied: true,
+    ttl: 1
+  };
+  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
+    method: records[0] ? "PUT" : "POST",
+    body: JSON.stringify(record)
+  }, fetcher);
+}
+var exactAccountPermissionGroup = async (config, name, fetcher) => {
+  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
+  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
+  if (matches.length !== 1) {
+    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
+  }
+  return { id: matches[0].id, name };
+};
+async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
+    throw new Error("Cloudflare account id is invalid");
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
+    throw new Error("Cloudflare account runtime-token name is invalid");
+  }
+  const permissionNames = [...new Set(config.permissionNames)];
+  if (permissionNames.length === 0)
+    throw new Error("Cloudflare account runtime token needs a permission group");
+  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
+  const body = {
+    name,
+    policies: [{
+      effect: "allow",
+      permission_groups: permissionGroups.map(({ id }) => ({ id })),
+      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
+    }]
+  };
+  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
+  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
+    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
+  }
+  return { id: created.id, value: created.value, name, permissionNames };
+}
+async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Access service-token name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/service_tokens`;
+  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = tokens.filter((token) => token.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
+  if (matches[0]) {
+    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
+      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
+    }
+    return { credentials: config.existing, created: false };
+  }
+  const created = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
+  }, fetcher);
+  if (!created.id || !created.client_id || !created.client_secret) {
+    throw new Error("Cloudflare did not return the new Access service-token secret");
+  }
+  return {
+    credentials: {
+      tokenId: created.id,
+      clientId: created.client_id,
+      clientSecret: created.client_secret
+    },
+    created: true
+  };
+}
+async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/policies`;
+  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === config.name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
+  const desired = {
+    name: config.name,
+    decision: "non_identity",
+    include: [{ service_token: { token_id: config.serviceTokenId } }]
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
+    method: matches[0] ? "PUT" : "POST",
+    body: JSON.stringify(desired)
+  }, fetcher);
+  return { policy, created: !matches[0] };
+}
+async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
+  const desired = {
+    name: config.name,
+    type: "self_hosted",
+    domain: config.hostname,
+    session_duration: "24h",
+    service_auth_401_redirect: true,
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare WARP enrollment application name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
+  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
+    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
+  }
+  const desired = {
+    name,
+    type: "warp",
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!application.id || application.type && application.type !== "warp") {
+    throw new Error("Cloudflare did not return the WARP enrollment application");
+  }
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare VNET name is invalid");
+  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
+  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
+  if (matches[0])
+    return { virtualNetwork: matches[0], created: false };
+  const virtualNetwork = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
+  }, fetcher);
+  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
+    throw new Error("Cloudflare did not return the VNET id");
+  }
+  return { virtualNetwork, created: true };
+}
+async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare WARP device profile name is invalid");
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
+    throw new Error("Cloudflare service-token id is invalid");
+  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
+    throw new Error("Cloudflare VNET id is invalid");
+  const precedence = config.precedence ?? 100;
+  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
+    throw new Error("Cloudflare WARP device profile precedence is invalid");
+  }
+  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
+  const listPath = `/accounts/${config.accountId}/devices/policies`;
+  const path = `/accounts/${config.accountId}/devices/policy`;
+  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
+  if (matches[0]?.match && matches[0].match !== match) {
+    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
+  }
+  const desired = {
+    name,
+    match,
+    precedence,
+    description: "ForgeZero non-interactive compute enrollment",
+    enabled: true,
+    allow_mode_switch: false,
+    allowed_to_leave: false,
+    auto_connect: 0,
+    switch_locked: true,
+    service_mode_v2: { mode: "warp" },
+    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!policy.id)
+    throw new Error("Cloudflare did not return the WARP device profile id");
+  return { policy, created: !matches[0] };
+}
+async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
+    throw new Error("Cloudflare Worker script name is invalid");
+  }
+  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      secrets: {
+        CF_ACCESS_CLIENT_ID: {
+          name: "CF_ACCESS_CLIENT_ID",
+          type: "secret_text",
+          text: config.credentials.clientId
+        },
+        CF_ACCESS_CLIENT_SECRET: {
+          name: "CF_ACCESS_CLIENT_SECRET",
+          type: "secret_text",
+          text: config.credentials.clientSecret
+        }
+      }
+    })
+  }, fetcher);
+}
+async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
+  const title = config.title.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
+  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = namespaces.filter((namespace2) => namespace2.title === title);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
+  if (matches[0])
+    return { namespace: matches[0], created: false };
+  const namespace = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ title })
+  }, fetcher);
+  return { namespace, created: true };
+}
+async function ensureCloudflareTunnel(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Tunnel name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/cfd_tunnel`;
+  const tunnels = await cf(config, `${path}?is_deleted=false&name=${encodeURIComponent(name)}&per_page=1000`, {}, fetcher);
+  const matches = tunnels.filter((tunnel2) => tunnel2.name === name && !tunnel2.deleted_at);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Tunnel ${name} is ambiguous`);
+  const created = !matches[0];
+  const tunnel = matches[0] ?? await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, config_src: "cloudflare" })
+  }, fetcher);
+  const connectorToken = await cf(config, `${path}/${encodeURIComponent(tunnel.id)}/token`, {}, fetcher);
+  if (!connectorToken || connectorToken.length > 16384) {
+    throw new Error("Cloudflare returned an invalid Tunnel connector token");
+  }
+  return { tunnel, connectorToken, created };
+}
+
+// src/cloudflare-bootstrap.ts
+import { constants } from "fs";
+import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
+import { dirname, join, resolve } from "path";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
+import { isIP as isIP2 } from "net";
+var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
+async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
+  const metadata = await handle.stat();
+  if (!metadata.isFile())
+    throw new Error(`${path} must be a regular file`);
+  if (metadata.nlink !== 1)
+    throw new Error(`${path} must not have multiple hard links`);
+  const uid = ownerUid();
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+    throw new Error(`${path} must be owned by the current operator`);
+  if ((metadata.mode & 63) !== 0)
+    throw new Error(`${path} must not be accessible by group or other users`);
+  if ((metadata.mode & 256) === 0)
+    throw new Error(`${path} must be readable by its owner`);
+  if (metadata.size < 1 || metadata.size > maximumBytes)
+    throw new Error(`${path} has an invalid size`);
+}
+async function readOwnerOnlyFile(path, maximumBytes) {
+  const absolute = resolve(path);
+  let handle;
+  try {
+    handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+    await assertOwnerOnlyHandle(absolute, handle, maximumBytes);
+    return await handle.readFile({ encoding: "utf8" });
+  } catch (cause) {
+    if (cause instanceof Error && cause.message.startsWith(absolute))
+      throw cause;
+    throw new Error(`cannot securely read owner-only file ${absolute}`);
+  } finally {
+    await handle?.close();
+  }
+}
+async function readOwnerApiToken(path) {
+  const token = (await readOwnerOnlyFile(path, 4096)).trim();
+  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+    throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
+  }
+  return token;
+}
+async function readCloudflareBootstrapTokens(files) {
+  const entries = await Promise.all([
+    ["apiToken", files.apiTokenFile],
+    ["tunnelApiToken", files.tunnelApiTokenFile],
+    ["dnsApiToken", files.dnsApiTokenFile],
+    ["kvApiToken", files.kvApiTokenFile],
+    ["accessApiToken", files.accessApiTokenFile],
+    ["workerApiToken", files.workerApiTokenFile]
+  ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
+  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const unified = tokens.apiToken;
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
+    if (!tokens[key] && !unified)
+      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  }
+  return tokens;
+}
+var validateId = (value, label) => {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[a-f0-9]{32}$/.test(normalized))
+    throw new Error(`${label} must be a 32-character hexadecimal id`);
+  return normalized;
+};
+var validateName = (value, label, maximum, allowSpaces = true) => {
+  const normalized = value.trim();
+  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+    throw new Error(`${label} is invalid`);
+  }
+  return normalized;
+};
+var privateAddress = (value) => {
+  const address = value.trim().toLowerCase();
+  const family = isIP2(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
+      return address;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    if (Number.isFinite(first) && (first & 65024) === 64512)
+      return address;
+  }
+  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+};
+function validateCloudflareBootstrapCoordinates(input) {
+  const nodeInputs = input.nodes?.length ? input.nodes : [{
+    nodeName: input.tunnelName,
+    hostname: input.hostname,
+    service: input.service,
+    tunnelName: input.tunnelName,
+    applicationName: input.applicationName
+  }];
+  if (nodeInputs.length < 1 || nodeInputs.length > 32) {
+    throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
+  }
+  const nodes = nodeInputs.map((node) => {
+    const nodeName = node.nodeName.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
+      throw new Error("Cloudflare node name is invalid");
+    const hostname = node.hostname.trim().toLowerCase();
+    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+      throw new Error("Cloudflare public node hostname is invalid");
+    }
+    const serviceUrl = new URL(node.service);
+    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
+      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
+    }
+    return {
+      nodeName,
+      hostname,
+      service: serviceUrl.toString().replace(/\/$/, ""),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
+      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
+      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+    };
+  });
+  for (const [label, values] of [
+    ["node name", nodes.map(({ nodeName }) => nodeName)],
+    ["hostname", nodes.map(({ hostname }) => hostname)],
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
+    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+  ]) {
+    if (new Set(values).size !== values.length)
+      throw new Error(`Cloudflare fleet ${label} must be unique`);
+  }
+  const first = nodes[0];
+  const workerScriptName = input.workerScriptName.trim();
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
+    throw new Error("Cloudflare Worker script name is invalid");
+  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
+  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
+    throw new Error("Cloudflare Worker compatibility date is invalid");
+  }
+  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
+  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
+    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
+  }
+  const workerDirectory = resolve(input.workerDirectory);
+  const workerMain = input.workerMain.trim();
+  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
+    throw new Error("Cloudflare Worker main must be a project-relative path");
+  }
+  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
+    throw new Error("Cloudflare runtime-token name prefix is invalid");
+  }
+  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
+    throw new Error("private-network runtime token requires runtime-token creation");
+  }
+  const privateNetwork = input.privateNetwork ? {
+    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
+    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
+    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
+    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
+    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
+  } : undefined;
+  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
+    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
+  }
+  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
+    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
+  }
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    hostname: first.hostname,
+    service: first.service,
+    tunnelName: first.tunnelName,
+    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
+    workerScriptName,
+    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
+    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
+    applicationName: first.applicationName,
+    workerDirectory,
+    workerMain,
+    workerCompatibilityDate,
+    publicDomains,
+    createRuntimeTokens: input.createRuntimeTokens,
+    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
+    runtimeTokenNamePrefix,
+    nodes,
+    ...privateNetwork ? { privateNetwork } : {}
+  };
+}
+function planCloudflareBootstrap(input, outputPath) {
+  const coordinates = validateCloudflareBootstrapCoordinates(input);
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-plan",
+    mode: "attended-token-file",
+    outputFile: resolve(outputPath),
+    coordinates,
+    operations: [
+      "create or reuse one Workers KV namespace",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      ...coordinates.createRuntimeTokens ? [
+        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
+      ] : [],
+      "deploy the shared Worker once with the created NODES binding and stable custom domains",
+      "create or reuse one shared Access service token/policy and one self-hosted application per node",
+      ...coordinates.privateNetwork ? [
+        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
+      ] : [],
+      "write the Access client id and secret to the existing Worker as encrypted secrets",
+      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+    ],
+    secrets: [
+      "API tokens are read only from owner-only files and are never written to output",
+      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
+      "the normal API process does not receive or import the management token files"
+    ]
+  };
+}
+var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
+  const child = Bun.spawn([...command], {
+    cwd,
+    env: { ...env },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text()
+  ]);
+  return { exitCode, stdout, stderr };
+};
+var inheritedWorkerEnvironment = () => {
+  const allowed = [
+    "PATH",
+    "HOME",
+    "TMPDIR",
+    "XDG_CONFIG_HOME",
+    "XDG_CACHE_HOME",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NODE_EXTRA_CA_CERTS",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NO_PROXY"
+  ];
+  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+};
+var redact = (text, secrets) => {
+  let safe = text.slice(0, 4096);
+  for (const secret of secrets)
+    if (secret)
+      safe = safe.split(secret).join("[REDACTED]");
+  return safe.trim();
+};
+async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
+  const validated = validateCloudflareBootstrapCoordinates(coordinates);
+  const workerDirectoryMetadata = await stat(validated.workerDirectory);
+  if (!workerDirectoryMetadata.isDirectory())
+    throw new Error("Cloudflare Worker directory is not a directory");
+  const workerMain = resolve(validated.workerDirectory, validated.workerMain);
+  const workerMainMetadata = await stat(workerMain);
+  if (!workerMainMetadata.isFile())
+    throw new Error("Cloudflare Worker main is not a regular file");
+  const wrangler = resolve(validated.workerDirectory, "node_modules/.bin/wrangler");
+  const wranglerMetadata = await stat(wrangler);
+  if (!wranglerMetadata.isFile())
+    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
+  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
+    throw new Error("Cloudflare KV namespace id is invalid");
+  const temporaryDirectory = await mkdtemp(join(tmpdir(), "fz-wrangler-"));
+  await chmod(temporaryDirectory, 448);
+  const configurationPath = join(temporaryDirectory, "wrangler.json");
+  try {
+    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({
+        name: validated.workerScriptName,
+        main: workerMain,
+        compatibility_date: validated.workerCompatibilityDate,
+        workers_dev: false,
+        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
+        observability: { enabled: true },
+        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
+      }, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const result = await runner({
+      command: [wrangler, "deploy", "--config", configurationPath],
+      cwd: validated.workerDirectory,
+      env: {
+        ...inheritedWorkerEnvironment(),
+        XDG_CONFIG_HOME: temporaryDirectory,
+        XDG_CACHE_HOME: temporaryDirectory,
+        WRANGLER_LOG_PATH: join(temporaryDirectory, "wrangler.log"),
+        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
+        CLOUDFLARE_API_TOKEN: apiToken,
+        WRANGLER_SEND_METRICS: "false"
+      }
+    });
+    if (result.exitCode !== 0) {
+      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
+      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
+    }
+  } finally {
+    await rm(temporaryDirectory, { recursive: true, force: true });
+  }
+}
+async function readExistingOutput(path) {
+  try {
+    await lstat(path);
+  } catch (cause) {
+    if (cause.code === "ENOENT")
+      return;
+    throw cause;
+  }
+  const text = await readOwnerOnlyFile(path, 1048576);
+  let output;
+  try {
+    output = JSON.parse(text);
+  } catch {
+    throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+  }
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
+    throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
+  }
+  return output;
+}
+async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
+  const output = await readExistingOutput(resolve(checkpointPath));
+  if (!output || output.phase !== "complete") {
+    throw new Error("Cloudflare connector handoff requires a completed bootstrap checkpoint");
+  }
+  const normalizedNodeName = nodeName.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalizedNodeName)) {
+    throw new Error("Cloudflare connector handoff node name is invalid");
+  }
+  const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
+  const expected = coordinates.nodes.find((node) => node.nodeName === normalizedNodeName);
+  const matches = output.resources.nodes?.filter((node) => node.nodeName === normalizedNodeName) ?? [];
+  if (!expected || matches.length !== 1) {
+    throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
+  }
+  const resource = matches[0];
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !resource.applicationId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(resource.tunnelId) || !/^[A-Za-z0-9._-]{40,16384}$/.test(resource.connectorToken)) {
+    throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
+  }
+  return {
+    nodeName: resource.nodeName,
+    hostname: resource.hostname,
+    service: resource.service,
+    tunnelId: resource.tunnelId,
+    connectorToken: resource.connectorToken
+  };
+}
+async function readCloudflareHostHandoff(checkpointPath, nodeName) {
+  const connector = await readCloudflareConnectorHandoff(checkpointPath, nodeName);
+  const output = await readExistingOutput(resolve(checkpointPath));
+  const kv = output?.resources.runtimeTokens?.kv;
+  if (!output || output.phase !== "complete" || !/^[a-f0-9]{32}$/i.test(output.coordinates.accountId) || !/^[a-f0-9]{32}$/i.test(output.coordinates.zoneId) || !/^[a-f0-9]{32}$/i.test(output.resources.kvNamespaceId) || !kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv.value)) {
+    throw new Error("Cloudflare host handoff is missing the exact-account KV runtime capability");
+  }
+  const network = output.resources.runtimeTokens?.privateNetwork?.value;
+  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+    throw new Error("Cloudflare host handoff private-network capability is malformed");
+  }
+  const privateNetwork = output.resources.privateNetwork;
+  const access = output.resources.access;
+  if (Boolean(privateNetwork) !== Boolean(network)) {
+    throw new Error("Cloudflare host handoff private-network resources and capability disagree");
+  }
+  if (privateNetwork && (!access?.clientId || !access.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(privateNetwork.warpOrganization) || !/^[0-9a-f-]{36}$/i.test(privateNetwork.virtualNetworkId) || !privateNetwork.deviceProfileId)) {
+    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
+  }
+  return {
+    ...connector,
+    accountId: output.coordinates.accountId,
+    zoneId: output.coordinates.zoneId,
+    kvNamespaceId: output.resources.kvNamespaceId,
+    kvRuntimeToken: kv.value,
+    ...network ? { privateNetworkRuntimeToken: network } : {},
+    ...privateNetwork && access ? { warp: {
+      organization: privateNetwork.warpOrganization,
+      clientId: access.clientId,
+      clientSecret: access.clientSecret,
+      virtualNetworkId: privateNetwork.virtualNetworkId,
+      deviceProfileId: privateNetwork.deviceProfileId
+    } } : {}
+  };
+}
+async function prepareOwnerOutputDirectory(absolutePath) {
+  const directory = dirname(absolutePath);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const directoryMetadata = await stat(directory);
+  const uid = ownerUid();
+  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+    throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
+  }
+  return directory;
+}
+async function writeOwnerBootstrapOutput(path, output) {
+  const absolute = resolve(path);
+  const directory = await prepareOwnerOutputDirectory(absolute);
+  const temporary = `${absolute}.${randomUUID()}.tmp`;
+  let handle;
+  try {
+    handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    await handle.writeFile(`${JSON.stringify(output, null, 2)}
+`, { encoding: "utf8" });
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await rename(temporary, absolute);
+    await chmod(absolute, 384);
+    const directoryHandle = await open(directory, constants.O_RDONLY);
+    try {
+      await directoryHandle.sync();
+    } finally {
+      await directoryHandle.close();
+    }
+  } finally {
+    await handle?.close();
+    await unlink(temporary).catch((cause) => {
+      if (cause.code !== "ENOENT")
+        throw cause;
+    });
+  }
+}
+var tokenFor = (tokens, key) => {
+  const token = tokens[key]?.trim() || tokens.apiToken?.trim();
+  if (!token)
+    throw new Error(`Cloudflare ${key} is not configured`);
+  return token;
+};
+var initialManagementToken = (tokens) => {
+  const token = tokens.apiToken?.trim();
+  if (!token) {
+    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
+  }
+  return token;
+};
+var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+  const coordinates = validateCloudflareBootstrapCoordinates(input);
+  const absoluteOutput = resolve(outputPath);
+  const existing = await readExistingOutput(absoluteOutput);
+  if (existing && !sameCoordinates(existing.coordinates, coordinates)) {
+    throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
+  }
+  await prepareOwnerOutputDirectory(absoluteOutput);
+  const namespace = await ensureCloudflareKvNamespace({
+    accountId: coordinates.accountId,
+    title: coordinates.kvNamespaceTitle,
+    apiToken: tokenFor(tokens, "kvApiToken")
+  }, fetcher);
+  const nodeResources = [];
+  const createdNodes = [];
+  let resources;
+  for (const node of coordinates.nodes) {
+    const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let created = false;
+    if (checkpointed) {
+      nodeResources.push(checkpointed);
+    } else {
+      const tunnel = await ensureCloudflareTunnel({
+        accountId: coordinates.accountId,
+        name: node.tunnelName,
+        apiToken: tokenFor(tokens, "tunnelApiToken")
+      }, fetcher);
+      created = tunnel.created;
+      nodeResources.push({
+        nodeName: node.nodeName,
+        hostname: node.hostname,
+        service: node.service,
+        tunnelName: node.tunnelName,
+        tunnelId: tunnel.tunnel.id,
+        connectorToken: tunnel.connectorToken
+      });
+    }
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
+    const firstNode = nodeResources[0];
+    resources = {
+      tunnelId: firstNode.tunnelId,
+      kvNamespaceId: namespace.namespace.id,
+      hostname: firstNode.hostname,
+      service: firstNode.service,
+      connectorToken: firstNode.connectorToken,
+      nodes: [...nodeResources],
+      ...existing?.resources.access ? { access: existing.resources.access } : {},
+      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
+      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
+      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (!resources)
+    throw new Error("Cloudflare fleet has no nodes");
+  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
+    resources = {
+      ...resources,
+      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
+        accountId: coordinates.accountId,
+        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
+        permissionNames: ["Workers KV Storage Write"],
+        apiToken: initialManagementToken(tokens)
+      }, fetcher) }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "runtime-tokens-created",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
+    resources = {
+      ...resources,
+      runtimeTokens: {
+        ...resources.runtimeTokens,
+        privateNetwork: await createCloudflareAccountRuntimeToken({
+          accountId: coordinates.accountId,
+          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
+          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
+          apiToken: initialManagementToken(tokens)
+        }, fetcher)
+      }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "runtime-tokens-created",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (!resources.worker) {
+    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
+    resources = {
+      ...resources,
+      worker: {
+        scriptName: coordinates.workerScriptName,
+        publicDomains: coordinates.publicDomains,
+        deployed: true
+      }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "worker-deployed",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  const serviceToken = await ensureCloudflareAccessServiceToken({
+    accountId: coordinates.accountId,
+    name: coordinates.serviceTokenName,
+    apiToken: tokenFor(tokens, "accessApiToken"),
+    existing: resources.access
+  }, fetcher);
+  resources = { ...resources, access: serviceToken.credentials };
+  await writeOwnerBootstrapOutput(absoluteOutput, {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "access-token-provisioned",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources
+  });
+  const policy = await ensureCloudflareAccessPolicy({
+    accountId: coordinates.accountId,
+    name: coordinates.policyName,
+    serviceTokenId: serviceToken.credentials.tokenId,
+    apiToken: tokenFor(tokens, "accessApiToken")
+  }, fetcher);
+  if (!policy.policy.id)
+    throw new Error("Cloudflare did not return the Access policy id");
+  resources = {
+    ...resources,
+    access: { ...serviceToken.credentials, policyId: policy.policy.id }
+  };
+  await writeOwnerBootstrapOutput(absoluteOutput, {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "access-token-provisioned",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources
+  });
+  let privateNetworkCreated = false;
+  if (coordinates.privateNetwork && !resources.privateNetwork) {
+    const managementToken = initialManagementToken(tokens);
+    const virtualNetwork = await ensureCloudflareVirtualNetwork({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.virtualNetworkName,
+      comment: "ForgeZero private database network",
+      apiToken: managementToken
+    }, fetcher);
+    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.enrollmentApplicationName,
+      policyId: policy.policy.id,
+      apiToken: tokenFor(tokens, "accessApiToken")
+    }, fetcher);
+    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.deviceProfileName,
+      serviceTokenId: serviceToken.credentials.tokenId,
+      virtualNetworkId: virtualNetwork.virtualNetwork.id,
+      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
+      apiToken: managementToken
+    }, fetcher);
+    const routes = [];
+    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
+      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
+      const route = await ensureCloudflarePrivateDatabaseRoute({
+        accountId: coordinates.accountId,
+        tunnelId: resource.tunnelId,
+        privateAddress: node.privateAddress,
+        virtualNetworkId: virtualNetwork.virtualNetwork.id,
+        comment: `ForgeZero ${node.nodeName} database`,
+        apiToken: managementToken
+      }, fetcher);
+      await ensureCloudflareWarpDatabaseInclude({
+        accountId: coordinates.accountId,
+        policyId: deviceProfile.policy.id,
+        privateAddress: node.privateAddress,
+        description: `ForgeZero ${node.nodeName} database`,
+        apiToken: managementToken
+      }, fetcher);
+      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
+    }
+    resources = {
+      ...resources,
+      privateNetwork: {
+        warpOrganization: coordinates.privateNetwork.warpOrganization,
+        virtualNetworkId: virtualNetwork.virtualNetwork.id,
+        deviceProfileId: deviceProfile.policy.id,
+        enrollmentApplicationId: enrollment.application.id,
+        routes
+      }
+    };
+    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "access-token-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  for (const node of coordinates.nodes) {
+    const application = await ensureCloudflareAccessApplication({
+      accountId: coordinates.accountId,
+      name: node.applicationName,
+      hostname: node.hostname,
+      policyId: policy.policy.id,
+      apiToken: tokenFor(tokens, "accessApiToken")
+    }, fetcher);
+    if (!application.application.id)
+      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
+    resources = {
+      ...resources,
+      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
+      access: {
+        ...resources.access,
+        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
+      }
+    };
+    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
+    createdNode.application = application.created;
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "access-token-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  await configureCloudflareWorkerAccessSecrets({
+    accountId: coordinates.accountId,
+    scriptName: coordinates.workerScriptName,
+    credentials: serviceToken.credentials,
+    apiToken: tokenFor(tokens, "workerApiToken")
+  }, fetcher);
+  for (const node of resources.nodes) {
+    await configureCloudflareEdge({
+      accountId: coordinates.accountId,
+      zoneId: coordinates.zoneId,
+      tunnelId: node.tunnelId,
+      hostname: node.hostname,
+      service: node.service,
+      apiToken: tokenFor(tokens, "tunnelApiToken"),
+      tunnelApiToken: tokenFor(tokens, "tunnelApiToken"),
+      dnsApiToken: tokenFor(tokens, "dnsApiToken")
+    }, fetcher);
+  }
+  const output = {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "complete",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources,
+    created: {
+      tunnel: createdNodes.some(({ tunnel }) => tunnel),
+      kvNamespace: namespace.created,
+      serviceToken: serviceToken.created,
+      policy: policy.created,
+      application: createdNodes.some(({ application }) => application),
+      privateNetwork: privateNetworkCreated,
+      workerDeployed: true,
+      nodes: createdNodes
+    }
+  };
+  await writeOwnerBootstrapOutput(absoluteOutput, output);
+  return output;
+}
+async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
+  const plan = planCloudflareBootstrap(request.coordinates, request.checkpointPath);
+  if (request.mode === "plan") {
+    return {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap-evidence",
+      phase: "planned",
+      checkpointFile: plan.outputFile,
+      workerScriptName: plan.coordinates.workerScriptName,
+      publicDomains: plan.coordinates.publicDomains,
+      nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
+    };
+  }
+  if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
+    throw new Error("Cloudflare apply requires owner-only management token file paths");
+  }
+  if (plan.coordinates.createRuntimeTokens && !request.tokenFiles.apiTokenFile) {
+    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
+  }
+  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-evidence",
+    phase: "complete",
+    checkpointFile: plan.outputFile,
+    kvNamespaceId: output.resources.kvNamespaceId,
+    workerScriptName: output.coordinates.workerScriptName,
+    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
+    runtimeTokenIds: {
+      kv: output.resources.runtimeTokens?.kv.id,
+      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
+    },
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+      nodeName,
+      hostname,
+      tunnelId,
+      applicationId
+    }))
+  };
+}
+
+// src/bootstrap.ts
+import { createHmac, randomBytes } from "crypto";
+import {
+  chmodSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname as dirname2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/agent-update-helper.ts
+import { DEFAULT_SOCKET } from "@forgezero/vault";
+
+// src/agent-update.ts
+var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
+var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
+
+// src/agent-update-helper.ts
+var AGENT_UPDATE_GROUP = "forgezero-update";
+var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
+var MAX_REQUEST_BYTES = 8 * 1024;
+var UPDATE_RETRY_BASE_MS = 5 * 60000;
+var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
+
+// src/version.ts
+var VERSION = "0.1.36";
+
+// src/software.ts
+var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
+var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
+var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var UBUNTU_2604_X64 = [
+  {
+    requirement: { id: "bun", version: "1.3.14" },
+    check: 'test "$(/usr/local/bin/bun --version 2>/dev/null)" = 1.3.14',
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL https://bun.sh/install -o "$tmp/install"; ` + `echo "${BUN_INSTALLER_SHA256}  $tmp/install" | sha256sum -c -; ` + `BUN_INSTALL="$tmp/bun" BUN_VERSION=1.3.14 bash "$tmp/install" >/dev/null; ` + `install -d -m 0755 /usr/local/lib/forgezero/runtime; ` + `install -m 0755 "$tmp/bun/bin/bun" /usr/local/lib/forgezero/runtime/bun.next; ` + `mv -Tf /usr/local/lib/forgezero/runtime/bun.next /usr/local/lib/forgezero/runtime/bun; ` + `ln -sfn /usr/local/lib/forgezero/runtime/bun /usr/local/bin/bun`
+  },
+  {
+    requirement: { id: "nginx", version: "ubuntu-26.04" },
+    check: "command -v nginx >/dev/null && systemctl is-active --quiet nginx",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y nginx && systemctl enable --now nginx"
+  },
+  {
+    requirement: { id: "arangodb", version: "3.11.14" },
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+  },
+  {
+    requirement: { id: "cloudflared", version: "2026.7.3" },
+    check: `cloudflared --version 2>/dev/null | grep -q '2026.7.3'`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://github.com/cloudflare/cloudflared/releases/download/2026.7.3/cloudflared-linux-amd64' -o "$tmp/cloudflared"; ` + `echo "${CLOUDFLARED_SHA256}  $tmp/cloudflared" | sha256sum -c -; ` + `install -m 0755 "$tmp/cloudflared" /usr/local/bin/cloudflared`
+  },
+  {
+    requirement: { id: "ufw", version: "ubuntu-26.04" },
+    check: "command -v ufw >/dev/null",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y ufw"
+  },
+  {
+    requirement: { id: "openssh-client", version: "ubuntu-26.04" },
+    check: "command -v ssh >/dev/null && command -v scp >/dev/null && command -v ssh-keyscan >/dev/null && command -v ssh-keygen >/dev/null",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y openssh-client"
+  }
+];
+
+// src/software-helper.ts
+var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
+var SOFTWARE_HELPER_GROUP = "forgezero-software";
+var SOFTWARE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-software-helper.service";
+var MAX_REQUEST_BYTES2 = 8 * 1024;
+
+// src/egress-policy.ts
+var AGENT_EGRESS_TABLE = "forgezero_agent_egress";
+var SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
+var BLOCKED_IPV4 = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "168.63.129.16/32",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.88.99.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4"
+];
+var BLOCKED_IPV6 = [
+  "::/128",
+  "::1/128",
+  "::ffff:0:0/96",
+  "64:ff9b::/96",
+  "64:ff9b:1::/48",
+  "100::/64",
+  "fc00::/7",
+  "fec0::/10",
+  "fe80::/10",
+  "ff00::/8",
+  "2001::/32",
+  "2001:2::/48",
+  "2001:10::/28",
+  "2001:20::/28",
+  "2001:db8::/32",
+  "2002::/16",
+  "3fff::/20"
+];
+var normalizeEgressTcpPorts = (ports) => {
+  for (const port of ports) {
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+      throw new Error("Agent egress policy refuses an invalid loopback TCP port.");
+    }
+  }
+  return [...new Set(ports)].sort((left, right) => left - right);
+};
+function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
+  const ports = normalizeEgressTcpPorts(loopbackTcpPorts);
+  return [
+    "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+    `IPAddressAllow=${SYSTEMD_RESOLVED_ADDRESS}/32`,
+    ...ports.length > 0 ? ["IPAddressAllow=127.0.0.1/32", "IPAddressAllow=::1/128"] : [],
+    ...BLOCKED_IPV4.map((network) => `IPAddressDeny=${network}`),
+    ...BLOCKED_IPV6.map((network) => `IPAddressDeny=${network}`)
+  ].join(`
+`);
+}
+
+// src/provision.ts
+import { isIP as isIP3 } from "net";
+function atLeast(version, floor) {
+  const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
+  const got = parse(version);
+  const want = parse(floor);
+  if (got.length === 0)
+    return false;
+  for (let index = 0;index < want.length; index += 1) {
+    const a = got[index] ?? 0;
+    const b = want[index] ?? 0;
+    if (a > b)
+      return true;
+    if (a < b)
+      return false;
+  }
+  return true;
+}
+var CAPABILITY_CHECKS = {
+  snpGuest: {
+    command: "test -e /dev/sev-guest && echo yes || echo no",
+    satisfied: (stdout) => stdout.trim() === "yes",
+    remedy: "Not a confidential guest. The agent will run in `enrolled` mode, which is still stronger than an API key in the application."
+  },
+  systemd: {
+    command: "test -d /run/systemd/system && echo yes || echo no",
+    satisfied: (stdout) => stdout.trim() === "yes",
+    remedy: "systemd is what supervises the agent. On a non-systemd host, run `fz-agent` under whatever supervises services there."
+  },
+  bun: {
+    command: "bun --version 2>/dev/null || echo missing",
+    satisfied: (stdout) => atLeast(stdout, "1.1.0"),
+    remedy: "Install bun: curl -fsSL https://bun.sh/install | bash"
+  },
+  python: {
+    command: "python3 --version 2>/dev/null || echo missing",
+    satisfied: (stdout, exitCode) => exitCode === 0 && /^Python 3\./.test(stdout.trim()),
+    remedy: "Install Python 3. It supplies the standard-library ioctl boundary for SNP reports."
+  }
+};
+var modeFor = (capabilities) => capabilities.snpGuest ? "attested" : "enrolled";
+var reasonFor = (mode) => mode === "attested" ? "SEV-SNP guest device present, so the agent can prove what it is running and the platform can refuse it if the measurement is wrong." : "No SEV-SNP guest device. The agent authenticates with its enrolment token and hybrid Ed25519 + ML-DSA signature \u2014 weaker than attestation, stronger than an API key in the application.";
+var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
+var DEPLOYMENT_GROUP = "forgezero-deploy";
+var VAULT_GROUP = "forgezero-vault";
+var LIFECYCLE_GROUP = "forgezero-lifecycle";
+var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
+var AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
+var AGENT_SOCKET_PROXY_UNIT_PATH = "/etc/systemd/system/forgezero-agent-proxy.service";
+var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
+var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
+var LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
+var LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
+var WARP_CONFIG_UNIT_PATH = "/etc/systemd/system/forgezero-warp-config.service";
+var WARP_SERVICE_DROP_IN_PATH = "/etc/systemd/system/warp-svc.service.d/forgezero.conf";
+var AGENT_EGRESS_UNIT_PATH = "/etc/systemd/system/forgezero-agent-egress.service";
+var DEFAULT_RUNNER_PUBLIC_TCP_PORTS = [443];
+function agentEgressUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  const user = options.user ?? "forgezero";
+  if (!/^[a-z_][a-z0-9_-]{0,30}$/.test(user))
+    throw new Error("invalid Agent service user");
+  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
+  if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
+    throw new Error("deployed project runner needs at least one vetted public TCP port");
+  }
+  if (deploymentEnabled)
+    systemdAgentEgressDirectives(runnerLoopbackPorts);
+  const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
+  const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
+  const policyProofs = deploymentEnabled ? [
+    ...runnerLoopbackPorts.length > 0 ? [`loopback=.*:${runnerLoopbackPorts.join(",")}`] : [],
+    `public-tcp=${runnerPublicTcpPorts.join(",")}`
+  ].map((pattern) => `ExecStartPost=/bin/sh -c '/usr/sbin/nft --numeric list table inet ${AGENT_EGRESS_TABLE} | /usr/bin/grep -q "${pattern}"'`).join(`
+`) : "";
+  return `[Unit]
+Description=ForgeZero Agent host egress policy
+Documentation=https://www.forgezero.net/docs/agent
+After=systemd-resolved.service nftables.service
+Requires=systemd-resolved.service
+Before=forgezero-agent-enrol.service forgezero-agent.service
+
+[Service]
+Type=notify
+NotifyAccess=all
+User=root
+Group=root
+ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
+${policyProofs}
+Restart=on-failure
+RestartSec=2
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+CapabilityBoundingSet=CAP_NET_ADMIN
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function softwareHelperUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  return `[Unit]
+Description=ForgeZero declarative software strategy helper
+Documentation=https://www.forgezero.net/docs/agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=${SOFTWARE_HELPER_GROUP}
+Environment=FZ_SOFTWARE_HELPER_SOCKET=${DEFAULT_SOFTWARE_HELPER_SOCKET}
+ExecStart=${bin} software-helper
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-software
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+PrivateTmp=true
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentUpdateHelperUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  return `[Unit]
+Description=ForgeZero verified Agent update helper
+Documentation=https://www.forgezero.net/docs/agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=${AGENT_UPDATE_GROUP}
+Environment=FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}
+ExecStart=${bin} update-helper
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-update
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+ReadWritePaths=${DEFAULT_AGENT_RELEASE_ROOT} /var/lib/forgezero
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentSocketUnit(options) {
+  const socket = systemdPath(options.socketPath, "agent socket");
+  return `[Unit]
+Description=ForgeZero application Vault socket
+Documentation=https://www.forgezero.net/docs/agent
+
+[Socket]
+ListenStream=${socket}
+SocketUser=root
+SocketGroup=${VAULT_GROUP}
+SocketMode=0660
+DirectoryMode=0750
+RemoveOnStop=true
+Service=forgezero-agent-proxy.service
+
+[Install]
+WantedBy=sockets.target
+`;
+}
+function agentSocketProxyUnit(options) {
+  const backend = agentBackendSocketPath(options.socketPath);
+  const user = options.user ?? "forgezero";
+  return `[Unit]
+Description=ForgeZero application Vault socket proxy
+Documentation=https://www.forgezero.net/docs/agent
+Requires=forgezero-agent.service
+After=forgezero-agent.service
+
+[Service]
+User=${user}
+Group=${VAULT_GROUP}
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd ${backend}
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX
+`;
+}
+function agentBackendSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
+var systemdPath = (value, label) => {
+  if (!value || !/^\/[A-Za-z0-9._@/-]+$/.test(value))
+    throw new Error(`invalid ${label} path`);
+  return value;
+};
+var awaitSocketCommand = (path) => {
+  const socket = systemdPath(path, "readiness socket");
+  return `for attempt in $(seq 1 100); do test -S ${socket} && exit 0; sleep 0.1; done; exit 1`;
+};
+var validNodeHostname = (value) => !value || value.length <= 253 && value === value.toLowerCase() && value.split(".").length >= 3 && value.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+function warpConfigUnit(options) {
+  if (!options.warpOrganization || !/^[a-z0-9][a-z0-9-]{0,62}$/i.test(options.warpOrganization)) {
+    throw new Error("WARP organization is invalid");
+  }
+  if (!options.warpClientIdCredentialPath || !options.warpClientSecretCredentialPath) {
+    throw new Error("WARP service-token credential paths are required");
+  }
+  const clientIdPath = systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential");
+  const clientSecretPath = systemdPath(options.warpClientSecretCredentialPath, "WARP client-secret credential");
+  const bin = options.binPath ?? "fz-agent";
+  return `[Unit]
+Description=Materialize Cloudflare One enrollment in tmpfs
+Documentation=https://www.forgezero.net/docs/agent
+Before=warp-svc.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+LoadCredentialEncrypted=warp-auth-client-id:${clientIdPath}
+LoadCredentialEncrypted=warp-auth-client-secret:${clientSecretPath}
+Environment=FZ_WARP_CLIENT_ID_CREDENTIAL=warp-auth-client-id
+Environment=FZ_WARP_CLIENT_SECRET_CREDENTIAL=warp-auth-client-secret
+ExecStart=${bin} warp-config --organization=${options.warpOrganization}
+RuntimeDirectory=forgezero-warp
+RuntimeDirectoryMode=0700
+RuntimeDirectoryPreserve=yes
+UMask=0077
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/cloudflare-warp
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function warpServiceDropIn() {
+  return `[Unit]
+Requires=forgezero-warp-config.service
+After=forgezero-warp-config.service
+`;
+}
+function lifecycleHelperUnit(options) {
+  if (!options.lifecycleProfilePath)
+    throw new Error("lifecycle helper needs a root-owned profile");
+  const bin = options.binPath ?? "fz-agent";
+  const profile = systemdPath(options.lifecycleProfilePath, "lifecycle profile");
+  const socket = systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket");
+  return `[Unit]
+Description=ForgeZero fixed-operation compute lifecycle helper
+Documentation=https://www.forgezero.net/docs/agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=${LIFECYCLE_GROUP}
+Environment=FZ_LIFECYCLE_HELPER_SOCKET=${socket}
+ExecStart=${bin} lifecycle-helper --profile=${profile}
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-lifecycle
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentEnrolmentUnit(options) {
+  if (!options.apiUrl || !options.enrolTokenCredentialPath || !options.enrolStatePath) {
+    throw new Error("direct enrolment needs API, credential and state paths");
+  }
+  if (!validNodeHostname(options.nodeHostname))
+    throw new Error("node hostname is invalid");
+  const bin = options.binPath ?? "fz-agent";
+  const user = options.user ?? "forgezero";
+  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
+  const label = options.nodeLabel ? `Environment=FZ_NODE_LABEL=${options.nodeLabel}
+` : "";
+  const hostname = options.nodeHostname ? `Environment=FZ_NODE_HOSTNAME=${options.nodeHostname}
+` : "";
+  const gitPublicKey = options.gitPublicKeyPath ? `Environment=FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}
+` : "";
+  const networkAttachment = [
+    options.cloudflareAccountId ? `Environment=FZ_CF_ACCOUNT_ID=${options.cloudflareAccountId}
+` : "",
+    options.cloudflareTunnelId ? `Environment=FZ_CF_TUNNEL_ID=${options.cloudflareTunnelId}
+` : "",
+    options.cloudflareVirtualNetworkId ? `Environment=FZ_CF_VIRTUAL_NETWORK_ID=${options.cloudflareVirtualNetworkId}
+` : "",
+    options.cloudflareWarpPolicyId ? `Environment=FZ_CF_WARP_POLICY_ID=${options.cloudflareWarpPolicyId}
+` : ""
+  ].join("");
+  const stateDir = options.enrolStatePath.replace(/\/[^/]+$/, "");
+  const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
+Requires=forgezero-agent-egress.service
+BindsTo=forgezero-agent-egress.service
+` : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  return `[Unit]
+Description=Bind this machine to its ForgeZero compute
+After=network-online.target
+Wants=network-online.target
+${egressDependency}Before=forgezero-agent.service
+ConditionPathExists=!${options.enrolStatePath}
+
+[Service]
+Type=oneshot
+User=${user}
+Group=${user}
+LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
+LoadCredentialEncrypted=enrol-token:${options.enrolTokenCredentialPath}
+Environment=FZ_SEED_CREDENTIAL=agent-seed
+Environment=FZ_ENROL_TOKEN_CREDENTIAL=enrol-token
+Environment=FZ_ENROL_STATE_FILE=${options.enrolStatePath}
+Environment=FZ_API=${options.apiUrl}
+${label}${hostname}${gitPublicKey}${networkAttachment}ExecStart=${bin} enrol
+# A '+' fixed command runs as root solely to remove the host-bound one-time
+# ciphertext. Tenant code and the agent never receive a privilege boundary.
+ExecStartPost=+/usr/bin/rm -f ${options.enrolTokenCredentialPath}
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=${stateDir}
+LimitCORE=0
+${egressDirectives}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function deploymentRunnerUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
+  const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
+Requires=forgezero-agent-egress.service
+BindsTo=forgezero-agent-egress.service
+` : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.runnerLoopbackPorts ?? []) : "";
+  return `[Unit]
+Description=ForgeZero credential-free project command runner
+Documentation=https://www.forgezero.net/docs/agent
+${egressDependency}
+
+[Service]
+Type=notify
+NotifyAccess=all
+User=${DEPLOYMENT_RUNNER_USER}
+Group=${DEPLOYMENT_GROUP}
+Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:${VAULT_GROUP} /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
+Restart=always
+RestartSec=2
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=false
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+${egressDirectives}
+ReadWritePaths=${root}/releases ${root}/runner-home
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentUnit(options) {
+  if (!validNodeHostname(options.nodeHostname))
+    throw new Error("node hostname is invalid");
+  if (!options.telemetryEndpoint) {
+    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+  }
+  let telemetryEndpoint;
+  {
+    let endpoint2;
+    try {
+      endpoint2 = new URL(options.telemetryEndpoint);
+    } catch {
+      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+    }
+    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
+      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
+    telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
+  }
+  const bin = options.binPath ?? "fz-agent";
+  const user = options.user ?? "forgezero";
+  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
+  const controlSocketPath = options.controlSocketPath ?? "/run/forgezero/control.sock";
+  const deployRoot = options.deployRoot ?? "/opt/forgezero";
+  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
+  if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
+    throw new Error("migration pull and lifecycle profile must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([options.pullBootstrap, options.bootstrapSshCredentialPath, options.bootstrapTargetTelemetryEndpoint].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential and target telemetry endpoint must be supplied together");
+  }
+  const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
+  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const warpValues = [
+    options.warpOrganization,
+    options.warpClientIdCredentialPath,
+    options.warpClientSecretCredentialPath
+  ];
+  const warpEnabled = warpValues.every(Boolean);
+  if (warpValues.some(Boolean) && !warpEnabled)
+    throw new Error("WARP configuration must be supplied together");
+  const networkAttachmentValues = [
+    options.cloudflareAccountId,
+    options.cloudflareTunnelId,
+    options.cloudflareVirtualNetworkId,
+    options.cloudflareWarpPolicyId
+  ];
+  if (networkAttachmentValues.some(Boolean)) {
+    if (!options.cloudflareAccountId || !options.cloudflareTunnelId || !options.cloudflareWarpPolicyId) {
+      throw new Error("private-network attachment requires account, Tunnel and WARP policy ids");
+    }
+    const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    if (!/^[a-f0-9]{32}$/i.test(options.cloudflareAccountId) || !uuid.test(options.cloudflareTunnelId) || options.cloudflareVirtualNetworkId && !uuid.test(options.cloudflareVirtualNetworkId) || !/^[A-Za-z0-9-]{1,64}$/.test(options.cloudflareWarpPolicyId)) {
+      throw new Error("private-network attachment coordinates are invalid");
+    }
+  }
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  const deploymentEnvironment = options.deploymentEnvironment ?? {};
+  const deploymentCredentials = options.deploymentCredentials ?? {};
+  for (const [name, value] of Object.entries(deploymentEnvironment)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !/^[A-Za-z0-9._:\/@+-]+$/.test(value)) {
+      throw new Error(`invalid deployment environment entry: ${name}`);
+    }
+  }
+  for (const [name, path] of Object.entries(deploymentCredentials)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !path.startsWith("/") || /[\r\n:]/.test(path)) {
+      throw new Error(`invalid deployment credential entry: ${name}`);
+    }
+  }
+  const environment = [
+    "NODE_ENV=production",
+    `FZ_SOCKET_PATH=${agentBackendSocketPath(options.socketPath)}`,
+    `FZ_CONTROL_SOCKET=${controlSocketPath}`,
+    `FZ_SEED_CREDENTIAL=agent-seed`,
+    `FZ_AGENT_MODE=${options.mode}`,
+    options.apiUrl ? `FZ_API=${options.apiUrl}` : null,
+    options.project ? `FZ_PROJECT=${options.project}` : null,
+    options.environment ? `FZ_ENVIRONMENT=${options.environment}` : null,
+    options.enrolStatePath ? `FZ_ENROL_STATE_FILE=${options.enrolStatePath}` : null,
+    options.nodeLabel ? `FZ_NODE_LABEL=${options.nodeLabel}` : null,
+    options.nodeHostname ? `FZ_NODE_HOSTNAME=${options.nodeHostname}` : null,
+    `OTEL_EXPORTER_OTLP_ENDPOINT=${telemetryEndpoint}`,
+    "OTEL_SERVICE_NAME=forgezero-agent",
+    options.gitPublicKeyPath ? `FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}` : null,
+    options.repository ? `FZ_DEPLOY_REPO=${options.repository}` : null,
+    options.branch ? `FZ_DEPLOY_BRANCH=${options.branch}` : null,
+    options.profile ? `FZ_DEPLOY_PROFILE=${options.profile}` : null,
+    options.repository && options.branch ? `FZ_DEPLOY_KEY=${options.project ?? "platform"}:${options.environment ?? "production"}` : null,
+    deploymentEnabled ? `FZ_DEPLOY_ROOT=${deployRoot}` : null,
+    deploymentEnabled ? `FZ_CAPACITY_EVIDENCE_DIR=${deployRoot}/capacity` : null,
+    deploymentEnabled ? `FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}` : null,
+    deploymentEnabled ? `FZ_SOFTWARE_HELPER_SOCKET=${DEFAULT_SOFTWARE_HELPER_SOCKET}` : null,
+    Object.keys(deploymentCredentials).length > 0 ? `FZ_DEPLOY_SYSTEMD_SECRETS=${Object.keys(deploymentCredentials).join(",")}` : null,
+    Object.keys(deploymentEnvironment).length > 0 ? `FZ_DEPLOY_ENV_NAMES=${Object.keys(deploymentEnvironment).join(",")}` : null,
+    ...Object.entries(deploymentEnvironment).map(([name, value]) => `${name}=${value}`),
+    options.publicApiUrl ? `FZ_PUBLIC_API_URL=${options.publicApiUrl}` : null,
+    options.pullDeployments ? "FZ_DEPLOY_PULL=true" : null,
+    options.pullMigrations ? "FZ_MIGRATION_PULL=true" : null,
+    options.pullBootstrap ? "FZ_BOOTSTRAP_PULL=true" : null,
+    options.pullBootstrap ? "FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL=bootstrap-ssh-key" : null,
+    options.pullBootstrap ? `FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT=${options.bootstrapTargetTelemetryEndpoint}` : null,
+    `FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}`,
+    options.pullMigrations ? `FZ_LIFECYCLE_HELPER_SOCKET=${lifecycleHelperSocketPath}` : null
+  ].filter((line) => line !== null);
+  if (deploymentEnabled) {
+    environment.push(`HOME=${deployRoot}/agent-home`, `XDG_CACHE_HOME=${deployRoot}/cache`);
+  }
+  const gitCredential = options.gitCredentialPath ? `LoadCredentialEncrypted=git-deploy-key:${options.gitCredentialPath}
+` : "";
+  const bootstrapCredential = bootstrapEnabled ? `LoadCredentialEncrypted=bootstrap-ssh-key:${bootstrapSshCredentialPath}
+` : "";
+  const projectCredentials = Object.entries(deploymentCredentials).map(([name, path]) => `LoadCredentialEncrypted=${name}:${path}`).join(`
+`);
+  const deploymentWrites = deploymentEnabled ? `ReadWritePaths=${deployRoot}/releases ${deployRoot}/agent-home ${deployRoot}/cache ${deployRoot}/capacity` : "";
+  const supplementaryGroups = [
+    AGENT_UPDATE_GROUP,
+    deploymentEnabled ? DEPLOYMENT_GROUP : null,
+    deploymentEnabled ? SOFTWARE_HELPER_GROUP : null,
+    lifecycleEnabled ? LIFECYCLE_GROUP : null
+  ].filter((value) => value !== null);
+  const deploymentGroup = supplementaryGroups.length > 0 ? `SupplementaryGroups=${supplementaryGroups.join(" ")}` : "";
+  const after = [
+    "network-online.target",
+    "forgezero-agent-update-helper.service",
+    options.enforceEgress ? "forgezero-agent-egress.service" : null,
+    deploymentEnabled ? "forgezero-deploy-runner.service" : null,
+    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
+    warpEnabled ? "warp-svc.service" : null,
+    enrolmentEnabled ? "forgezero-agent-enrol.service" : null
+  ].filter((value) => value !== null);
+  const requires = [
+    "forgezero-agent-update-helper.service",
+    options.enforceEgress ? "forgezero-agent-egress.service" : null,
+    deploymentEnabled ? "forgezero-deploy-runner.service" : null,
+    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
+    warpEnabled ? "warp-svc.service" : null,
+    enrolmentEnabled ? "forgezero-agent-enrol.service" : null
+  ].filter((value) => value !== null);
+  const deploymentDependency = [
+    `After=${after.join(" ")}`,
+    "Wants=network-online.target",
+    requires.length > 0 ? `Requires=${requires.join(" ")}` : null,
+    options.enforceEgress ? "BindsTo=forgezero-agent-egress.service" : null
+  ].filter((value) => value !== null).join(`
+`);
+  const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
+DeviceAllow=/dev/sev-guest rw` : "";
+  const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
+ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
+` : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  return `[Unit]
+Description=ForgeZero node agent (${options.mode})
+Documentation=https://www.forgezero.net/docs/agent
+${deploymentDependency}
+
+[Service]
+Type=simple
+User=${user}
+Group=${VAULT_GROUP}
+${deploymentGroup}
+LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
+${gitCredential}${bootstrapCredential}${projectCredentials}${projectCredentials ? `
+` : ""}${snpPrepare}ExecStart=${bin}
+Restart=always
+RestartSec=2
+
+${environment.map((line) => `Environment=${line}`).join(`
+`)}
+
+# The node seed and the vault replica live in this process's memory. A core dump
+# writes both to disk, which is the one artefact this design exists to remove.
+LimitCORE=0
+
+# The socket is the entire interface: anything that can read it can read the
+# scope. So it lives in a directory systemd creates with a known owner rather
+# than wherever the process happened to have write access.
+RuntimeDirectory=forgezero
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+UMask=0007
+
+# Tenant-controlled commands execute in forgezero-deploy-runner.service. This
+# credential-bearing process never needs to cross a privilege boundary.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+${egressDirectives}
+${snpDevice}
+${deploymentWrites}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+var UNIT_PATH = "/etc/systemd/system/forgezero-agent.service";
+function planProvision(options) {
+  const mode = options.mode;
+  const user = options.user ?? "forgezero";
+  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
+  const credentialDir = seedCredentialPath.replace(/\/[^/]+$/, "");
+  const deployRoot = options.deployRoot ?? "/opt/forgezero";
+  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
+  const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
+  if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
+    throw new Error("migration pull and lifecycle profile must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([options.pullBootstrap, options.bootstrapSshCredentialPath, options.bootstrapTargetTelemetryEndpoint].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential and target telemetry endpoint must be supplied together");
+  }
+  const warpValues = [
+    options.warpOrganization,
+    options.warpClientIdCredentialPath,
+    options.warpClientSecretCredentialPath
+  ];
+  const warpEnabled = warpValues.every(Boolean);
+  if (warpValues.some(Boolean) && !warpEnabled)
+    throw new Error("WARP configuration must be supplied together");
+  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
+    throw new Error("direct enrolment paths must be supplied together");
+  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
+  const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
+  const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
+  const sourceBinPath = options.sourceBinPath ? systemdPath(options.sourceBinPath, "agent source binary") : undefined;
+  const binPath = options.binPath ? systemdPath(options.binPath, "agent binary") : undefined;
+  const gitCredentialPath = options.gitCredentialPath ? systemdPath(options.gitCredentialPath, "Git credential") : undefined;
+  const gitPublicKeyPath = options.gitPublicKeyPath ? systemdPath(options.gitPublicKeyPath, "Git public key") : undefined;
+  if (options.generateGitIdentity && (!gitCredentialPath || !gitPublicKeyPath)) {
+    throw new Error("generated Git identity needs credential and public-key paths");
+  }
+  const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
+  const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
+  const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
+  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
+  const warpClientSecretCredentialPath = warpEnabled ? systemdPath(options.warpClientSecretCredentialPath, "WARP client-secret credential") : undefined;
+  return {
+    mode,
+    reason: reasonFor(mode),
+    unitPath: UNIT_PATH,
+    unit: agentUnit({
+      ...options,
+      mode,
+      lifecycleProfilePath,
+      lifecycleHelperSocketPath,
+      bootstrapSshCredentialPath
+    }),
+    auxiliaryUnits: [
+      { path: AGENT_SOCKET_UNIT_PATH, unit: agentSocketUnit(options) },
+      { path: AGENT_SOCKET_PROXY_UNIT_PATH, unit: agentSocketProxyUnit(options) },
+      { path: AGENT_UPDATE_HELPER_UNIT_PATH, unit: agentUpdateHelperUnit(options) },
+      ...options.enforceEgress ? [
+        { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
+      ] : [],
+      ...deploymentEnabled ? [
+        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) },
+        { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) }
+      ] : [],
+      ...enrolmentEnabled ? [
+        { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
+      ] : [],
+      ...lifecycleEnabled ? [
+        { path: LIFECYCLE_HELPER_UNIT_PATH, unit: lifecycleHelperUnit({
+          ...options,
+          lifecycleProfilePath,
+          lifecycleHelperSocketPath
+        }) }
+      ] : [],
+      ...warpEnabled ? [
+        { path: WARP_CONFIG_UNIT_PATH, unit: warpConfigUnit({
+          ...options,
+          warpClientIdCredentialPath,
+          warpClientSecretCredentialPath
+        }) },
+        { path: WARP_SERVICE_DROP_IN_PATH, unit: warpServiceDropIn() }
+      ] : []
+    ],
+    socketPath: options.socketPath,
+    user,
+    steps: [
+      ...options.enforceEgress ? [{
+        label: "Ubuntu Agent egress prerequisites",
+        command: `. /etc/os-release; test "$ID" = ubuntu; ` + `DEBIAN_FRONTEND=noninteractive apt-get update -qq; ` + `DEBIAN_FRONTEND=noninteractive apt-get install -y nftables; ` + `systemctl enable --now systemd-resolved.service; ` + `test "$(readlink -f /etc/resolv.conf)" = /run/systemd/resolve/stub-resolv.conf; ` + `test -s /run/systemd/resolve/stub-resolv.conf`
+      }] : [],
+      {
+        label: "vault socket access group",
+        command: `groupadd --system ${VAULT_GROUP} || true`
+      },
+      {
+        label: "Agent update helper access group",
+        command: `groupadd --system ${AGENT_UPDATE_GROUP} || true`
+      },
+      ...sourceBinPath && binPath ? [{
+        label: "root-owned agent runtime",
+        command: `install -d -o root -g root -m 0755 ${binPath.replace(/\/[^/]+$/, "")} ` + `${DEFAULT_AGENT_RELEASE_ROOT}/versions/${VERSION}/dist; ` + `install -o root -g root -m 0755 ${sourceBinPath} ` + `${DEFAULT_AGENT_RELEASE_ROOT}/versions/${VERSION}/dist/fz-agent.js; ` + `ln -sfn versions/${VERSION} ${DEFAULT_AGENT_RELEASE_ROOT}/current.next; ` + `mv -Tf ${DEFAULT_AGENT_RELEASE_ROOT}/current.next ${DEFAULT_AGENT_RELEASE_ROOT}/current; ` + `rm -f ${binPath}; ln -s ${DEFAULT_AGENT_RELEASE_ROOT}/current/dist/fz-agent.js ${binPath}`
+      }] : [],
+      ...warpEnabled ? [{
+        label: "Cloudflare One client for Ubuntu 26.04",
+        command: `. /etc/os-release; test "$ID" = ubuntu && test "$VERSION_ID" = 26.04; ` + `install -d -m 0755 /usr/share/keyrings /etc/apt/sources.list.d /etc/systemd/system/warp-svc.service.d; ` + `curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg -o /run/cloudflare-warp-key.gpg; ` + `gpg --batch --yes --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg /run/cloudflare-warp-key.gpg; ` + `rm -f /run/cloudflare-warp-key.gpg; ` + `printf 'deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ %s main\\n' "$VERSION_CODENAME" > /etc/apt/sources.list.d/cloudflare-client.list; ` + `apt-get update -qq; DEBIAN_FRONTEND=noninteractive apt-get install -y cloudflare-warp`
+      }] : [],
+      ...deploymentEnabled ? [{
+        label: "deployment isolation group",
+        command: `groupadd --system ${DEPLOYMENT_GROUP} || true; groupadd --system ${SOFTWARE_HELPER_GROUP} || true`
+      }] : [],
+      ...lifecycleEnabled ? [{
+        label: "lifecycle helper access group",
+        command: `groupadd --system ${LIFECYCLE_GROUP} || true`
+      }] : [],
+      {
+        label: "service account",
+        command: `useradd --system --no-create-home --shell /usr/sbin/nologin ${user} || true`
+      },
+      {
+        label: "bind service account to vault group",
+        command: `usermod -g ${VAULT_GROUP} ${user}`
+      },
+      {
+        label: "grant verified Agent update access",
+        command: `usermod -a -G ${AGENT_UPDATE_GROUP} ${user}`
+      },
+      ...lifecycleEnabled ? [{
+        label: "grant lifecycle helper socket access",
+        command: `usermod -a -G ${LIFECYCLE_GROUP} ${user}`
+      }] : [],
+      ...deploymentEnabled ? [{
+        label: "credential-free deployment account",
+        command: `useradd --system --no-create-home --shell /usr/sbin/nologin --gid ${DEPLOYMENT_GROUP} ${DEPLOYMENT_RUNNER_USER} || true; ` + `usermod -a -G ${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP} ${user}`
+      }] : [],
+      {
+        label: "credential directory",
+        command: `install -d -o root -g root -m 0700 ${credentialDir}`
+      },
+      {
+        label: "Agent state directory",
+        command: "install -d -o root -g root -m 0750 /var/lib/forgezero"
+      },
+      {
+        label: "encrypted node identity",
+        command: `test -s ${seedCredentialPath} || { ` + `openssl rand -base64 32 | tr '+/' '-_' | tr -d '=\\n' | ` + `systemd-creds encrypt --name=agent-seed - ${seedCredentialPath}; ` + `chmod 0400 ${seedCredentialPath}; }`
+      },
+      ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
+        {
+          label: "Git deploy identity directory",
+          command: `install -d -o root -g root -m 0755 ${gitPublicKeyDir}`
+        },
+        {
+          label: "unique encrypted Git deploy identity",
+          command: `test -s ${gitCredentialPath} || { ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; ` + `ssh-keygen -q -t ed25519 -N '' -C forgezero-compute -f /run/forgezero-git-deploy-key; ` + `systemd-creds encrypt --name=git-deploy-key /run/forgezero-git-deploy-key ${gitCredentialPath}; ` + `install -o root -g root -m 0444 /run/forgezero-git-deploy-key.pub ${gitPublicKeyPath}; ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; ` + `chmod 0400 ${gitCredentialPath}; }; ` + `test -s ${gitPublicKeyPath} || { ` + `systemd-creds decrypt --name=git-deploy-key ${gitCredentialPath} /run/forgezero-git-deploy-key; ` + `ssh-keygen -y -f /run/forgezero-git-deploy-key | ` + `sed 's/$/ forgezero-compute/' > /run/forgezero-git-deploy-key.pub; ` + `install -o root -g root -m 0444 /run/forgezero-git-deploy-key.pub ${gitPublicKeyPath}; ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; }; ` + `test -s ${gitCredentialPath} && test -s ${gitPublicKeyPath}`
+        }
+      ] : [],
+      ...enrolmentEnabled ? [
+        {
+          label: "enrolment state directory",
+          command: `install -d -o ${user} -g ${user} -m 0700 ${enrolStateDir}`
+        },
+        {
+          label: "encrypted one-time enrolment capability",
+          command: `test -s ${enrolStatePath} || test -s ${enrolTokenCredentialPath} || { test -r ${enrolTokenSourcePath}; ` + `systemd-creds encrypt --name=enrol-token ${enrolTokenSourcePath} ${enrolTokenCredentialPath}; ` + `chmod 0400 ${enrolTokenCredentialPath}; rm -f ${enrolTokenSourcePath}; }`
+        }
+      ] : [],
+      ...deploymentEnabled ? [{
+        label: "deployment directories",
+        command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/capacity && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
+      }] : [],
+      { label: "reload units", command: "systemctl daemon-reload" },
+      ...deploymentEnabled ? [{
+        label: "remove unsupported deployment socket activation",
+        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
+      }] : [],
+      {
+        label: "enable and converge services",
+        command: `systemctl enable ${[
+          "forgezero-agent.socket",
+          "forgezero-agent-update-helper.service",
+          ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
+          ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+          ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
+          ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
+          ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
+          "forgezero-agent.service"
+        ].join(" ")}; systemctl reset-failed forgezero-agent.service || true; systemctl restart ${[
+          "forgezero-agent-update-helper.service",
+          ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
+          ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+          ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
+          ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
+          ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
+        ].join(" ")}; systemctl restart forgezero-agent.socket; systemctl reset-failed forgezero-agent.service || true; systemctl restart forgezero-agent.service`
+      },
+      ...enrolmentEnabled ? [{
+        label: "prove the compute binding is durable",
+        command: `test -s ${enrolStatePath}`
+      }] : [],
+      ...options.enforceEgress ? [{
+        label: "prove the Agent egress policy is active",
+        command: "systemctl is-active forgezero-agent-egress.service && " + "nft --numeric list table inet forgezero_agent_egress | grep -q forgezero-agent-egress-v1" + (deploymentEnabled ? ` && nft --numeric list table inet forgezero_agent_egress | grep -q 'public-tcp=${runnerPublicTcpPorts.join(",")}'` + (runnerLoopbackPorts.length > 0 ? ` && nft --numeric list table inet forgezero_agent_egress | grep -Eq 'loopback=[0-9]+:${runnerLoopbackPorts.join(",")}( |")'` : "") : "")
+      }] : [],
+      { label: "prove it is running", command: "systemctl is-active forgezero-agent.service" },
+      { label: "prove the public Vault socket exists", command: awaitSocketCommand(options.socketPath) },
+      { label: "prove the Agent Vault backend exists", command: awaitSocketCommand(agentBackendSocketPath(options.socketPath)) },
+      { label: "prove the Agent update helper exists", command: awaitSocketCommand(DEFAULT_AGENT_UPDATE_SOCKET) },
+      ...deploymentEnabled ? [{
+        label: "prove the deployment runner socket exists",
+        command: awaitSocketCommand(DEPLOYMENT_RUNNER_SOCKET)
+      }, {
+        label: "prove the software strategy helper socket exists",
+        command: awaitSocketCommand(DEFAULT_SOFTWARE_HELPER_SOCKET)
+      }] : [],
+      ...lifecycleEnabled ? [{
+        label: "prove the lifecycle helper socket exists",
+        command: awaitSocketCommand(lifecycleHelperSocketPath)
+      }] : [],
+      ...warpEnabled ? [{
+        label: "prove Cloudflare WARP is connected",
+        command: `warp-cli --accept-tos status | grep -Eiq '(^|[[:space:]])Connected([[:space:]]|$)'`
+      }] : [],
+      ...options.repository ? [{
+        label: "prove the deployment control socket exists",
+        command: awaitSocketCommand(options.controlSocketPath ?? "/run/forgezero/control.sock")
+      }] : []
+    ]
+  };
+}
+
+// src/cli/agent-install.ts
+async function readCapabilities(run) {
+  const answers = {};
+  const checks = Object.entries(CAPABILITY_CHECKS);
+  for (const [id, check] of checks) {
+    try {
+      const result = await run(check.command);
+      answers[id] = check.satisfied(result.stdout, result.exitCode);
+    } catch {
+      answers[id] = false;
+    }
+  }
+  return answers;
+}
+async function localRunner(command) {
+  const proc = Bun.spawn(["sh", "-c", command], { stdout: "pipe", stderr: "pipe" });
+  const stdout = await new Response(proc.stdout).text();
+  return { stdout, exitCode: await proc.exited };
+}
+function planInstall(options) {
+  const { capabilities, ...unit } = options;
+  return planProvision({ ...unit, mode: modeFor(capabilities) });
+}
+async function applyPlan(plan, run) {
+  const transcript = [];
+  for (const step of plan.steps) {
+    const result = await run(step.command);
+    transcript.push({ label: step.label, command: step.command, exitCode: result.exitCode });
+    if (result.exitCode !== 0 && !step.optional) {
+      throw new Error(`${step.label} failed (exit ${result.exitCode}): ${step.command}`);
+    }
+  }
+  return transcript;
+}
+
+// src/platform-bootstrap-runtime.ts
+var safeAtom = (name, value) => {
+  if (!value || /[\0\r\n]/.test(value))
+    throw new Error(`${name} must be non-empty and single-line.`);
+  return value;
+};
+var boundedInteger = (name, value, minimum, maximum) => {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`${name} must be an integer from ${minimum} through ${maximum}.`);
+  }
+  return value;
+};
+var privateCoordinator = (raw) => {
+  const url = new URL(raw);
+  if (url.protocol !== "http:" || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error("ArangoDB coordinator URLs must be credential-free private HTTP origins.");
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const privateHost = host === "localhost" || host === "::1" || host.startsWith("fd") || host.startsWith("fc") || /^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+  if (!privateHost || url.port && url.port !== "8529") {
+    throw new Error("ArangoDB coordinators must use private addresses and port 8529.");
+  }
+  return url.origin;
+};
+var httpsOrigin = (name, raw) => {
+  const value = new URL(raw);
+  if (value.protocol !== "https:" || value.username || value.password || value.search || value.hash || value.pathname !== "/") {
+    throw new Error(`${name} must be a credential-free HTTPS origin.`);
+  }
+  return value.origin;
+};
+var systemdValue = (name, raw) => {
+  if (/[\0\r\n]/.test(raw))
+    throw new Error(`${name} must be single-line.`);
+  const value = raw;
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("$", "\\$")}"`;
+};
+function validatePlatformSharedEnvironment(input, options = {}) {
+  if (input.softwareProfile === "platform-api" !== (input.databaseRole === "none")) {
+    throw new Error("platform-api requires database role none; platform-db-api requires master or joiner.");
+  }
+  if (input.databaseCoordinators.length < 1 || input.databaseCoordinators.length > 16) {
+    throw new Error("databaseCoordinators must contain 1 through 16 endpoints.");
+  }
+  const coordinators = input.databaseCoordinators.map(privateCoordinator);
+  if (new Set(coordinators).size !== coordinators.length)
+    throw new Error("databaseCoordinators must be unique.");
+  if (!["private-lan", "cloudflare-warp"].includes(input.databaseNetworkMode)) {
+    throw new Error("Database networking must be private-lan or cloudflare-warp.");
+  }
+  boundedInteger("databaseReplicationFactor", input.databaseReplicationFactor, 1, 16);
+  boundedInteger("databaseWriteConcern", input.databaseWriteConcern, 1, 16);
+  if (input.databaseWriteConcern > input.databaseReplicationFactor) {
+    throw new Error("databaseWriteConcern cannot exceed databaseReplicationFactor.");
+  }
+  boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
+  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
+  boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
+  boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
+  if (!Number.isFinite(input.otlpTraceSampleRatio) || input.otlpTraceSampleRatio < 0 || input.otlpTraceSampleRatio > 1) {
+    throw new Error("otlpTraceSampleRatio must be from 0 through 1.");
+  }
+  if (input.otlpEndpoint !== "http://127.0.0.1:4318")
+    throw new Error("OTLP must use the exact local collector endpoint.");
+  validateCollectorUnit(input.otlpCollectorUnit);
+  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  for (const [name, value] of Object.entries({
+    nodeHostname: input.nodeHostname,
+    nodeRegion: input.nodeRegion,
+    databaseUser: input.databaseUser,
+    sharedDirectory: input.sharedDirectory,
+    seedSyncEpoch: input.seedSyncEpoch,
+    repository: input.repository,
+    branch: input.branch,
+    deployProfile: input.deployProfile
+  }))
+    safeAtom(name, value);
+  if (!input.sharedDirectory.startsWith("/"))
+    throw new Error("sharedDirectory must be absolute.");
+  for (const peer of input.seedSyncPeers) {
+    const url = new URL(peer);
+    if (url.protocol !== "ws:" && url.protocol !== "wss:")
+      throw new Error("Seed peers must be WebSocket URLs.");
+    if (url.username || url.password || url.hash)
+      throw new Error("Seed peers cannot contain credentials or fragments.");
+  }
+  if (input.smtp) {
+    safeAtom("smtp.host", input.smtp.host);
+    boundedInteger("smtp.port", input.smtp.port, 1, 65535);
+    safeAtom("smtp.from", input.smtp.from);
+    if (input.smtp.user)
+      safeAtom("smtp.user", input.smtp.user);
+  }
+  if (input.backup) {
+    httpsOrigin("backup.endpoint", input.backup.endpoint);
+    for (const [name, value] of Object.entries(input.backup))
+      safeAtom(`backup.${name}`, value);
+  }
+  if (input.cloudflare) {
+    if (![input.cloudflare.accountId, input.cloudflare.zoneId, input.cloudflare.kvNamespaceId].every((item) => /^[a-f0-9]{32}$/i.test(item)) || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(input.cloudflare.tunnelId)) {
+      throw new Error("Cloudflare account, zone, KV and Tunnel ids are malformed.");
+    }
+    const service = new URL(input.cloudflare.tunnelService);
+    if (service.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(service.hostname) || service.username || service.password || service.search || service.hash)
+      throw new Error("Cloudflare Tunnel service must be loopback HTTP.");
+    if (input.cloudflare.warp) {
+      if (!/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(input.cloudflare.warp.organization) || !/^[0-9a-f-]{36}$/i.test(input.cloudflare.warp.virtualNetworkId) || !/^[A-Za-z0-9_-]{1,128}$/.test(input.cloudflare.warp.deviceProfileId)) {
+        throw new Error("Cloudflare WARP organization, VNET or device profile is malformed.");
+      }
+    }
+  }
+  if (!options.allowPendingCloudflareHandoff && input.databaseNetworkMode === "cloudflare-warp" !== Boolean(input.cloudflare?.warp)) {
+    throw new Error("cloudflare-warp networking requires its exact enrolled Cloudflare coordinates.");
+  }
+  return {
+    ...input,
+    databaseCoordinators: coordinators,
+    appOrigin: httpsOrigin("appOrigin", input.appOrigin),
+    apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+  };
+}
+function renderPlatformSharedEnvironment(input) {
+  const value = validatePlatformSharedEnvironment(input);
+  const appHost = new URL(value.appOrigin).hostname.split(".").slice(-2).join(".");
+  const apiHost = new URL(value.apiOrigin).hostname.split(".").slice(-2).join(".");
+  const entries = {
+    ARANGO_URL: value.databaseCoordinators[0],
+    ARANGO_URLS: value.databaseCoordinators.join(","),
+    ARANGO_DB: "fz",
+    FZ_DATABASE_MODE: "platform",
+    ARANGO_USER: value.databaseUser,
+    ARANGO_REPLICATION_FACTOR: String(value.databaseReplicationFactor),
+    ARANGO_WRITE_CONCERN: String(value.databaseWriteConcern),
+    FZ_DB_ROLE: value.databaseRole,
+    FZ_SOFTWARE_PROFILE: value.softwareProfile,
+    FZ_ROLE: value.nodeRole,
+    FZ_DB_ADDRESS: value.databaseAddress ?? "",
+    FZ_DB_MASTER: value.databaseMaster ?? "",
+    FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
+    FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
+    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
+    FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
+    FZ_SHARED_DIR: value.sharedDirectory,
+    FZ_PUBLIC_API_PORT: String(value.publicApiPort),
+    ORIGIN: value.appOrigin,
+    API_ORIGIN: value.apiOrigin,
+    HOST: "127.0.0.1",
+    APP_ORIGINS: value.appOrigin,
+    TRUST_CLOUDFLARE_IP: "1",
+    SESSION_COOKIE_SAMESITE: appHost === apiHost ? "lax" : "none",
+    SESSION_COOKIE_DOMAIN: "",
+    FZ_NODE_HOSTNAME: value.nodeHostname,
+    FZ_NODE_REGION: value.nodeRegion,
+    FZ_CONCURRENCY_LIMIT: String(value.concurrencyLimit),
+    FZ_DRAIN_DEADLINE_MS: String(value.drainDeadlineMs),
+    OTEL_EXPORTER_OTLP_ENDPOINT: value.otlpEndpoint,
+    FZ_OTLP_COLLECTOR_UNIT: value.otlpCollectorUnit,
+    OTEL_SERVICE_NAME: "forgezero-api",
+    FZ_OTLP_FLUSH_INTERVAL_MS: String(value.otlpFlushIntervalMs),
+    FZ_OTLP_TRACE_SAMPLE_RATIO: String(value.otlpTraceSampleRatio),
+    FZ_AGENT_OTLP_ENDPOINT: value.agentOtlpEndpoint,
+    FZ_CUSTODIAN_EMAIL: value.custodianEmail ?? "",
+    FZ_PROFILE: value.deployProfile,
+    FZ_REPO: value.repository,
+    FZ_BRANCH: value.branch,
+    FZ_SMTP_HOST: value.smtp?.host ?? "",
+    FZ_SMTP_PORT: value.smtp ? String(value.smtp.port) : "",
+    FZ_SMTP_USER: value.smtp?.user ?? "",
+    FZ_SMTP_FROM: value.smtp?.from ?? "",
+    BACKUP_S3_ENDPOINT: value.backup?.endpoint ?? "",
+    BACKUP_S3_REGION: value.backup?.region ?? "",
+    BACKUP_S3_BUCKET: value.backup?.bucket ?? "",
+    BACKUP_S3_ACCESS_KEY_ID: value.backup?.accessKeyId ?? "",
+    FZ_CF_ACCOUNT_ID: value.cloudflare?.accountId ?? "",
+    FZ_CF_ZONE_ID: value.cloudflare?.zoneId ?? "",
+    FZ_CF_KV_NAMESPACE_ID: value.cloudflare?.kvNamespaceId ?? "",
+    FZ_CF_TUNNEL_ID: value.cloudflare?.tunnelId ?? "",
+    FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
+    FZ_WARP_ORGANIZATION: value.cloudflare?.warp?.organization ?? "",
+    FZ_CF_VIRTUAL_NETWORK_ID: value.cloudflare?.warp?.virtualNetworkId ?? "",
+    FZ_CF_WARP_POLICY_ID: value.cloudflare?.warp?.deviceProfileId ?? ""
+  };
+  return `# Generated by fz bootstrap platform. Non-secret coordinates only.
+` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
+`) + `
+`;
+}
+function platformApiCredentialSpecs(options) {
+  const optional = [
+    ["bootstrap-smtp-password", options.smtp],
+    ["cloudflare-kv-token", options.cloudflareKv],
+    ["cloudflare-network-token", options.cloudflareNetwork]
+  ];
+  return [
+    { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
+    { name: "seed-sync-root", encryptedPath: "/etc/forgezero/creds/seed-sync-root.cred", required: true },
+    ...optional.filter(([, present]) => present).map(([name]) => ({
+      name,
+      encryptedPath: `/etc/forgezero/creds/${name}.cred`,
+      required: false
+    }))
+  ];
+}
+function renderPlatformApiUnits(input) {
+  for (const path of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+    if (!path.startsWith("/") || /[\r\n]/.test(path))
+      throw new Error("Runtime paths must be absolute and single-line.");
+  }
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
+    throw new Error("Invalid service user.");
+  validateCollectorUnit(input.collectorUnit);
+  boundedInteger("bluePort", input.bluePort, 1024, 65535);
+  boundedInteger("greenPort", input.greenPort, 1024, 65535);
+  if (input.bluePort === input.greenPort)
+    throw new Error("Blue and green ports must differ.");
+  const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
+`);
+  const template = `[Unit]
+Description=ForgeZero (%i slot)
+After=network-online.target ${input.collectorUnit}
+Wants=network-online.target ${input.collectorUnit}
+
+[Service]
+Type=simple
+User=${input.serviceUser}
+WorkingDirectory=${input.slotsDirectory}/%i
+Environment=NODE_ENV=production
+Environment=FZ_SLOT=%i
+EnvironmentFile=${input.sharedEnvironmentFile}
+${credentials}
+ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
+Restart=always
+RestartSec=2
+TimeoutStopSec=35s
+LimitCORE=0
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadOnlyPaths=${input.sharedDirectory}
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+  return { template, dropIns: {
+    blue: `[Service]
+Environment=PORT=${input.bluePort}
+`,
+    green: `[Service]
+Environment=PORT=${input.greenPort}
+`
+  } };
+}
+function renderPlatformNginx(input) {
+  boundedInteger("publicPort", input.publicPort, 1024, 65535);
+  boundedInteger("initialSlotPort", input.initialSlotPort, 1024, 65535);
+  if (input.publicPort === input.initialSlotPort)
+    throw new Error("Edge and slot ports must differ.");
+  return {
+    upstream: `upstream forgezero { server 127.0.0.1:${input.initialSlotPort}; }
+`,
+    site: `server {
+  listen 127.0.0.1:${input.publicPort};
+  server_name _;
+  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  location / { return 404; }
+}
+`
+  };
+}
+function renderPlatformActivationFiles(input) {
+  if (!input.root.startsWith("/") || /[\0\r\n]/.test(input.root))
+    throw new Error("Activation root must be absolute and single-line.");
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
+    throw new Error("Invalid activation service user.");
+  boundedInteger("bluePort", input.bluePort, 1024, 65535);
+  boundedInteger("greenPort", input.greenPort, 1024, 65535);
+  if (input.bluePort === input.greenPort)
+    throw new Error("Activation slot ports must differ.");
+  boundedInteger("keepReleases", input.keepReleases, 2, 100);
+  if (!/^\/[A-Za-z0-9/_-]{1,128}$/.test(input.healthPath) || input.healthPath.includes("..")) {
+    throw new Error("Activation health path is malformed.");
+  }
+  const environment = [
+    `FZ_DIR=${input.root}`,
+    `FZ_USER=${input.serviceUser}`,
+    `FZ_BLUE_PORT=${input.bluePort}`,
+    `FZ_GREEN_PORT=${input.greenPort}`,
+    `FZ_HEALTH_PATH=${input.healthPath}`,
+    `FZ_KEEP_RELEASES=${input.keepReleases}`
+  ].join(`
+`) + `
+`;
+  const helper = `#!/usr/bin/env bash
+set -Eeuo pipefail
+source /etc/forgezero/deploy.env
+[[ $# == 1 ]] || { echo "usage: forgezero-activate <release>" >&2; exit 2; }
+release="$(realpath -e "$1")"; releases="$(realpath -e "$FZ_DIR/releases")"; slots="$FZ_DIR/slots"
+install -d -o root -g root -m 0755 "$slots"
+case "$release/" in "$releases"/*/) ;; *) echo "release is outside $releases" >&2; exit 2 ;; esac
+[[ -f "$release/.fz/deploy.json" && -s "$release/src/index.ts" && -s "$release/bun.lock" ]] || { echo "release is incomplete" >&2; exit 2; }
+slot_file="$FZ_DIR/.forge-slot"; previous_slot="$(cat "$slot_file" 2>/dev/null || true)"
+if [[ "$previous_slot" == blue ]]; then target=green; port="$FZ_GREEN_PORT"; else target=blue; port="$FZ_BLUE_PORT"; fi
+target_link="$slots/$target"; previous_target_link="$(readlink -f "$target_link" 2>/dev/null || true)"
+chown -R root:"$FZ_USER" "$release"; chmod -R a-w "$release"; find "$release" -type d -exec chmod a+rx {} +; find "$release" -type f -exec chmod a+r {} +
+ln -sfn "$release" "$target_link"; systemctl restart "forgezero@\${target}.service"
+healthy=0; for _ in $(seq 1 30); do curl -fsS --max-time 2 "http://127.0.0.1:\${port}\${FZ_HEALTH_PATH}" >/dev/null 2>&1 && { healthy=1; break; }; sleep 1; done
+if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; exit 1; fi
+upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
+printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
+if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
+rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"; [[ -n "$previous_slot" && "$previous_slot" != "$target" ]] && systemctl stop "forgezero@\${previous_slot}.service" || true
+mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
+for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
+printf 'promoted %s on %s\\n' "$release" "$target"
+`;
+  return {
+    environment,
+    helper,
+    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/libexec/forgezero-activate *
+`
+  };
+}
+function validateCollectorUnit(unit) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}\.service$/.test(unit))
+    throw new Error("Invalid OTLP collector service unit.");
+  if (/^(forgezero@.*|forgezero-agent|forgezero-metal-agent|forgezero-db)\.service$/.test(unit)) {
+    throw new Error("OTLP collector must be independently supervised.");
+  }
+}
+function planLocalOtlpProof(endpoint2, collectorUnit) {
+  if (endpoint2 !== "http://127.0.0.1:4318")
+    throw new Error("OTLP proof requires exact loopback endpoint http://127.0.0.1:4318.");
+  validateCollectorUnit(collectorUnit);
+  return {
+    unitCheck: { command: "systemctl", argv: ["is-active", "--quiet", collectorUnit] },
+    receiverCheck: {
+      command: "curl",
+      acceptedStatus: "2xx",
+      argv: [
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "5",
+        "--output",
+        "/dev/null",
+        "--write-out",
+        "%{http_code}",
+        "--request",
+        "POST",
+        "--header",
+        "Content-Type: application/json",
+        "--data-binary",
+        "{}",
+        `${endpoint2}/v1/metrics`
+      ]
+    }
+  };
+}
+
+// src/bootstrap.ts
+import { DEFAULT_SOCKET as DEFAULT_SOCKET2 } from "@forgezero/vault";
+var PLATFORM_BOOTSTRAP_PROFILES = [
+  "platform-db-api",
+  "platform-api"
+];
+var STATE_PATH = "/var/lib/forgezero/bootstrap.json";
+var CREDS = "/etc/forgezero/creds";
+var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
+var TUNNEL_CREDENTIAL = `${CREDS}/cloudflared-token.cred`;
+var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
+var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
+var WARP_CLIENT_ID_CREDENTIAL = `${CREDS}/warp-auth-client-id.cred`;
+var WARP_CLIENT_SECRET_CREDENTIAL = `${CREDS}/warp-auth-client-secret.cred`;
+var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
+var PLATFORM_ENROL_SOURCE = "/run/forgezero-platform-enrol-token";
+var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
+var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
+var PACKAGED_AGENT_BIN = fileURLToPath(new URL("./fz-agent.js", import.meta.url));
+var privateOrigin = (value) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`database coordinator is malformed: ${value}`);
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error(`database coordinators must be credential-free HTTP(S) origins: ${value}`);
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const v4 = host.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/)?.slice(1).map(Number);
+  const privateV4 = v4 && v4.every((part) => part >= 0 && part <= 255) && (v4[0] === 10 || v4[0] === 172 && v4[1] >= 16 && v4[1] <= 31 || v4[0] === 192 && v4[1] === 168);
+  const privateV6 = host === "::1" || /^f[cd][0-9a-f]:/i.test(host);
+  if (!privateV4 && !privateV6 && host !== "127.0.0.1" && host !== "localhost") {
+    throw new Error(`database coordinator must use a private address: ${value}`);
+  }
+  return url.origin;
+};
+var privateCidr = (value) => {
+  const match = value.match(/^(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\/(\d|[12]\d|3[0-2])$/);
+  if (!match || match[1].split(".").some((part) => Number(part) > 255))
+    throw new Error(`private firewall CIDR is malformed: ${value}`);
+  return value;
+};
+var privateFile = (host, path, label) => {
+  if (!host.exists(path))
+    throw new Error(`${label} file is missing: ${path}`);
+  const metadata = host.inspect?.(path);
+  if (metadata && (!metadata.regular || metadata.symbolic || metadata.uid !== 0 || metadata.links !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 16 * 1024)) {
+    throw new Error(`${label} must be a root-owned, owner-only regular file with one link and at most 16 KiB`);
+  }
+  const value = host.read(path).trim();
+  if (!value)
+    throw new Error(`${label} file is empty: ${path}`);
+  return value;
+};
+function validateBootstrapConfig(value) {
+  if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?){2,}$/.test(value.nodeHostname)) {
+    throw new Error("node hostname must be a lowercase public FQDN");
+  }
+  let telemetry;
+  try {
+    telemetry = new URL(value.telemetryEndpoint);
+  } catch {
+    throw new Error("telemetry endpoint is malformed");
+  }
+  if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
+    throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+  }
+  if (value.kind === "tenant") {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
+      throw new Error("tenant realm is malformed");
+    if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
+      throw new Error("tenant API must be public HTTPS or loopback HTTP");
+    }
+    if (!value.enrolTokenFile)
+      throw new Error("tenant bootstrap requires --enrol-token-file");
+    if (value.bootstrapRunner) {
+      if (!value.bootstrapRunner.sshPrivateKeyFile.startsWith("/") || /[\r\n]/.test(value.bootstrapRunner.sshPrivateKeyFile)) {
+        throw new Error("bootstrap runner SSH private-key file must be absolute");
+      }
+      let targetTelemetry;
+      try {
+        targetTelemetry = new URL(value.bootstrapRunner.targetTelemetryEndpoint);
+      } catch {
+        throw new Error("bootstrap target telemetry endpoint is malformed");
+      }
+      if (targetTelemetry.protocol !== "https:" || targetTelemetry.username || targetTelemetry.password || targetTelemetry.search || targetTelemetry.hash || targetTelemetry.port && targetTelemetry.port !== "443") {
+        throw new Error("bootstrap target telemetry must be public HTTPS on port 443");
+      }
+    }
+    return value;
+  }
+  if (!PLATFORM_BOOTSTRAP_PROFILES.includes(value.profile))
+    throw new Error("unsupported platform software profile");
+  if (!["production", "development"].includes(value.environment))
+    throw new Error("platform environment must be production or development");
+  let api;
+  try {
+    api = new URL(value.apiUrl);
+  } catch {
+    throw new Error("platform API URL is malformed");
+  }
+  if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash) {
+    throw new Error("platform API must be public HTTPS without credentials, query or fragment");
+  }
+  const expected = value.profile === "platform-api" ? { role: "none", mode: "default" } : { role: undefined, mode: "default" };
+  if (expected.role && value.database.role !== expected.role || value.database.serverMode !== expected.mode || value.profile === "platform-db-api" && !["master", "joiner"].includes(value.database.role)) {
+    throw new Error("platform profile, database role and Coordinator mode disagree");
+  }
+  if (value.database.role !== "none" && !value.database.address)
+    throw new Error("database nodes require a private address");
+  if (value.database.role === "joiner" && !value.database.master)
+    throw new Error("database joiners require the master starter address");
+  if (!/^(?:dev-)?fz-n[1-9][0-9]{0,2}$/.test(value.computeReference))
+    throw new Error("platform compute reference is malformed");
+  if (!value.database.bootstrapSecretFile)
+    throw new Error("platform bootstrap requires the shared cluster bootstrap-code file");
+  const write = value.database.coordinators.map(privateOrigin);
+  if (write.length < 1 || write.length > 16 || new Set(write).size !== write.length) {
+    throw new Error("database coordinators must contain 1-16 unique private origins");
+  }
+  value.database.coordinators = write;
+  const runtime = validatePlatformSharedEnvironment(value.runtime.environment, {
+    allowPendingCloudflareHandoff: Boolean(value.cloudflareHandoff)
+  });
+  if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.repository !== value.repository || runtime.branch !== value.branch || runtime.databaseCoordinators.join(",") !== write.join(",")) {
+    throw new Error("platform runtime coordinates disagree with immutable bootstrap coordinates");
+  }
+  if (runtime.deployProfile !== value.environment)
+    throw new Error("runtime deployment profile disagrees with bootstrap environment");
+  if (value.database.address !== runtime.databaseAddress || value.database.master !== runtime.databaseMaster) {
+    throw new Error("runtime database topology disagrees with bootstrap topology");
+  }
+  if (!Number.isSafeInteger(value.firewall.sshPort) || value.firewall.sshPort < 1 || value.firewall.sshPort > 65535) {
+    throw new Error("firewall SSH port is invalid");
+  }
+  value.firewall.privateCidrs = value.firewall.privateCidrs.map(privateCidr);
+  if (value.firewall.enabled && (value.firewall.privateCidrs.length < 1 || new Set(value.firewall.privateCidrs).size !== value.firewall.privateCidrs.length)) {
+    throw new Error("enabled firewall requires unique private cluster CIDRs");
+  }
+  if (Number(value.computeReference.match(/n(\d+)$/)?.[1]) > 3 && !value.platformEnrolTokenFile) {
+    throw new Error("post-genesis platform computes require an API-issued enrolment token file");
+  }
+  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.checkpointFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
+    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  }
+  value.runtime.environment = runtime;
+  return value;
+}
+function planBootstrap(input, initialized = false) {
+  const config = validateBootstrapConfig(structuredClone(input));
+  const software = config.kind === "tenant" ? [
+    ...config.software ?? [],
+    ...config.bootstrapRunner && !config.software?.some(({ id }) => id === "openssh-client") ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
+    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : []
+  ] : [
+    ...config.firewall.enabled ? [{ id: "ufw", version: "ubuntu-26.04" }] : [],
+    { id: "bun", version: "1.3.14" },
+    { id: "nginx", version: "ubuntu-26.04" },
+    ...config.profile === "platform-api" ? [] : [{ id: "arangodb", version: "3.11.14" }],
+    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : []
+  ];
+  return {
+    kind: config.kind,
+    mode: initialized ? "repair" : "install",
+    profile: config.kind === "platform" ? config.profile : config.profile ?? "tenant-managed",
+    software,
+    statePath: STATE_PATH,
+    steps: [
+      { id: "agent", label: "Install and verify the common Agent supervision boundary", mutation: true },
+      { id: "software", label: "Install exact Agent-owned software coordinates in order", mutation: true },
+      { id: "credentials", label: "Seal bootstrap credentials with systemd-creds", mutation: true },
+      ...config.kind === "platform" && config.database.role !== "none" ? [{ id: "database", label: "Provision Community 3.11.14 cluster and Coordinator mode", mutation: true }] : [],
+      ...config.kind === "platform" ? [
+        { id: "runtime", label: "Install the shared environment, API slots, edge and activation boundary", mutation: true },
+        { id: "deploy", label: "Create the first invite when required and health-gate the initial deployment", mutation: true },
+        { id: "enrol", label: "Consume the API-bound platform capability and enable signed control", mutation: true }
+      ] : [],
+      ...config.installCloudflared ? [{ id: "cloudflared-install-only", label: "Install cloudflared without creating Cloudflare resources", mutation: true }] : [],
+      { id: "state", label: "Persist immutable bootstrap profile and evidence coordinates", mutation: true },
+      { id: "status", label: "Verify services and immutable profile", mutation: false }
+    ]
+  };
+}
+var checked = async (host, argv, label, options) => {
+  const result = await host.exec(argv, options);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed: ${result.output.trim()}`);
+  return result.output;
+};
+var shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+var unitEscape = (value) => {
+  if (/[^A-Za-z0-9_./:@,+-]/.test(value))
+    throw new Error(`unsafe systemd coordinate: ${value}`);
+  return value;
+};
+function databaseUnit(config) {
+  const db = config.database;
+  const join2 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
+  return `[Unit]
+Description=ForgeZero ArangoDB Community 3.11.14 cluster (${db.role})
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=arangodb
+Group=arangodb
+LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join2}
+Restart=always
+RestartSec=5
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/forgezero-cluster
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function databaseVerifyUnit(config) {
+  const { address } = config.database;
+  return `[Unit]
+Description=Verify ForgeZero ArangoDB Community 3.11.14 writable Coordinator
+Requires=forgezero-db.service
+After=forgezero-db.service
+PartOf=forgezero-db.service
+
+[Service]
+Type=oneshot
+User=arangodb
+Group=arangodb
+LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default")quit(0);last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+RemainAfterExit=yes
+TimeoutStartSec=200
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function tunnelUnit() {
+  return `[Unit]
+Description=ForgeZero Cloudflare Tunnel connector
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+LoadCredentialEncrypted=cloudflared-token:${TUNNEL_CREDENTIAL}
+ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate run --token-file %d/cloudflared-token
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+var derive = (root, label) => {
+  if (!/^[a-f0-9]{64}$/i.test(root))
+    throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
+  return createHmac("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
+};
+async function seal(host, name, destination, value) {
+  if (host.exists(destination))
+    return;
+  const result = await host.exec(["systemd-creds", "encrypt", `--name=${name}`, "-", destination], { stdin: value });
+  if (result.exitCode !== 0)
+    throw new Error(`could not seal ${name}: ${result.output.trim()}`);
+}
+function stateFor(config) {
+  return `${JSON.stringify({
+    format: 1,
+    kind: config.kind,
+    profile: config.kind === "platform" ? config.profile : config.profile ?? "tenant-managed",
+    nodeHostname: config.nodeHostname,
+    apiUrl: config.apiUrl,
+    ...config.kind === "platform" ? {
+      environment: config.environment,
+      databaseRole: config.database.role,
+      databaseServerMode: config.database.serverMode,
+      databaseAddress: config.database.address,
+      databaseCoordinators: config.database.coordinators,
+      databaseModeEvidence: config.database.role === "none" ? undefined : DB_MODE_EVIDENCE,
+      collectorUnit: config.runtime.environment.otlpCollectorUnit,
+      cloudflared: Boolean(config.cloudflareHandoff)
+    } : { realm: config.realm }
+  }, null, 2)}
+`;
+}
+async function bootstrapStatus(host = localBootstrapHost()) {
+  if (!host.exists(STATE_PATH))
+    return { initialized: false, services: {}, problems: ["bootstrap state is missing"] };
+  let state;
+  try {
+    state = JSON.parse(host.read(STATE_PATH));
+  } catch {
+    return { initialized: false, services: {}, problems: ["bootstrap state is malformed"] };
+  }
+  const units = ["forgezero-agent.service", "forgezero-agent.socket"];
+  if (state.kind === "platform")
+    units.push("nginx.service");
+  if (state.kind === "platform" && state.collectorUnit)
+    units.push(state.collectorUnit);
+  if (state.kind === "platform" && state.cloudflared)
+    units.push("cloudflared.service");
+  if (state.kind === "platform" && state.databaseRole !== "none")
+    units.push("forgezero-db.service", "forgezero-db-verify.service");
+  const services = {};
+  const problems = [];
+  for (const unit of units) {
+    const result = await host.exec(["systemctl", "is-active", "--quiet", unit]);
+    services[unit] = result.exitCode === 0;
+    if (result.exitCode !== 0)
+      problems.push(`${unit} is not active`);
+  }
+  if (state.kind === "platform") {
+    const [blue, green] = await Promise.all([
+      host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
+      host.exec(["systemctl", "is-active", "--quiet", "forgezero@green.service"])
+    ]);
+    services["forgezero@active.service"] = blue.exitCode === 0 || green.exitCode === 0;
+    if (!services["forgezero@active.service"])
+      problems.push("neither API slot is active");
+  }
+  if (!host.exists("/var/lib/forgezero/enrolment.json"))
+    problems.push("durable Agent enrolment state is missing");
+  return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
+}
+async function applyBootstrap(input, host = localBootstrapHost()) {
+  const config = validateBootstrapConfig(structuredClone(input));
+  if (host.uid() !== 0)
+    throw new Error("fz bootstrap --apply must run as root");
+  if (config.kind === "tenant") {
+    const token = privateFile(host, config.enrolTokenFile, "tenant enrolment token");
+    if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(token))
+      throw new Error("tenant enrolment token is malformed");
+  }
+  let cloudflare;
+  if (config.kind === "platform" && config.cloudflareHandoff) {
+    cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.checkpointFile, config.cloudflareHandoff.nodeName);
+    const expected = config.runtime.environment.cloudflare;
+    if (cloudflare.hostname !== config.nodeHostname)
+      throw new Error("Cloudflare checkpoint hostname disagrees with platform node hostname");
+    if (expected && (cloudflare.service !== expected.tunnelService || cloudflare.accountId !== expected.accountId || cloudflare.zoneId !== expected.zoneId || cloudflare.kvNamespaceId !== expected.kvNamespaceId || cloudflare.tunnelId !== expected.tunnelId)) {
+      throw new Error("Cloudflare checkpoint disagrees with immutable platform runtime coordinates");
+    }
+    const discovered = {
+      accountId: cloudflare.accountId,
+      zoneId: cloudflare.zoneId,
+      kvNamespaceId: cloudflare.kvNamespaceId,
+      tunnelId: cloudflare.tunnelId,
+      tunnelService: cloudflare.service,
+      ...cloudflare.warp ? { warp: {
+        organization: cloudflare.warp.organization,
+        virtualNetworkId: cloudflare.warp.virtualNetworkId,
+        deviceProfileId: cloudflare.warp.deviceProfileId
+      } } : {}
+    };
+    if (expected && JSON.stringify(expected) !== JSON.stringify(discovered)) {
+      throw new Error("Cloudflare checkpoint disagrees with immutable WARP/runtime coordinates");
+    }
+    config.runtime.environment.cloudflare = expected ?? discovered;
+    if (config.runtime.environment.databaseNetworkMode === "cloudflare-warp" !== Boolean(cloudflare.warp)) {
+      throw new Error("Cloudflare checkpoint private-network mode disagrees with the platform database network mode");
+    }
+  }
+  const plan = planBootstrap(config, host.exists(STATE_PATH));
+  const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
+  host.mkdir(CREDS, 448);
+  host.mkdir("/var/lib/forgezero", 448);
+  if (config.kind === "tenant" && config.bootstrapRunner && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
+    await seal(host, "bootstrap-ssh-key", BOOTSTRAP_SSH_CREDENTIAL, privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key"));
+    host.remove(config.bootstrapRunner.sshPrivateKeyFile);
+  }
+  if (cloudflare?.warp) {
+    await seal(host, "warp-auth-client-id", WARP_CLIENT_ID_CREDENTIAL, cloudflare.warp.clientId);
+    await seal(host, "warp-auth-client-secret", WARP_CLIENT_SECRET_CREDENTIAL, cloudflare.warp.clientSecret);
+  }
+  await host.installAgent(config, alreadyEnrolled && config.kind === "platform" ? PLATFORM_ENROL_SOURCE : undefined);
+  if (config.kind === "platform" && config.firewall.enabled) {
+    await host.ensureSoftware(plan.software.filter(({ id }) => id === "ufw"));
+  } else
+    await host.ensureSoftware(plan.software);
+  if (config.kind === "platform" && config.firewall.enabled) {
+    await checked(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
+    await checked(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
+    await checked(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
+    for (const cidr of config.firewall.privateCidrs) {
+      if (config.database.role !== "none")
+        await checked(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
+      for (const port of [config.runtime.bluePort, config.runtime.greenPort])
+        await checked(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
+    }
+    await checked(host, ["ufw", "--force", "enable"], "firewall activation");
+    await host.ensureSoftware(plan.software.filter(({ id }) => id !== "ufw"));
+  }
+  if (config.kind === "platform") {
+    const root = privateFile(host, config.database.bootstrapSecretFile, "database bootstrap secret");
+    if (!host.exists(JWT_CREDENTIAL)) {
+      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+    }
+    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+    const credentialFiles = config.runtime.credentialFiles ?? {};
+    for (const [name, source] of Object.entries({
+      "bootstrap-smtp-password": credentialFiles.smtpPassword,
+      "backup-s3-secret": credentialFiles.backupS3Secret
+    })) {
+      if (source) {
+        const destination = `${CREDS}/${name}.cred`;
+        if (!host.exists(destination)) {
+          await seal(host, name, destination, privateFile(host, source, name));
+          host.remove(source);
+        }
+      }
+    }
+    if (cloudflare) {
+      await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
+      if (cloudflare.privateNetworkRuntimeToken)
+        await seal(host, "cloudflare-network-token", `${CREDS}/cloudflare-network-token.cred`, cloudflare.privateNetworkRuntimeToken);
+    }
+    const runtime = config.runtime;
+    const envPath = `${runtime.environment.sharedDirectory}/.env`;
+    const credentials = platformApiCredentialSpecs({
+      smtp: Boolean(credentialFiles.smtpPassword),
+      cloudflareKv: Boolean(cloudflare),
+      cloudflareNetwork: Boolean(cloudflare?.privateNetworkRuntimeToken)
+    });
+    const units = renderPlatformApiUnits({
+      serviceUser: runtime.serviceUser,
+      sharedDirectory: runtime.environment.sharedDirectory,
+      sharedEnvironmentFile: envPath,
+      slotsDirectory: runtime.slotsDirectory,
+      bluePort: runtime.bluePort,
+      greenPort: runtime.greenPort,
+      collectorUnit: runtime.environment.otlpCollectorUnit,
+      credentials
+    });
+    const edge = renderPlatformNginx({ publicPort: runtime.environment.publicApiPort, initialSlotPort: runtime.bluePort });
+    const activation = renderPlatformActivationFiles({
+      root: config.deployRoot ?? "/opt/forgezero",
+      serviceUser: runtime.serviceUser,
+      bluePort: runtime.bluePort,
+      greenPort: runtime.greenPort,
+      healthPath: runtime.healthPath,
+      keepReleases: runtime.keepReleases
+    });
+    await checked(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
+      await checked(host, ["id", runtime.serviceUser], "existing API service account");
+    });
+    host.mkdir(runtime.environment.sharedDirectory, 488);
+    host.mkdir(runtime.slotsDirectory, 493);
+    host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
+    await checked(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
+    host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
+    host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
+    host.write("/etc/systemd/system/forgezero@green.service.d/port.conf", units.dropIns.green, 420);
+    host.write("/etc/nginx/conf.d/forgezero-upstream.conf", edge.upstream, 420);
+    host.write("/etc/nginx/conf.d/forgezero.conf", edge.site, 420);
+    host.write("/etc/forgezero/deploy.env", activation.environment, 420);
+    host.write("/usr/local/libexec/forgezero-activate", activation.helper, 493);
+    host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
+    await checked(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
+    const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
+    await checked(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    const otlpStatus = (await checked(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
+    if (!/^2\d\d$/.test(otlpStatus))
+      throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
+    await checked(host, ["nginx", "-t"], "nginx configuration");
+    await checked(host, ["systemctl", "daemon-reload"], "systemd reload");
+    await checked(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (config.database.role === "master") {
+      const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
+      if (!host.exists(invite)) {
+        host.write(invite, `plt_${randomBytes(24).toString("hex")}
+`, 384);
+        await checked(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
+      }
+    }
+    if (config.database.role !== "none") {
+      host.mkdir("/var/lib/forgezero-cluster", 448);
+      await checked(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
+      host.write("/etc/systemd/system/forgezero-db.service", databaseUnit(config), 420);
+      host.write("/etc/systemd/system/forgezero-db-verify.service", databaseVerifyUnit(config), 420);
+      await checked(host, ["systemctl", "daemon-reload"], "database unit reload");
+      await checked(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
+      const evidence = {
+        expectedMode: "default",
+        role: "COORDINATOR",
+        unit: "forgezero-db-verify.service",
+        verifiedAt: new Date().toISOString()
+      };
+      host.write(DB_MODE_EVIDENCE, `${JSON.stringify(evidence, null, 2)}
+`, 384);
+    }
+    if (!alreadyEnrolled) {
+      const enrolToken = config.platformEnrolTokenFile ? privateFile(host, config.platformEnrolTokenFile, "platform enrolment token") : `fze_${derive(derive(root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}`;
+      if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolToken))
+        throw new Error("platform enrolment token is malformed");
+      host.write(PLATFORM_ENROL_SOURCE, `${enrolToken}
+`, 384);
+    }
+    await checked(host, [
+      "runuser",
+      "-u",
+      "forgezero-agent",
+      "--",
+      "/usr/local/bin/fz-agent",
+      "deploy",
+      ...config.database.role === "master" ? ["--release-executor"] : []
+    ], "initial Agent deployment");
+    if (!alreadyEnrolled) {
+      await host.installAgent(config, PLATFORM_ENROL_SOURCE);
+      if (config.platformEnrolTokenFile)
+        host.remove(config.platformEnrolTokenFile);
+    }
+  }
+  if (config.kind === "platform" && cloudflare) {
+    if (!host.exists(TUNNEL_CREDENTIAL)) {
+      await seal(host, "cloudflared-token", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
+    }
+    host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
+    await checked(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
+    await checked(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
+  }
+  host.write(STATE_PATH, stateFor(config), 384);
+  const status = await bootstrapStatus(host);
+  if (!status.initialized)
+    throw new Error(`bootstrap verification failed: ${status.problems.join("; ")}`);
+  let launch;
+  if (config.kind === "platform" && config.database.role === "master") {
+    const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
+    if (!host.exists(invitePath))
+      throw new Error("platform invite is missing after deployment");
+    const token = host.read(invitePath).trim();
+    if (!/^plt_[a-f0-9]{48}$/.test(token))
+      throw new Error("platform invite is malformed");
+    launch = {
+      command: `sudo -u ${shellQuote(config.runtime.serviceUser)} env FZ_SHARED_DIR=${shellQuote(config.runtime.environment.sharedDirectory)} /usr/local/bin/fz genesis --mode 2-of-3 --api ${shellQuote(config.apiUrl)} --app ${shellQuote(config.runtime.environment.appOrigin)}`,
+      inviteUrl: `${config.runtime.environment.appOrigin}/invite?token=${encodeURIComponent(token)}`
+    };
+  }
+  return { plan, applied: true, status, ...launch ? { launch } : {} };
+}
+var exactKeys = (value, allowed, label) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  const record = value;
+  const unknown = Object.keys(record).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`${label} contains unknown fields: ${unknown.join(", ")}`);
+  return record;
+};
+function strictBootstrapDocument(value) {
+  const root = exactKeys(value, [
+    "kind",
+    "environment",
+    "profile",
+    "computeReference",
+    "nodeHostname",
+    "apiUrl",
+    "repository",
+    "branch",
+    "deployRoot",
+    "telemetryEndpoint",
+    "database",
+    "platformEnrolTokenFile",
+    "runtime",
+    "firewall",
+    "installCloudflared",
+    "cloudflareHandoff",
+    "realm",
+    "enrolTokenFile",
+    "software",
+    "bootstrapRunner"
+  ], "bootstrap config");
+  if (root.kind === "platform") {
+    exactKeys(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
+    if (root.cloudflareHandoff !== undefined)
+      exactKeys(root.cloudflareHandoff, ["checkpointFile", "nodeName"], "Cloudflare handoff");
+    exactKeys(root.database, ["role", "serverMode", "address", "master", "coordinators", "bootstrapSecretFile"], "database config");
+    const runtime = exactKeys(root.runtime, [
+      "environment",
+      "serviceUser",
+      "slotsDirectory",
+      "bluePort",
+      "greenPort",
+      "healthPath",
+      "keepReleases",
+      "credentialFiles"
+    ], "runtime config");
+    exactKeys(runtime.environment, [
+      "softwareProfile",
+      "databaseRole",
+      "databaseCoordinators",
+      "databaseAddress",
+      "databaseMaster",
+      "databaseNetworkMode",
+      "databaseReplicationFactor",
+      "databaseWriteConcern",
+      "nodeHostname",
+      "nodeRegion",
+      "databaseUser",
+      "nodeRole",
+      "appOrigin",
+      "apiOrigin",
+      "publicApiPort",
+      "sharedDirectory",
+      "seedSyncPeers",
+      "seedSyncMembers",
+      "seedSyncEpoch",
+      "concurrencyLimit",
+      "drainDeadlineMs",
+      "otlpEndpoint",
+      "otlpCollectorUnit",
+      "agentOtlpEndpoint",
+      "custodianEmail",
+      "smtp",
+      "repository",
+      "branch",
+      "deployProfile",
+      "otlpFlushIntervalMs",
+      "otlpTraceSampleRatio",
+      "backup",
+      "cloudflare"
+    ], "runtime environment");
+    if (runtime.credentialFiles !== undefined)
+      exactKeys(runtime.credentialFiles, ["smtpPassword", "backupS3Secret"], "runtime credential files");
+    const environment = runtime.environment;
+    if (environment.smtp !== undefined)
+      exactKeys(environment.smtp, ["host", "port", "user", "from"], "SMTP config");
+    if (environment.backup !== undefined)
+      exactKeys(environment.backup, ["endpoint", "region", "bucket", "accessKeyId"], "backup config");
+    if (environment.cloudflare !== undefined)
+      exactKeys(environment.cloudflare, ["accountId", "zoneId", "kvNamespaceId", "tunnelId", "tunnelService", "warp"], "Cloudflare runtime config");
+    if (environment.cloudflare && typeof environment.cloudflare === "object" && environment.cloudflare.warp !== undefined) {
+      exactKeys(environment.cloudflare.warp, ["organization", "virtualNetworkId", "deviceProfileId"], "Cloudflare WARP runtime config");
+    }
+  } else if (root.kind === "tenant") {
+    if (root.bootstrapRunner !== undefined)
+      exactKeys(root.bootstrapRunner, ["sshPrivateKeyFile", "targetTelemetryEndpoint"], "bootstrap runner config");
+    for (const key of ["environment", "profile", "computeReference", "database", "platformEnrolTokenFile", "runtime", "cloudflareHandoff"]) {
+      if (root[key] !== undefined && key !== "profile")
+        throw new Error(`tenant bootstrap cannot contain ${key}`);
+    }
+  } else
+    throw new Error("bootstrap config kind must be platform or tenant");
+  return value;
+}
+function readBootstrapConfig(path) {
+  const metadata = lstatSync(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
+    throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
+  }
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync(path, "utf8"))));
+}
+function localBootstrapHost() {
+  const execute = async (argv, options = {}) => {
+    const child = Bun.spawn([...argv], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
+    if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
+      child.stdin.write(options.stdin);
+      child.stdin.end();
+    }
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  };
+  return {
+    uid: () => process.getuid?.() ?? -1,
+    exists: existsSync,
+    read: (path) => readFileSync(path, "utf8"),
+    write(path, content, mode) {
+      mkdirSync(dirname2(path), { recursive: true, mode: 493 });
+      const temporary = `${path}.next.${process.pid}`;
+      writeFileSync(temporary, content, { mode });
+      chmodSync(temporary, mode);
+      renameSync(temporary, path);
+    },
+    mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
+    remove: (path) => rmSync(path, { force: true }),
+    inspect(path) {
+      const value = lstatSync(path);
+      return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
+    },
+    exec: execute,
+    async ensureSoftware(requirements) {
+      const result = await execute([
+        "runuser",
+        "-u",
+        "forgezero-agent",
+        "--",
+        "/usr/local/bin/fz-agent",
+        "software-ensure",
+        ...requirements.map(({ id, version }) => `--require=${id}@${version}`)
+      ]);
+      if (result.exitCode !== 0)
+        throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
+      return result;
+    },
+    async installAgent(config, enrolTokenSourcePath) {
+      const capabilities = await readCapabilities(localRunner);
+      const deployRoot = config.deployRoot ?? "/opt/forgezero";
+      if (config.kind === "platform") {
+        const lifecycle = config.database.role === "none" ? {
+          apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
+          apiHealthUrl: "http://127.0.0.1:3000/api/health"
+        } : {
+          apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
+          databaseUnit: "forgezero-db.service",
+          apiHealthUrl: "http://127.0.0.1:3000/api/health",
+          databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
+          databasePorts: [8529]
+        };
+        mkdirSync(dirname2(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+`, { mode: 256 });
+      }
+      const plan = planInstall({
+        capabilities,
+        socketPath: DEFAULT_SOCKET2,
+        seedPath: "/var/lib/forgezero/node.seed",
+        controlSocketPath: "/run/forgezero/control.sock",
+        repository: config.repository,
+        branch: config.branch,
+        profile: config.kind === "platform" ? config.profile : config.profile,
+        deployRoot,
+        publicApiUrl: config.apiUrl,
+        gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
+        gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
+        generateGitIdentity: true,
+        pullDeployments: true,
+        pullMigrations: config.kind === "platform",
+        pullBootstrap: config.kind === "tenant" && Boolean(config.bootstrapRunner),
+        bootstrapSshCredentialPath: config.kind === "tenant" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+        bootstrapTargetTelemetryEndpoint: config.kind === "tenant" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
+        lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
+        ...config.kind === "platform" && config.runtime.environment.cloudflare?.warp ? {
+          warpOrganization: config.runtime.environment.cloudflare.warp.organization,
+          warpClientIdCredentialPath: WARP_CLIENT_ID_CREDENTIAL,
+          warpClientSecretCredentialPath: WARP_CLIENT_SECRET_CREDENTIAL,
+          cloudflareAccountId: config.runtime.environment.cloudflare.accountId,
+          cloudflareTunnelId: config.runtime.environment.cloudflare.tunnelId,
+          cloudflareVirtualNetworkId: config.runtime.environment.cloudflare.warp.virtualNetworkId,
+          cloudflareWarpPolicyId: config.runtime.environment.cloudflare.warp.deviceProfileId
+        } : {},
+        enforceEgress: true,
+        nodeHostname: config.nodeHostname,
+        telemetryEndpoint: config.telemetryEndpoint,
+        binPath: "/usr/local/lib/forgezero/agent/fz-agent",
+        sourceBinPath: PACKAGED_AGENT_BIN,
+        ...config.kind === "tenant" || enrolTokenSourcePath ? {
+          enrolTokenSourcePath: config.kind === "tenant" ? config.enrolTokenFile : enrolTokenSourcePath,
+          enrolTokenCredentialPath: ENROL_CREDENTIAL,
+          enrolStatePath: "/var/lib/forgezero/enrolment.json",
+          apiUrl: config.apiUrl,
+          project: config.kind === "tenant" ? config.realm : "platform",
+          environment: config.kind === "tenant" ? undefined : config.environment,
+          nodeLabel: config.kind === "tenant" ? config.nodeHostname : config.computeReference
+        } : {}
+      });
+      for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
+        mkdirSync(dirname2(unit.path), { recursive: true, mode: 493 });
+        writeFileSync(unit.path, unit.unit, { mode: 420 });
+      }
+      await applyPlan(plan, localRunner);
+      return plan;
+    }
+  };
+}
+export {
+  validateBootstrapConfig,
+  readBootstrapConfig,
+  planBootstrap,
+  localBootstrapHost,
+  bootstrapStatus,
+  applyBootstrap,
+  PLATFORM_BOOTSTRAP_PROFILES
+};