@forgezero/agent 0.1.34 → 0.1.36

package/dist/cloudflare-bootstrap.js

@@ -0,0 +1,1196 @@
+// @bun
+// src/cloudflare-edge.ts
+import { isIP } from "net";
+function isPrivateDatabaseAddress(value) {
+  const address = value.trim().toLowerCase();
+  const family = isIP(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    return Number.isFinite(first) && (first & 65024) === 64512;
+  }
+  return false;
+}
+function privateDatabaseHostRoute(value) {
+  const address = value.trim().toLowerCase();
+  if (!isPrivateDatabaseAddress(address)) {
+    throw new Error("database address must be an RFC 1918 IPv4 or unique-local IPv6 address");
+  }
+  return `${address}/${isIP(address) === 4 ? 32 : 128}`;
+}
+var endpoint = "https://api.cloudflare.com/client/v4";
+async function cf(config, path, init = {}, fetcher = fetch) {
+  const response = await fetcher(`${endpoint}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${config.apiToken}`,
+      "content-type": "application/json",
+      ...init.headers
+    }
+  });
+  const body = await response.json();
+  if (!response.ok || body.success !== true) {
+    throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
+  }
+  return body.result;
+}
+async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (current) {
+    if (current.tunnel_id !== config.tunnelId) {
+      throw new Error(`private route ${config.network} already belongs to another Tunnel`);
+    }
+    return { route: current, created: false };
+  }
+  const route = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({
+      network: config.network,
+      tunnel_id: config.tunnelId,
+      comment: config.comment.slice(0, 100),
+      ...config.virtualNetworkId ? { virtual_network_id: config.virtualNetworkId } : {}
+    })
+  }, fetcher);
+  return { route, created: true };
+}
+async function ensureCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return ensureCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function removeCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route) => !route.deleted_at && route.network === config.network && (route.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (!current)
+    return { removed: false };
+  if (current.tunnel_id !== config.tunnelId) {
+    throw new Error(`private route ${config.network} belongs to another Tunnel`);
+  }
+  await cf(config, `${path}/${encodeURIComponent(current.id)}`, { method: "DELETE" }, fetcher);
+  return { removed: true, route: current };
+}
+async function removeCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return removeCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function ensureCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  if (entries.some((entry) => entry.address === route))
+    return { entries, created: false };
+  const next = [...entries, { address: route, description: config.description.slice(0, 100) }];
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, created: true };
+}
+async function removeCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  const next = entries.filter((entry) => entry.address !== route);
+  if (next.length === entries.length)
+    return { entries, removed: false };
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, removed: true };
+}
+async function configureCloudflareEdge(config, fetcher = fetch) {
+  const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
+  const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
+  const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
+  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  await cf(tunnelAuth, tunnelPath, {
+    method: "PUT",
+    body: JSON.stringify({ config: { ingress: [
+      { hostname: config.hostname, service: config.service },
+      ...otherHosts,
+      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+    ] } })
+  }, fetcher);
+  const dnsPath = `/zones/${config.zoneId}/dns_records`;
+  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  if (records.length > 1) {
+    throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
+  }
+  const record = {
+    type: "CNAME",
+    name: config.hostname,
+    content: `${config.tunnelId}.cfargotunnel.com`,
+    proxied: true,
+    ttl: 1
+  };
+  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
+    method: records[0] ? "PUT" : "POST",
+    body: JSON.stringify(record)
+  }, fetcher);
+}
+var exactAccountPermissionGroup = async (config, name, fetcher) => {
+  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
+  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
+  if (matches.length !== 1) {
+    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
+  }
+  return { id: matches[0].id, name };
+};
+async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
+    throw new Error("Cloudflare account id is invalid");
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
+    throw new Error("Cloudflare account runtime-token name is invalid");
+  }
+  const permissionNames = [...new Set(config.permissionNames)];
+  if (permissionNames.length === 0)
+    throw new Error("Cloudflare account runtime token needs a permission group");
+  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
+  const body = {
+    name,
+    policies: [{
+      effect: "allow",
+      permission_groups: permissionGroups.map(({ id }) => ({ id })),
+      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
+    }]
+  };
+  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
+  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
+    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
+  }
+  return { id: created.id, value: created.value, name, permissionNames };
+}
+async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Access service-token name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/service_tokens`;
+  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = tokens.filter((token) => token.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
+  if (matches[0]) {
+    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
+      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
+    }
+    return { credentials: config.existing, created: false };
+  }
+  const created = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
+  }, fetcher);
+  if (!created.id || !created.client_id || !created.client_secret) {
+    throw new Error("Cloudflare did not return the new Access service-token secret");
+  }
+  return {
+    credentials: {
+      tokenId: created.id,
+      clientId: created.client_id,
+      clientSecret: created.client_secret
+    },
+    created: true
+  };
+}
+async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/policies`;
+  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === config.name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
+  const desired = {
+    name: config.name,
+    decision: "non_identity",
+    include: [{ service_token: { token_id: config.serviceTokenId } }]
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
+    method: matches[0] ? "PUT" : "POST",
+    body: JSON.stringify(desired)
+  }, fetcher);
+  return { policy, created: !matches[0] };
+}
+async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
+  const desired = {
+    name: config.name,
+    type: "self_hosted",
+    domain: config.hostname,
+    session_duration: "24h",
+    service_auth_401_redirect: true,
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare WARP enrollment application name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
+  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
+    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
+  }
+  const desired = {
+    name,
+    type: "warp",
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!application.id || application.type && application.type !== "warp") {
+    throw new Error("Cloudflare did not return the WARP enrollment application");
+  }
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare VNET name is invalid");
+  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
+  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
+  if (matches[0])
+    return { virtualNetwork: matches[0], created: false };
+  const virtualNetwork = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
+  }, fetcher);
+  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
+    throw new Error("Cloudflare did not return the VNET id");
+  }
+  return { virtualNetwork, created: true };
+}
+async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare WARP device profile name is invalid");
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
+    throw new Error("Cloudflare service-token id is invalid");
+  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
+    throw new Error("Cloudflare VNET id is invalid");
+  const precedence = config.precedence ?? 100;
+  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
+    throw new Error("Cloudflare WARP device profile precedence is invalid");
+  }
+  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
+  const listPath = `/accounts/${config.accountId}/devices/policies`;
+  const path = `/accounts/${config.accountId}/devices/policy`;
+  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
+  if (matches[0]?.match && matches[0].match !== match) {
+    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
+  }
+  const desired = {
+    name,
+    match,
+    precedence,
+    description: "ForgeZero non-interactive compute enrollment",
+    enabled: true,
+    allow_mode_switch: false,
+    allowed_to_leave: false,
+    auto_connect: 0,
+    switch_locked: true,
+    service_mode_v2: { mode: "warp" },
+    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!policy.id)
+    throw new Error("Cloudflare did not return the WARP device profile id");
+  return { policy, created: !matches[0] };
+}
+async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
+    throw new Error("Cloudflare Worker script name is invalid");
+  }
+  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      secrets: {
+        CF_ACCESS_CLIENT_ID: {
+          name: "CF_ACCESS_CLIENT_ID",
+          type: "secret_text",
+          text: config.credentials.clientId
+        },
+        CF_ACCESS_CLIENT_SECRET: {
+          name: "CF_ACCESS_CLIENT_SECRET",
+          type: "secret_text",
+          text: config.credentials.clientSecret
+        }
+      }
+    })
+  }, fetcher);
+}
+async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
+  const title = config.title.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
+  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = namespaces.filter((namespace2) => namespace2.title === title);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
+  if (matches[0])
+    return { namespace: matches[0], created: false };
+  const namespace = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ title })
+  }, fetcher);
+  return { namespace, created: true };
+}
+async function ensureCloudflareTunnel(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Tunnel name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/cfd_tunnel`;
+  const tunnels = await cf(config, `${path}?is_deleted=false&name=${encodeURIComponent(name)}&per_page=1000`, {}, fetcher);
+  const matches = tunnels.filter((tunnel2) => tunnel2.name === name && !tunnel2.deleted_at);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Tunnel ${name} is ambiguous`);
+  const created = !matches[0];
+  const tunnel = matches[0] ?? await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, config_src: "cloudflare" })
+  }, fetcher);
+  const connectorToken = await cf(config, `${path}/${encodeURIComponent(tunnel.id)}/token`, {}, fetcher);
+  if (!connectorToken || connectorToken.length > 16384) {
+    throw new Error("Cloudflare returned an invalid Tunnel connector token");
+  }
+  return { tunnel, connectorToken, created };
+}
+
+// src/cloudflare-bootstrap.ts
+import { constants } from "fs";
+import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
+import { dirname, join, resolve } from "path";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
+import { isIP as isIP2 } from "net";
+var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
+async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
+  const metadata = await handle.stat();
+  if (!metadata.isFile())
+    throw new Error(`${path} must be a regular file`);
+  if (metadata.nlink !== 1)
+    throw new Error(`${path} must not have multiple hard links`);
+  const uid = ownerUid();
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+    throw new Error(`${path} must be owned by the current operator`);
+  if ((metadata.mode & 63) !== 0)
+    throw new Error(`${path} must not be accessible by group or other users`);
+  if ((metadata.mode & 256) === 0)
+    throw new Error(`${path} must be readable by its owner`);
+  if (metadata.size < 1 || metadata.size > maximumBytes)
+    throw new Error(`${path} has an invalid size`);
+}
+async function readOwnerOnlyFile(path, maximumBytes) {
+  const absolute = resolve(path);
+  let handle;
+  try {
+    handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+    await assertOwnerOnlyHandle(absolute, handle, maximumBytes);
+    return await handle.readFile({ encoding: "utf8" });
+  } catch (cause) {
+    if (cause instanceof Error && cause.message.startsWith(absolute))
+      throw cause;
+    throw new Error(`cannot securely read owner-only file ${absolute}`);
+  } finally {
+    await handle?.close();
+  }
+}
+async function readOwnerApiToken(path) {
+  const token = (await readOwnerOnlyFile(path, 4096)).trim();
+  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+    throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
+  }
+  return token;
+}
+async function readCloudflareBootstrapTokens(files) {
+  const entries = await Promise.all([
+    ["apiToken", files.apiTokenFile],
+    ["tunnelApiToken", files.tunnelApiTokenFile],
+    ["dnsApiToken", files.dnsApiTokenFile],
+    ["kvApiToken", files.kvApiTokenFile],
+    ["accessApiToken", files.accessApiTokenFile],
+    ["workerApiToken", files.workerApiTokenFile]
+  ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
+  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const unified = tokens.apiToken;
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
+    if (!tokens[key] && !unified)
+      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  }
+  return tokens;
+}
+var validateId = (value, label) => {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[a-f0-9]{32}$/.test(normalized))
+    throw new Error(`${label} must be a 32-character hexadecimal id`);
+  return normalized;
+};
+var validateName = (value, label, maximum, allowSpaces = true) => {
+  const normalized = value.trim();
+  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+    throw new Error(`${label} is invalid`);
+  }
+  return normalized;
+};
+var privateAddress = (value) => {
+  const address = value.trim().toLowerCase();
+  const family = isIP2(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
+      return address;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    if (Number.isFinite(first) && (first & 65024) === 64512)
+      return address;
+  }
+  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+};
+function validateCloudflareBootstrapCoordinates(input) {
+  const nodeInputs = input.nodes?.length ? input.nodes : [{
+    nodeName: input.tunnelName,
+    hostname: input.hostname,
+    service: input.service,
+    tunnelName: input.tunnelName,
+    applicationName: input.applicationName
+  }];
+  if (nodeInputs.length < 1 || nodeInputs.length > 32) {
+    throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
+  }
+  const nodes = nodeInputs.map((node) => {
+    const nodeName = node.nodeName.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
+      throw new Error("Cloudflare node name is invalid");
+    const hostname = node.hostname.trim().toLowerCase();
+    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+      throw new Error("Cloudflare public node hostname is invalid");
+    }
+    const serviceUrl = new URL(node.service);
+    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
+      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
+    }
+    return {
+      nodeName,
+      hostname,
+      service: serviceUrl.toString().replace(/\/$/, ""),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
+      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
+      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+    };
+  });
+  for (const [label, values] of [
+    ["node name", nodes.map(({ nodeName }) => nodeName)],
+    ["hostname", nodes.map(({ hostname }) => hostname)],
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
+    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+  ]) {
+    if (new Set(values).size !== values.length)
+      throw new Error(`Cloudflare fleet ${label} must be unique`);
+  }
+  const first = nodes[0];
+  const workerScriptName = input.workerScriptName.trim();
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
+    throw new Error("Cloudflare Worker script name is invalid");
+  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
+  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
+    throw new Error("Cloudflare Worker compatibility date is invalid");
+  }
+  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
+  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
+    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
+  }
+  const workerDirectory = resolve(input.workerDirectory);
+  const workerMain = input.workerMain.trim();
+  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
+    throw new Error("Cloudflare Worker main must be a project-relative path");
+  }
+  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
+    throw new Error("Cloudflare runtime-token name prefix is invalid");
+  }
+  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
+    throw new Error("private-network runtime token requires runtime-token creation");
+  }
+  const privateNetwork = input.privateNetwork ? {
+    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
+    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
+    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
+    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
+    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
+  } : undefined;
+  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
+    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
+  }
+  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
+    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
+  }
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    hostname: first.hostname,
+    service: first.service,
+    tunnelName: first.tunnelName,
+    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
+    workerScriptName,
+    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
+    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
+    applicationName: first.applicationName,
+    workerDirectory,
+    workerMain,
+    workerCompatibilityDate,
+    publicDomains,
+    createRuntimeTokens: input.createRuntimeTokens,
+    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
+    runtimeTokenNamePrefix,
+    nodes,
+    ...privateNetwork ? { privateNetwork } : {}
+  };
+}
+function planCloudflareBootstrap(input, outputPath) {
+  const coordinates = validateCloudflareBootstrapCoordinates(input);
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-plan",
+    mode: "attended-token-file",
+    outputFile: resolve(outputPath),
+    coordinates,
+    operations: [
+      "create or reuse one Workers KV namespace",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      ...coordinates.createRuntimeTokens ? [
+        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
+      ] : [],
+      "deploy the shared Worker once with the created NODES binding and stable custom domains",
+      "create or reuse one shared Access service token/policy and one self-hosted application per node",
+      ...coordinates.privateNetwork ? [
+        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
+      ] : [],
+      "write the Access client id and secret to the existing Worker as encrypted secrets",
+      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+    ],
+    secrets: [
+      "API tokens are read only from owner-only files and are never written to output",
+      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
+      "the normal API process does not receive or import the management token files"
+    ]
+  };
+}
+var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
+  const child = Bun.spawn([...command], {
+    cwd,
+    env: { ...env },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text()
+  ]);
+  return { exitCode, stdout, stderr };
+};
+var inheritedWorkerEnvironment = () => {
+  const allowed = [
+    "PATH",
+    "HOME",
+    "TMPDIR",
+    "XDG_CONFIG_HOME",
+    "XDG_CACHE_HOME",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NODE_EXTRA_CA_CERTS",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NO_PROXY"
+  ];
+  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+};
+var redact = (text, secrets) => {
+  let safe = text.slice(0, 4096);
+  for (const secret of secrets)
+    if (secret)
+      safe = safe.split(secret).join("[REDACTED]");
+  return safe.trim();
+};
+async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
+  const validated = validateCloudflareBootstrapCoordinates(coordinates);
+  const workerDirectoryMetadata = await stat(validated.workerDirectory);
+  if (!workerDirectoryMetadata.isDirectory())
+    throw new Error("Cloudflare Worker directory is not a directory");
+  const workerMain = resolve(validated.workerDirectory, validated.workerMain);
+  const workerMainMetadata = await stat(workerMain);
+  if (!workerMainMetadata.isFile())
+    throw new Error("Cloudflare Worker main is not a regular file");
+  const wrangler = resolve(validated.workerDirectory, "node_modules/.bin/wrangler");
+  const wranglerMetadata = await stat(wrangler);
+  if (!wranglerMetadata.isFile())
+    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
+  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
+    throw new Error("Cloudflare KV namespace id is invalid");
+  const temporaryDirectory = await mkdtemp(join(tmpdir(), "fz-wrangler-"));
+  await chmod(temporaryDirectory, 448);
+  const configurationPath = join(temporaryDirectory, "wrangler.json");
+  try {
+    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({
+        name: validated.workerScriptName,
+        main: workerMain,
+        compatibility_date: validated.workerCompatibilityDate,
+        workers_dev: false,
+        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
+        observability: { enabled: true },
+        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
+      }, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const result = await runner({
+      command: [wrangler, "deploy", "--config", configurationPath],
+      cwd: validated.workerDirectory,
+      env: {
+        ...inheritedWorkerEnvironment(),
+        XDG_CONFIG_HOME: temporaryDirectory,
+        XDG_CACHE_HOME: temporaryDirectory,
+        WRANGLER_LOG_PATH: join(temporaryDirectory, "wrangler.log"),
+        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
+        CLOUDFLARE_API_TOKEN: apiToken,
+        WRANGLER_SEND_METRICS: "false"
+      }
+    });
+    if (result.exitCode !== 0) {
+      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
+      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
+    }
+  } finally {
+    await rm(temporaryDirectory, { recursive: true, force: true });
+  }
+}
+async function readExistingOutput(path) {
+  try {
+    await lstat(path);
+  } catch (cause) {
+    if (cause.code === "ENOENT")
+      return;
+    throw cause;
+  }
+  const text = await readOwnerOnlyFile(path, 1048576);
+  let output;
+  try {
+    output = JSON.parse(text);
+  } catch {
+    throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+  }
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
+    throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
+  }
+  return output;
+}
+async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
+  const output = await readExistingOutput(resolve(checkpointPath));
+  if (!output || output.phase !== "complete") {
+    throw new Error("Cloudflare connector handoff requires a completed bootstrap checkpoint");
+  }
+  const normalizedNodeName = nodeName.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalizedNodeName)) {
+    throw new Error("Cloudflare connector handoff node name is invalid");
+  }
+  const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
+  const expected = coordinates.nodes.find((node) => node.nodeName === normalizedNodeName);
+  const matches = output.resources.nodes?.filter((node) => node.nodeName === normalizedNodeName) ?? [];
+  if (!expected || matches.length !== 1) {
+    throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
+  }
+  const resource = matches[0];
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !resource.applicationId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(resource.tunnelId) || !/^[A-Za-z0-9._-]{40,16384}$/.test(resource.connectorToken)) {
+    throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
+  }
+  return {
+    nodeName: resource.nodeName,
+    hostname: resource.hostname,
+    service: resource.service,
+    tunnelId: resource.tunnelId,
+    connectorToken: resource.connectorToken
+  };
+}
+async function readCloudflareHostHandoff(checkpointPath, nodeName) {
+  const connector = await readCloudflareConnectorHandoff(checkpointPath, nodeName);
+  const output = await readExistingOutput(resolve(checkpointPath));
+  const kv = output?.resources.runtimeTokens?.kv;
+  if (!output || output.phase !== "complete" || !/^[a-f0-9]{32}$/i.test(output.coordinates.accountId) || !/^[a-f0-9]{32}$/i.test(output.coordinates.zoneId) || !/^[a-f0-9]{32}$/i.test(output.resources.kvNamespaceId) || !kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv.value)) {
+    throw new Error("Cloudflare host handoff is missing the exact-account KV runtime capability");
+  }
+  const network = output.resources.runtimeTokens?.privateNetwork?.value;
+  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+    throw new Error("Cloudflare host handoff private-network capability is malformed");
+  }
+  const privateNetwork = output.resources.privateNetwork;
+  const access = output.resources.access;
+  if (Boolean(privateNetwork) !== Boolean(network)) {
+    throw new Error("Cloudflare host handoff private-network resources and capability disagree");
+  }
+  if (privateNetwork && (!access?.clientId || !access.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(privateNetwork.warpOrganization) || !/^[0-9a-f-]{36}$/i.test(privateNetwork.virtualNetworkId) || !privateNetwork.deviceProfileId)) {
+    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
+  }
+  return {
+    ...connector,
+    accountId: output.coordinates.accountId,
+    zoneId: output.coordinates.zoneId,
+    kvNamespaceId: output.resources.kvNamespaceId,
+    kvRuntimeToken: kv.value,
+    ...network ? { privateNetworkRuntimeToken: network } : {},
+    ...privateNetwork && access ? { warp: {
+      organization: privateNetwork.warpOrganization,
+      clientId: access.clientId,
+      clientSecret: access.clientSecret,
+      virtualNetworkId: privateNetwork.virtualNetworkId,
+      deviceProfileId: privateNetwork.deviceProfileId
+    } } : {}
+  };
+}
+async function prepareOwnerOutputDirectory(absolutePath) {
+  const directory = dirname(absolutePath);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const directoryMetadata = await stat(directory);
+  const uid = ownerUid();
+  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+    throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
+  }
+  return directory;
+}
+async function writeOwnerBootstrapOutput(path, output) {
+  const absolute = resolve(path);
+  const directory = await prepareOwnerOutputDirectory(absolute);
+  const temporary = `${absolute}.${randomUUID()}.tmp`;
+  let handle;
+  try {
+    handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    await handle.writeFile(`${JSON.stringify(output, null, 2)}
+`, { encoding: "utf8" });
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await rename(temporary, absolute);
+    await chmod(absolute, 384);
+    const directoryHandle = await open(directory, constants.O_RDONLY);
+    try {
+      await directoryHandle.sync();
+    } finally {
+      await directoryHandle.close();
+    }
+  } finally {
+    await handle?.close();
+    await unlink(temporary).catch((cause) => {
+      if (cause.code !== "ENOENT")
+        throw cause;
+    });
+  }
+}
+var tokenFor = (tokens, key) => {
+  const token = tokens[key]?.trim() || tokens.apiToken?.trim();
+  if (!token)
+    throw new Error(`Cloudflare ${key} is not configured`);
+  return token;
+};
+var initialManagementToken = (tokens) => {
+  const token = tokens.apiToken?.trim();
+  if (!token) {
+    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
+  }
+  return token;
+};
+var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+  const coordinates = validateCloudflareBootstrapCoordinates(input);
+  const absoluteOutput = resolve(outputPath);
+  const existing = await readExistingOutput(absoluteOutput);
+  if (existing && !sameCoordinates(existing.coordinates, coordinates)) {
+    throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
+  }
+  await prepareOwnerOutputDirectory(absoluteOutput);
+  const namespace = await ensureCloudflareKvNamespace({
+    accountId: coordinates.accountId,
+    title: coordinates.kvNamespaceTitle,
+    apiToken: tokenFor(tokens, "kvApiToken")
+  }, fetcher);
+  const nodeResources = [];
+  const createdNodes = [];
+  let resources;
+  for (const node of coordinates.nodes) {
+    const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let created = false;
+    if (checkpointed) {
+      nodeResources.push(checkpointed);
+    } else {
+      const tunnel = await ensureCloudflareTunnel({
+        accountId: coordinates.accountId,
+        name: node.tunnelName,
+        apiToken: tokenFor(tokens, "tunnelApiToken")
+      }, fetcher);
+      created = tunnel.created;
+      nodeResources.push({
+        nodeName: node.nodeName,
+        hostname: node.hostname,
+        service: node.service,
+        tunnelName: node.tunnelName,
+        tunnelId: tunnel.tunnel.id,
+        connectorToken: tunnel.connectorToken
+      });
+    }
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
+    const firstNode = nodeResources[0];
+    resources = {
+      tunnelId: firstNode.tunnelId,
+      kvNamespaceId: namespace.namespace.id,
+      hostname: firstNode.hostname,
+      service: firstNode.service,
+      connectorToken: firstNode.connectorToken,
+      nodes: [...nodeResources],
+      ...existing?.resources.access ? { access: existing.resources.access } : {},
+      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
+      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
+      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (!resources)
+    throw new Error("Cloudflare fleet has no nodes");
+  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
+    resources = {
+      ...resources,
+      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
+        accountId: coordinates.accountId,
+        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
+        permissionNames: ["Workers KV Storage Write"],
+        apiToken: initialManagementToken(tokens)
+      }, fetcher) }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "runtime-tokens-created",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
+    resources = {
+      ...resources,
+      runtimeTokens: {
+        ...resources.runtimeTokens,
+        privateNetwork: await createCloudflareAccountRuntimeToken({
+          accountId: coordinates.accountId,
+          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
+          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
+          apiToken: initialManagementToken(tokens)
+        }, fetcher)
+      }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "runtime-tokens-created",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (!resources.worker) {
+    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
+    resources = {
+      ...resources,
+      worker: {
+        scriptName: coordinates.workerScriptName,
+        publicDomains: coordinates.publicDomains,
+        deployed: true
+      }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "worker-deployed",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  const serviceToken = await ensureCloudflareAccessServiceToken({
+    accountId: coordinates.accountId,
+    name: coordinates.serviceTokenName,
+    apiToken: tokenFor(tokens, "accessApiToken"),
+    existing: resources.access
+  }, fetcher);
+  resources = { ...resources, access: serviceToken.credentials };
+  await writeOwnerBootstrapOutput(absoluteOutput, {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "access-token-provisioned",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources
+  });
+  const policy = await ensureCloudflareAccessPolicy({
+    accountId: coordinates.accountId,
+    name: coordinates.policyName,
+    serviceTokenId: serviceToken.credentials.tokenId,
+    apiToken: tokenFor(tokens, "accessApiToken")
+  }, fetcher);
+  if (!policy.policy.id)
+    throw new Error("Cloudflare did not return the Access policy id");
+  resources = {
+    ...resources,
+    access: { ...serviceToken.credentials, policyId: policy.policy.id }
+  };
+  await writeOwnerBootstrapOutput(absoluteOutput, {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "access-token-provisioned",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources
+  });
+  let privateNetworkCreated = false;
+  if (coordinates.privateNetwork && !resources.privateNetwork) {
+    const managementToken = initialManagementToken(tokens);
+    const virtualNetwork = await ensureCloudflareVirtualNetwork({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.virtualNetworkName,
+      comment: "ForgeZero private database network",
+      apiToken: managementToken
+    }, fetcher);
+    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.enrollmentApplicationName,
+      policyId: policy.policy.id,
+      apiToken: tokenFor(tokens, "accessApiToken")
+    }, fetcher);
+    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.deviceProfileName,
+      serviceTokenId: serviceToken.credentials.tokenId,
+      virtualNetworkId: virtualNetwork.virtualNetwork.id,
+      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
+      apiToken: managementToken
+    }, fetcher);
+    const routes = [];
+    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
+      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
+      const route = await ensureCloudflarePrivateDatabaseRoute({
+        accountId: coordinates.accountId,
+        tunnelId: resource.tunnelId,
+        privateAddress: node.privateAddress,
+        virtualNetworkId: virtualNetwork.virtualNetwork.id,
+        comment: `ForgeZero ${node.nodeName} database`,
+        apiToken: managementToken
+      }, fetcher);
+      await ensureCloudflareWarpDatabaseInclude({
+        accountId: coordinates.accountId,
+        policyId: deviceProfile.policy.id,
+        privateAddress: node.privateAddress,
+        description: `ForgeZero ${node.nodeName} database`,
+        apiToken: managementToken
+      }, fetcher);
+      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
+    }
+    resources = {
+      ...resources,
+      privateNetwork: {
+        warpOrganization: coordinates.privateNetwork.warpOrganization,
+        virtualNetworkId: virtualNetwork.virtualNetwork.id,
+        deviceProfileId: deviceProfile.policy.id,
+        enrollmentApplicationId: enrollment.application.id,
+        routes
+      }
+    };
+    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "access-token-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  for (const node of coordinates.nodes) {
+    const application = await ensureCloudflareAccessApplication({
+      accountId: coordinates.accountId,
+      name: node.applicationName,
+      hostname: node.hostname,
+      policyId: policy.policy.id,
+      apiToken: tokenFor(tokens, "accessApiToken")
+    }, fetcher);
+    if (!application.application.id)
+      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
+    resources = {
+      ...resources,
+      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
+      access: {
+        ...resources.access,
+        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
+      }
+    };
+    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
+    createdNode.application = application.created;
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "access-token-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  await configureCloudflareWorkerAccessSecrets({
+    accountId: coordinates.accountId,
+    scriptName: coordinates.workerScriptName,
+    credentials: serviceToken.credentials,
+    apiToken: tokenFor(tokens, "workerApiToken")
+  }, fetcher);
+  for (const node of resources.nodes) {
+    await configureCloudflareEdge({
+      accountId: coordinates.accountId,
+      zoneId: coordinates.zoneId,
+      tunnelId: node.tunnelId,
+      hostname: node.hostname,
+      service: node.service,
+      apiToken: tokenFor(tokens, "tunnelApiToken"),
+      tunnelApiToken: tokenFor(tokens, "tunnelApiToken"),
+      dnsApiToken: tokenFor(tokens, "dnsApiToken")
+    }, fetcher);
+  }
+  const output = {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "complete",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources,
+    created: {
+      tunnel: createdNodes.some(({ tunnel }) => tunnel),
+      kvNamespace: namespace.created,
+      serviceToken: serviceToken.created,
+      policy: policy.created,
+      application: createdNodes.some(({ application }) => application),
+      privateNetwork: privateNetworkCreated,
+      workerDeployed: true,
+      nodes: createdNodes
+    }
+  };
+  await writeOwnerBootstrapOutput(absoluteOutput, output);
+  return output;
+}
+async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
+  const plan = planCloudflareBootstrap(request.coordinates, request.checkpointPath);
+  if (request.mode === "plan") {
+    return {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap-evidence",
+      phase: "planned",
+      checkpointFile: plan.outputFile,
+      workerScriptName: plan.coordinates.workerScriptName,
+      publicDomains: plan.coordinates.publicDomains,
+      nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
+    };
+  }
+  if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
+    throw new Error("Cloudflare apply requires owner-only management token file paths");
+  }
+  if (plan.coordinates.createRuntimeTokens && !request.tokenFiles.apiTokenFile) {
+    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
+  }
+  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-evidence",
+    phase: "complete",
+    checkpointFile: plan.outputFile,
+    kvNamespaceId: output.resources.kvNamespaceId,
+    workerScriptName: output.coordinates.workerScriptName,
+    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
+    runtimeTokenIds: {
+      kv: output.resources.runtimeTokens?.kv.id,
+      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
+    },
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+      nodeName,
+      hostname,
+      tunnelId,
+      applicationId
+    }))
+  };
+}
+export {
+  writeOwnerBootstrapOutput,
+  validateCloudflareBootstrapCoordinates,
+  runAttendedCloudflareBootstrap,
+  readOwnerApiToken,
+  readCloudflareHostHandoff,
+  readCloudflareConnectorHandoff,
+  readCloudflareBootstrapTokens,
+  planCloudflareBootstrap,
+  deployCloudflareWorker,
+  applyCloudflareBootstrap
+};