@forgezero/agent 0.1.34 → 0.1.36

package/dist/fz.js

@@ -4857,9 +4857,9 @@ async function spawnWith(command, env, report = () => {}) {
 
 // src/cli/index.ts
 init_dist();
-import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync4, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3 } from "path";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync7, readFileSync as readFileSync7, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { hostname } from "os";
 
 // src/agent-update.ts
@@ -4875,7 +4875,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.34";
+var VERSION2 = "0.1.36";
 
 // src/software.ts
 var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
@@ -4889,7 +4889,8 @@ var SOFTWARE_CATALOG = [
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   {
@@ -4916,6 +4917,11 @@ var UBUNTU_2604_X64 = [
     requirement: { id: "ufw", version: "ubuntu-26.04" },
     check: "command -v ufw >/dev/null",
     install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y ufw"
+  },
+  {
+    requirement: { id: "openssh-client", version: "ubuntu-26.04" },
+    check: "command -v ssh >/dev/null && command -v scp >/dev/null && command -v ssh-keyscan >/dev/null && command -v ssh-keygen >/dev/null",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y openssh-client"
   }
 ];
 function validateSoftwareRequirements(value, _options = {}) {
@@ -4929,7 +4935,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "nginx", "arangodb", "cloudflared", "ufw"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "nginx", "arangodb", "cloudflared", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -5482,7 +5488,12 @@ function agentUnit(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([options.pullBootstrap, options.bootstrapSshCredentialPath, options.bootstrapTargetTelemetryEndpoint].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential and target telemetry endpoint must be supplied together");
+  }
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
+  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
   const warpValues = [
     options.warpOrganization,
     options.warpClientIdCredentialPath,
@@ -5548,6 +5559,9 @@ function agentUnit(options) {
     options.publicApiUrl ? `FZ_PUBLIC_API_URL=${options.publicApiUrl}` : null,
     options.pullDeployments ? "FZ_DEPLOY_PULL=true" : null,
     options.pullMigrations ? "FZ_MIGRATION_PULL=true" : null,
+    options.pullBootstrap ? "FZ_BOOTSTRAP_PULL=true" : null,
+    options.pullBootstrap ? "FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL=bootstrap-ssh-key" : null,
+    options.pullBootstrap ? `FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT=${options.bootstrapTargetTelemetryEndpoint}` : null,
     `FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}`,
     options.pullMigrations ? `FZ_LIFECYCLE_HELPER_SOCKET=${lifecycleHelperSocketPath}` : null
   ].filter((line) => line !== null);
@@ -5555,6 +5569,8 @@ function agentUnit(options) {
     environment.push(`HOME=${deployRoot}/agent-home`, `XDG_CACHE_HOME=${deployRoot}/cache`);
   }
   const gitCredential = options.gitCredentialPath ? `LoadCredentialEncrypted=git-deploy-key:${options.gitCredentialPath}
+` : "";
+  const bootstrapCredential = bootstrapEnabled ? `LoadCredentialEncrypted=bootstrap-ssh-key:${bootstrapSshCredentialPath}
 ` : "";
   const projectCredentials = Object.entries(deploymentCredentials).map(([name, path]) => `LoadCredentialEncrypted=${name}:${path}`).join(`
 `);
@@ -5609,7 +5625,7 @@ User=${user}
 Group=${VAULT_GROUP}
 ${deploymentGroup}
 LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
-${gitCredential}${projectCredentials}${projectCredentials ? `
+${gitCredential}${bootstrapCredential}${projectCredentials}${projectCredentials ? `
 ` : ""}${snpPrepare}ExecStart=${bin}
 Restart=always
 RestartSec=2
@@ -5664,6 +5680,10 @@ function planProvision(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([options.pullBootstrap, options.bootstrapSshCredentialPath, options.bootstrapTargetTelemetryEndpoint].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential and target telemetry endpoint must be supplied together");
+  }
   const warpValues = [
     options.warpOrganization,
     options.warpClientIdCredentialPath,
@@ -5689,13 +5709,20 @@ function planProvision(options) {
   const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
   const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
+  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
   const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
   const warpClientSecretCredentialPath = warpEnabled ? systemdPath(options.warpClientSecretCredentialPath, "WARP client-secret credential") : undefined;
   return {
     mode,
     reason: reasonFor(mode),
     unitPath: UNIT_PATH,
-    unit: agentUnit({ ...options, mode, lifecycleProfilePath, lifecycleHelperSocketPath }),
+    unit: agentUnit({
+      ...options,
+      mode,
+      lifecycleProfilePath,
+      lifecycleHelperSocketPath,
+      bootstrapSshCredentialPath
+    }),
     auxiliaryUnits: [
       { path: AGENT_SOCKET_UNIT_PATH, unit: agentSocketUnit(options) },
       { path: AGENT_SOCKET_PROXY_UNIT_PATH, unit: agentSocketProxyUnit(options) },
@@ -5806,7 +5833,7 @@ function planProvision(options) {
         },
         {
           label: "encrypted one-time enrolment capability",
-          command: `test -s ${enrolTokenCredentialPath} || { test -r ${enrolTokenSourcePath}; ` + `systemd-creds encrypt --name=enrol-token ${enrolTokenSourcePath} ${enrolTokenCredentialPath}; ` + `chmod 0400 ${enrolTokenCredentialPath}; rm -f ${enrolTokenSourcePath}; }`
+          command: `test -s ${enrolStatePath} || test -s ${enrolTokenCredentialPath} || { test -r ${enrolTokenSourcePath}; ` + `systemd-creds encrypt --name=enrol-token ${enrolTokenSourcePath} ${enrolTokenCredentialPath}; ` + `chmod 0400 ${enrolTokenCredentialPath}; rm -f ${enrolTokenSourcePath}; }`
         }
       ] : [],
       ...deploymentEnabled ? [{
@@ -10090,249 +10117,3583 @@ function removeSession(api, realm, path = defaultSessionPath()) {
   persist(path, file);
 }
 
-// src/cli/index.ts
-var RECOMMENDED_MODE = (THRESHOLD_MODES.find((mode) => mode.recommended) ?? THRESHOLD_MODES[0]).id;
-var DEFAULT_MODE = RECOMMENDED_MODE;
-var PACKAGED_AGENT_BIN = fileURLToPath(new URL("./fz-agent.js", import.meta.url));
-function parseOptions(argv) {
-  const options = {
-    api: process.env.FZ_API ?? "http://localhost:8787",
-    apiExplicit: Boolean(process.env.FZ_API),
-    app: process.env.FZ_APP,
-    realm: process.env.FZ_REALM ?? "platform",
-    realmExplicit: Boolean(process.env.FZ_REALM),
-    json: false,
-    apply: false,
-    enrol: false,
-    socket: process.env.SSH_AUTH_SOCK,
-    mode: DEFAULT_MODE,
-    user: process.env.FZ_USER ?? "operator",
-    userExplicit: Boolean(process.env.FZ_USER),
-    phraseStdin: false,
-    preserveEnv: false,
-    projectRoot: process.cwd(),
-    deployProfile: "app",
-    deploySoftware: [],
-    deployChannel: "production",
-    requireAttestation: false,
-    force: false,
-    noBrowser: false,
-    provider: "github",
-    branch: "main",
-    authMode: "public",
-    targets: [],
-    wait: false,
-    timeoutSeconds: 900,
-    queries: []
-  };
-  const positional = [];
-  for (let index = 0;index < argv.length; index += 1) {
-    const token = argv[index];
-    if (token === "--api") {
-      options.api = argv[++index] ?? options.api;
-      options.apiExplicit = true;
-    } else if (token === "--app")
-      options.app = argv[++index];
-    else if (token === "--realm") {
-      options.realm = argv[++index] ?? options.realm;
-      options.realmExplicit = true;
-    } else if (token === "--socket")
-      options.socket = argv[++index];
-    else if (token === "--json")
-      options.json = true;
-    else if (token === "--apply")
-      options.apply = true;
-    else if (token === "--enrol")
-      options.enrol = true;
-    else if (token === "--preserve-env")
-      options.preserveEnv = true;
-    else if (token === "--root")
-      options.projectRoot = argv[++index] ?? options.projectRoot;
-    else if (token === "--name")
-      options.projectName = argv[++index];
-    else if (token === "--purpose")
-      options.projectPurpose = argv[++index];
-    else if (token === "--profile")
-      options.deployProfile = argv[++index] ?? options.deployProfile;
-    else if (token === "--software")
-      options.deploySoftware.push(argv[++index] ?? "");
-    else if (token === "--channel") {
-      const channel = argv[++index];
-      if (channel === "development" || channel === "production")
-        options.deployChannel = channel;
-      else
-        options.optionError = "--channel must be production or development.";
-    } else if (token === "--attestation")
-      options.requireAttestation = true;
-    else if (token === "--force")
-      options.force = true;
-    else if (token === "--no-browser")
-      options.noBrowser = true;
-    else if (token === "--project")
-      options.projectKey = argv[++index];
-    else if (token === "--pipeline")
-      options.pipelineKey = argv[++index];
-    else if (token === "--revision")
-      options.revision = argv[++index];
-    else if (token === "--label")
-      options.label = argv[++index];
-    else if (token === "--provider") {
-      const value = argv[++index];
-      if (value === "github" || value === "gitlab" || value === "generic")
-        options.provider = value;
-      else
-        options.optionError = "--provider must be github, gitlab, or generic.";
-    } else if (token === "--repository")
-      options.repository = argv[++index];
-    else if (token === "--branch")
-      options.branch = argv[++index] ?? options.branch;
-    else if (token === "--clone-url")
-      options.cloneUrl = argv[++index];
-    else if (token === "--auth") {
-      const value = argv[++index];
-      if (value === "public" || value === "node-ssh" || value === "vault-token")
-        options.authMode = value;
-      else
-        options.optionError = "--auth must be public, node-ssh, or vault-token.";
-    } else if (token === "--git-secret")
-      options.gitSecret = argv[++index];
-    else if (token === "--git-username")
-      options.gitUsername = argv[++index];
-    else if (token === "--known-hosts")
-      options.knownHostsFile = argv[++index];
-    else if (token === "--target")
-      options.targets.push(argv[++index] ?? "");
-    else if (token === "--target-key")
-      options.targetKey = argv[++index];
-    else if (token === "--wait")
-      options.wait = true;
-    else if (token === "--timeout") {
-      const value = Number(argv[++index] ?? "");
-      if (Number.isFinite(value) && value > 0 && value <= 86400)
-        options.timeoutSeconds = value;
-      else
-        options.optionError = "--timeout must be between 1 and 86400 seconds.";
-    } else if (token === "--data")
-      options.data = argv[++index];
-    else if (token === "--data-file")
-      options.dataFile = argv[++index];
-    else if (token === "--query")
-      options.queries.push(argv[++index] ?? "");
-    else if (token === "--key")
-      options.key = argv[++index];
-    else if (token === "--mode")
-      options.mode = argv[++index] ?? options.mode;
-    else if (token === "--user") {
-      options.user = argv[++index] ?? options.user;
-      options.userExplicit = true;
-    } else if (token === "--token-file")
-      options.tokenFile = argv[++index];
-    else if (token === "--phrase-file")
-      options.phraseFile = argv[++index];
-    else if (token === "--phrase-stdin")
-      options.phraseStdin = true;
-    else
-      positional.push(token);
+// src/bootstrap.ts
+import { createHmac, randomBytes as randomBytes5 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync4,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync4,
+  renameSync as renameSync3,
+  rmSync,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { dirname as dirname4 } from "path";
+import { fileURLToPath } from "url";
+
+// src/platform-bootstrap-runtime.ts
+var safeAtom = (name, value) => {
+  if (!value || /[\0\r\n]/.test(value))
+    throw new Error(`${name} must be non-empty and single-line.`);
+  return value;
+};
+var boundedInteger = (name, value, minimum, maximum) => {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`${name} must be an integer from ${minimum} through ${maximum}.`);
   }
-  return { command: positional[0] ?? "help", args: positional.slice(1), options };
-}
-var out = {
-  line: (text3 = "") => process.stdout.write(`${text3}
-`),
-  step: (text3) => process.stdout.write(`  ${text3}
-`),
-  warn: (text3) => process.stderr.write(`  ! ${text3}
-`),
-  fail: (text3) => process.stderr.write(`  \u2717 ${text3}
-`),
-  ok: (text3) => process.stdout.write(`  \u2713 ${text3}
-`)
+  return value;
 };
-var sessionCookie = null;
-var storedSession = null;
-function captureSession(response) {
-  const setCookie = response.headers.get("set-cookie");
-  if (!setCookie)
-    return;
-  const cookie = setCookie.split(";")[0];
-  sessionCookie = cookie;
-  if (storedSession && (cookie !== storedSession.cookie || Date.now() - storedSession.lastUsedAtTs >= 60000)) {
-    storedSession = { ...storedSession, cookie, lastUsedAtTs: Date.now() };
-    saveSession(storedSession);
+var privateCoordinator = (raw) => {
+  const url = new URL(raw);
+  if (url.protocol !== "http:" || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error("ArangoDB coordinator URLs must be credential-free private HTTP origins.");
   }
-}
-function requestHeaders(apiBase, cookie) {
-  return {
-    "content-type": "application/json",
-    origin: new URL(apiBase).origin,
-    ...cookie ? { cookie } : {}
-  };
-}
-async function api(options, path, init) {
-  const base = options.realm === "platform" ? "/api" : `/api/t/${encodeURIComponent(options.realm)}`;
-  const response = await fetch(`${options.api}${base}${path}`, {
-    method: init?.method ?? "GET",
-    headers: { ...requestHeaders(options.api, sessionCookie), "user-agent": `forgezero-cli/${VERSION2}` },
-    body: init?.body === undefined ? undefined : JSON.stringify(init.body)
-  });
-  captureSession(response);
-  let body = null;
-  try {
-    body = await response.json();
-  } catch {
-    body = null;
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const privateHost = host === "localhost" || host === "::1" || host.startsWith("fd") || host.startsWith("fc") || /^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+  if (!privateHost || url.port && url.port !== "8529") {
+    throw new Error("ArangoDB coordinators must use private addresses and port 8529.");
   }
-  const challenge = body?.security;
-  if (response.status === 428 && challenge?.scope === "action" && challenge.requestKey && custodyIdentity && !path.startsWith("/security/step-up/")) {
-    const proved = await proveWithAgent(options, challenge.requestKey);
-    if (proved) {
-      const replay = await fetch(`${options.api}${base}${path}`, {
-        method: init?.method ?? "GET",
-        headers: {
-          ...requestHeaders(options.api, sessionCookie),
-          "x-security-request-key": challenge.requestKey
-        },
-        body: init?.body === undefined ? undefined : JSON.stringify(init.body)
-      });
-      captureSession(replay);
-      let replayed = null;
-      try {
-        replayed = await replay.json();
-      } catch {
-        replayed = null;
-      }
-      return { status: replay.status, body: replayed };
-    }
+  return url.origin;
+};
+var httpsOrigin = (name, raw) => {
+  const value = new URL(raw);
+  if (value.protocol !== "https:" || value.username || value.password || value.search || value.hash || value.pathname !== "/") {
+    throw new Error(`${name} must be a credential-free HTTPS origin.`);
   }
-  if (response.status === 428 && challenge?.scope === "action" && challenge.requestKey && storedSession && !path.startsWith("/security/step-up/")) {
-    const proved = await proveWithBrowser(options, challenge.requestKey, base);
-    if (proved) {
-      const replay = await fetch(`${options.api}${base}${path}`, {
-        method: init?.method ?? "GET",
-        headers: {
-          ...requestHeaders(options.api, sessionCookie),
-          "user-agent": `forgezero-cli/${VERSION2}`,
-          "x-security-request-key": challenge.requestKey
-        },
-        body: init?.body === undefined ? undefined : JSON.stringify(init.body)
-      });
-      captureSession(replay);
-      let replayed = null;
-      try {
-        replayed = await replay.json();
-      } catch {}
-      return { status: replay.status, body: replayed };
+  return value.origin;
+};
+var systemdValue = (name, raw) => {
+  if (/[\0\r\n]/.test(raw))
+    throw new Error(`${name} must be single-line.`);
+  const value = raw;
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("$", "\\$")}"`;
+};
+function validatePlatformSharedEnvironment(input, options = {}) {
+  if (input.softwareProfile === "platform-api" !== (input.databaseRole === "none")) {
+    throw new Error("platform-api requires database role none; platform-db-api requires master or joiner.");
+  }
+  if (input.databaseCoordinators.length < 1 || input.databaseCoordinators.length > 16) {
+    throw new Error("databaseCoordinators must contain 1 through 16 endpoints.");
+  }
+  const coordinators = input.databaseCoordinators.map(privateCoordinator);
+  if (new Set(coordinators).size !== coordinators.length)
+    throw new Error("databaseCoordinators must be unique.");
+  if (!["private-lan", "cloudflare-warp"].includes(input.databaseNetworkMode)) {
+    throw new Error("Database networking must be private-lan or cloudflare-warp.");
+  }
+  boundedInteger("databaseReplicationFactor", input.databaseReplicationFactor, 1, 16);
+  boundedInteger("databaseWriteConcern", input.databaseWriteConcern, 1, 16);
+  if (input.databaseWriteConcern > input.databaseReplicationFactor) {
+    throw new Error("databaseWriteConcern cannot exceed databaseReplicationFactor.");
+  }
+  boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
+  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
+  boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
+  boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
+  if (!Number.isFinite(input.otlpTraceSampleRatio) || input.otlpTraceSampleRatio < 0 || input.otlpTraceSampleRatio > 1) {
+    throw new Error("otlpTraceSampleRatio must be from 0 through 1.");
+  }
+  if (input.otlpEndpoint !== "http://127.0.0.1:4318")
+    throw new Error("OTLP must use the exact local collector endpoint.");
+  validateCollectorUnit(input.otlpCollectorUnit);
+  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  for (const [name, value] of Object.entries({
+    nodeHostname: input.nodeHostname,
+    nodeRegion: input.nodeRegion,
+    databaseUser: input.databaseUser,
+    sharedDirectory: input.sharedDirectory,
+    seedSyncEpoch: input.seedSyncEpoch,
+    repository: input.repository,
+    branch: input.branch,
+    deployProfile: input.deployProfile
+  }))
+    safeAtom(name, value);
+  if (!input.sharedDirectory.startsWith("/"))
+    throw new Error("sharedDirectory must be absolute.");
+  for (const peer of input.seedSyncPeers) {
+    const url = new URL(peer);
+    if (url.protocol !== "ws:" && url.protocol !== "wss:")
+      throw new Error("Seed peers must be WebSocket URLs.");
+    if (url.username || url.password || url.hash)
+      throw new Error("Seed peers cannot contain credentials or fragments.");
+  }
+  if (input.smtp) {
+    safeAtom("smtp.host", input.smtp.host);
+    boundedInteger("smtp.port", input.smtp.port, 1, 65535);
+    safeAtom("smtp.from", input.smtp.from);
+    if (input.smtp.user)
+      safeAtom("smtp.user", input.smtp.user);
+  }
+  if (input.backup) {
+    httpsOrigin("backup.endpoint", input.backup.endpoint);
+    for (const [name, value] of Object.entries(input.backup))
+      safeAtom(`backup.${name}`, value);
+  }
+  if (input.cloudflare) {
+    if (![input.cloudflare.accountId, input.cloudflare.zoneId, input.cloudflare.kvNamespaceId].every((item) => /^[a-f0-9]{32}$/i.test(item)) || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(input.cloudflare.tunnelId)) {
+      throw new Error("Cloudflare account, zone, KV and Tunnel ids are malformed.");
+    }
+    const service = new URL(input.cloudflare.tunnelService);
+    if (service.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(service.hostname) || service.username || service.password || service.search || service.hash)
+      throw new Error("Cloudflare Tunnel service must be loopback HTTP.");
+    if (input.cloudflare.warp) {
+      if (!/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(input.cloudflare.warp.organization) || !/^[0-9a-f-]{36}$/i.test(input.cloudflare.warp.virtualNetworkId) || !/^[A-Za-z0-9_-]{1,128}$/.test(input.cloudflare.warp.deviceProfileId)) {
+        throw new Error("Cloudflare WARP organization, VNET or device profile is malformed.");
+      }
     }
   }
-  if (response.status === 401 && storedSession) {
-    removeSession(storedSession.api, storedSession.realm);
-    storedSession = null;
-    sessionCookie = null;
+  if (!options.allowPendingCloudflareHandoff && input.databaseNetworkMode === "cloudflare-warp" !== Boolean(input.cloudflare?.warp)) {
+    throw new Error("cloudflare-warp networking requires its exact enrolled Cloudflare coordinates.");
   }
-  return { status: response.status, body };
+  return {
+    ...input,
+    databaseCoordinators: coordinators,
+    appOrigin: httpsOrigin("appOrigin", input.appOrigin),
+    apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+  };
 }
-function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+function renderPlatformSharedEnvironment(input) {
+  const value = validatePlatformSharedEnvironment(input);
+  const appHost = new URL(value.appOrigin).hostname.split(".").slice(-2).join(".");
+  const apiHost = new URL(value.apiOrigin).hostname.split(".").slice(-2).join(".");
+  const entries = {
+    ARANGO_URL: value.databaseCoordinators[0],
+    ARANGO_URLS: value.databaseCoordinators.join(","),
+    ARANGO_DB: "fz",
+    FZ_DATABASE_MODE: "platform",
+    ARANGO_USER: value.databaseUser,
+    ARANGO_REPLICATION_FACTOR: String(value.databaseReplicationFactor),
+    ARANGO_WRITE_CONCERN: String(value.databaseWriteConcern),
+    FZ_DB_ROLE: value.databaseRole,
+    FZ_SOFTWARE_PROFILE: value.softwareProfile,
+    FZ_ROLE: value.nodeRole,
+    FZ_DB_ADDRESS: value.databaseAddress ?? "",
+    FZ_DB_MASTER: value.databaseMaster ?? "",
+    FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
+    FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
+    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
+    FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
+    FZ_SHARED_DIR: value.sharedDirectory,
+    FZ_PUBLIC_API_PORT: String(value.publicApiPort),
+    ORIGIN: value.appOrigin,
+    API_ORIGIN: value.apiOrigin,
+    HOST: "127.0.0.1",
+    APP_ORIGINS: value.appOrigin,
+    TRUST_CLOUDFLARE_IP: "1",
+    SESSION_COOKIE_SAMESITE: appHost === apiHost ? "lax" : "none",
+    SESSION_COOKIE_DOMAIN: "",
+    FZ_NODE_HOSTNAME: value.nodeHostname,
+    FZ_NODE_REGION: value.nodeRegion,
+    FZ_CONCURRENCY_LIMIT: String(value.concurrencyLimit),
+    FZ_DRAIN_DEADLINE_MS: String(value.drainDeadlineMs),
+    OTEL_EXPORTER_OTLP_ENDPOINT: value.otlpEndpoint,
+    FZ_OTLP_COLLECTOR_UNIT: value.otlpCollectorUnit,
+    OTEL_SERVICE_NAME: "forgezero-api",
+    FZ_OTLP_FLUSH_INTERVAL_MS: String(value.otlpFlushIntervalMs),
+    FZ_OTLP_TRACE_SAMPLE_RATIO: String(value.otlpTraceSampleRatio),
+    FZ_AGENT_OTLP_ENDPOINT: value.agentOtlpEndpoint,
+    FZ_CUSTODIAN_EMAIL: value.custodianEmail ?? "",
+    FZ_PROFILE: value.deployProfile,
+    FZ_REPO: value.repository,
+    FZ_BRANCH: value.branch,
+    FZ_SMTP_HOST: value.smtp?.host ?? "",
+    FZ_SMTP_PORT: value.smtp ? String(value.smtp.port) : "",
+    FZ_SMTP_USER: value.smtp?.user ?? "",
+    FZ_SMTP_FROM: value.smtp?.from ?? "",
+    BACKUP_S3_ENDPOINT: value.backup?.endpoint ?? "",
+    BACKUP_S3_REGION: value.backup?.region ?? "",
+    BACKUP_S3_BUCKET: value.backup?.bucket ?? "",
+    BACKUP_S3_ACCESS_KEY_ID: value.backup?.accessKeyId ?? "",
+    FZ_CF_ACCOUNT_ID: value.cloudflare?.accountId ?? "",
+    FZ_CF_ZONE_ID: value.cloudflare?.zoneId ?? "",
+    FZ_CF_KV_NAMESPACE_ID: value.cloudflare?.kvNamespaceId ?? "",
+    FZ_CF_TUNNEL_ID: value.cloudflare?.tunnelId ?? "",
+    FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
+    FZ_WARP_ORGANIZATION: value.cloudflare?.warp?.organization ?? "",
+    FZ_CF_VIRTUAL_NETWORK_ID: value.cloudflare?.warp?.virtualNetworkId ?? "",
+    FZ_CF_WARP_POLICY_ID: value.cloudflare?.warp?.deviceProfileId ?? ""
+  };
+  return `# Generated by fz bootstrap platform. Non-secret coordinates only.
+` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
+`) + `
+`;
+}
+function platformApiCredentialSpecs(options) {
+  const optional = [
+    ["bootstrap-smtp-password", options.smtp],
+    ["cloudflare-kv-token", options.cloudflareKv],
+    ["cloudflare-network-token", options.cloudflareNetwork]
+  ];
+  return [
+    { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
+    { name: "seed-sync-root", encryptedPath: "/etc/forgezero/creds/seed-sync-root.cred", required: true },
+    ...optional.filter(([, present]) => present).map(([name]) => ({
+      name,
+      encryptedPath: `/etc/forgezero/creds/${name}.cred`,
+      required: false
+    }))
+  ];
+}
+function renderPlatformApiUnits(input) {
+  for (const path of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+    if (!path.startsWith("/") || /[\r\n]/.test(path))
+      throw new Error("Runtime paths must be absolute and single-line.");
+  }
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
+    throw new Error("Invalid service user.");
+  validateCollectorUnit(input.collectorUnit);
+  boundedInteger("bluePort", input.bluePort, 1024, 65535);
+  boundedInteger("greenPort", input.greenPort, 1024, 65535);
+  if (input.bluePort === input.greenPort)
+    throw new Error("Blue and green ports must differ.");
+  const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
+`);
+  const template = `[Unit]
+Description=ForgeZero (%i slot)
+After=network-online.target ${input.collectorUnit}
+Wants=network-online.target ${input.collectorUnit}
+
+[Service]
+Type=simple
+User=${input.serviceUser}
+WorkingDirectory=${input.slotsDirectory}/%i
+Environment=NODE_ENV=production
+Environment=FZ_SLOT=%i
+EnvironmentFile=${input.sharedEnvironmentFile}
+${credentials}
+ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
+Restart=always
+RestartSec=2
+TimeoutStopSec=35s
+LimitCORE=0
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadOnlyPaths=${input.sharedDirectory}
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+  return { template, dropIns: {
+    blue: `[Service]
+Environment=PORT=${input.bluePort}
+`,
+    green: `[Service]
+Environment=PORT=${input.greenPort}
+`
+  } };
+}
+function renderPlatformNginx(input) {
+  boundedInteger("publicPort", input.publicPort, 1024, 65535);
+  boundedInteger("initialSlotPort", input.initialSlotPort, 1024, 65535);
+  if (input.publicPort === input.initialSlotPort)
+    throw new Error("Edge and slot ports must differ.");
+  return {
+    upstream: `upstream forgezero { server 127.0.0.1:${input.initialSlotPort}; }
+`,
+    site: `server {
+  listen 127.0.0.1:${input.publicPort};
+  server_name _;
+  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  location / { return 404; }
+}
+`
+  };
+}
+function renderPlatformActivationFiles(input) {
+  if (!input.root.startsWith("/") || /[\0\r\n]/.test(input.root))
+    throw new Error("Activation root must be absolute and single-line.");
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
+    throw new Error("Invalid activation service user.");
+  boundedInteger("bluePort", input.bluePort, 1024, 65535);
+  boundedInteger("greenPort", input.greenPort, 1024, 65535);
+  if (input.bluePort === input.greenPort)
+    throw new Error("Activation slot ports must differ.");
+  boundedInteger("keepReleases", input.keepReleases, 2, 100);
+  if (!/^\/[A-Za-z0-9/_-]{1,128}$/.test(input.healthPath) || input.healthPath.includes("..")) {
+    throw new Error("Activation health path is malformed.");
+  }
+  const environment = [
+    `FZ_DIR=${input.root}`,
+    `FZ_USER=${input.serviceUser}`,
+    `FZ_BLUE_PORT=${input.bluePort}`,
+    `FZ_GREEN_PORT=${input.greenPort}`,
+    `FZ_HEALTH_PATH=${input.healthPath}`,
+    `FZ_KEEP_RELEASES=${input.keepReleases}`
+  ].join(`
+`) + `
+`;
+  const helper = `#!/usr/bin/env bash
+set -Eeuo pipefail
+source /etc/forgezero/deploy.env
+[[ $# == 1 ]] || { echo "usage: forgezero-activate <release>" >&2; exit 2; }
+release="$(realpath -e "$1")"; releases="$(realpath -e "$FZ_DIR/releases")"; slots="$FZ_DIR/slots"
+install -d -o root -g root -m 0755 "$slots"
+case "$release/" in "$releases"/*/) ;; *) echo "release is outside $releases" >&2; exit 2 ;; esac
+[[ -f "$release/.fz/deploy.json" && -s "$release/src/index.ts" && -s "$release/bun.lock" ]] || { echo "release is incomplete" >&2; exit 2; }
+slot_file="$FZ_DIR/.forge-slot"; previous_slot="$(cat "$slot_file" 2>/dev/null || true)"
+if [[ "$previous_slot" == blue ]]; then target=green; port="$FZ_GREEN_PORT"; else target=blue; port="$FZ_BLUE_PORT"; fi
+target_link="$slots/$target"; previous_target_link="$(readlink -f "$target_link" 2>/dev/null || true)"
+chown -R root:"$FZ_USER" "$release"; chmod -R a-w "$release"; find "$release" -type d -exec chmod a+rx {} +; find "$release" -type f -exec chmod a+r {} +
+ln -sfn "$release" "$target_link"; systemctl restart "forgezero@\${target}.service"
+healthy=0; for _ in $(seq 1 30); do curl -fsS --max-time 2 "http://127.0.0.1:\${port}\${FZ_HEALTH_PATH}" >/dev/null 2>&1 && { healthy=1; break; }; sleep 1; done
+if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; exit 1; fi
+upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
+printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
+if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
+rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"; [[ -n "$previous_slot" && "$previous_slot" != "$target" ]] && systemctl stop "forgezero@\${previous_slot}.service" || true
+mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
+for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
+printf 'promoted %s on %s\\n' "$release" "$target"
+`;
+  return {
+    environment,
+    helper,
+    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/libexec/forgezero-activate *
+`
+  };
+}
+function validateCollectorUnit(unit) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}\.service$/.test(unit))
+    throw new Error("Invalid OTLP collector service unit.");
+  if (/^(forgezero@.*|forgezero-agent|forgezero-metal-agent|forgezero-db)\.service$/.test(unit)) {
+    throw new Error("OTLP collector must be independently supervised.");
+  }
+}
+function planLocalOtlpProof(endpoint, collectorUnit) {
+  if (endpoint !== "http://127.0.0.1:4318")
+    throw new Error("OTLP proof requires exact loopback endpoint http://127.0.0.1:4318.");
+  validateCollectorUnit(collectorUnit);
+  return {
+    unitCheck: { command: "systemctl", argv: ["is-active", "--quiet", collectorUnit] },
+    receiverCheck: {
+      command: "curl",
+      acceptedStatus: "2xx",
+      argv: [
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "5",
+        "--output",
+        "/dev/null",
+        "--write-out",
+        "%{http_code}",
+        "--request",
+        "POST",
+        "--header",
+        "Content-Type: application/json",
+        "--data-binary",
+        "{}",
+        `${endpoint}/v1/metrics`
+      ]
+    }
+  };
+}
+
+// src/cloudflare-bootstrap.ts
+import { constants } from "fs";
+import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
+import { dirname as dirname3, join as join5, resolve as resolve2 } from "path";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
+import { isIP as isIP3 } from "net";
+
+// src/cloudflare-edge.ts
+import { isIP as isIP2 } from "net";
+function isPrivateDatabaseAddress(value) {
+  const address = value.trim().toLowerCase();
+  const family = isIP2(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    return Number.isFinite(first) && (first & 65024) === 64512;
+  }
+  return false;
+}
+function privateDatabaseHostRoute(value) {
+  const address = value.trim().toLowerCase();
+  if (!isPrivateDatabaseAddress(address)) {
+    throw new Error("database address must be an RFC 1918 IPv4 or unique-local IPv6 address");
+  }
+  return `${address}/${isIP2(address) === 4 ? 32 : 128}`;
+}
+var endpoint = "https://api.cloudflare.com/client/v4";
+async function cf(config, path, init = {}, fetcher = fetch) {
+  const response = await fetcher(`${endpoint}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${config.apiToken}`,
+      "content-type": "application/json",
+      ...init.headers
+    }
+  });
+  const body = await response.json();
+  if (!response.ok || body.success !== true) {
+    throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
+  }
+  return body.result;
+}
+async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
+  const [address, prefixText, ...extra] = config.network.split("/");
+  const family = isIP2(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
+  }
+  const path = `/accounts/${config.accountId}/teamnet/routes`;
+  const routes = await cf(config, path, {}, fetcher);
+  const current = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
+  if (current) {
+    if (current.tunnel_id !== config.tunnelId) {
+      throw new Error(`private route ${config.network} already belongs to another Tunnel`);
+    }
+    return { route: current, created: false };
+  }
+  const route = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({
+      network: config.network,
+      tunnel_id: config.tunnelId,
+      comment: config.comment.slice(0, 100),
+      ...config.virtualNetworkId ? { virtual_network_id: config.virtualNetworkId } : {}
+    })
+  }, fetcher);
+  return { route, created: true };
+}
+async function ensureCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
+  return ensureCloudflarePrivateRoute({
+    ...config,
+    network: privateDatabaseHostRoute(config.privateAddress)
+  }, fetcher);
+}
+async function ensureCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
+  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  const route = privateDatabaseHostRoute(config.privateAddress);
+  const policy = config.policyId ? `/${config.policyId}` : "";
+  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  if (entries.some((entry) => entry.address === route))
+    return { entries, created: false };
+  const next = [...entries, { address: route, description: config.description.slice(0, 100) }];
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify(next)
+  }, fetcher);
+  return { entries: updated, created: true };
+}
+async function configureCloudflareEdge(config, fetcher = fetch) {
+  const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
+  const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
+  const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
+  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  await cf(tunnelAuth, tunnelPath, {
+    method: "PUT",
+    body: JSON.stringify({ config: { ingress: [
+      { hostname: config.hostname, service: config.service },
+      ...otherHosts,
+      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+    ] } })
+  }, fetcher);
+  const dnsPath = `/zones/${config.zoneId}/dns_records`;
+  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  if (records.length > 1) {
+    throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
+  }
+  const record2 = {
+    type: "CNAME",
+    name: config.hostname,
+    content: `${config.tunnelId}.cfargotunnel.com`,
+    proxied: true,
+    ttl: 1
+  };
+  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
+    method: records[0] ? "PUT" : "POST",
+    body: JSON.stringify(record2)
+  }, fetcher);
+}
+var exactAccountPermissionGroup = async (config, name, fetcher) => {
+  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
+  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
+  if (matches.length !== 1) {
+    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
+  }
+  return { id: matches[0].id, name };
+};
+async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
+    throw new Error("Cloudflare account id is invalid");
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
+    throw new Error("Cloudflare account runtime-token name is invalid");
+  }
+  const permissionNames = [...new Set(config.permissionNames)];
+  if (permissionNames.length === 0)
+    throw new Error("Cloudflare account runtime token needs a permission group");
+  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
+  const body = {
+    name,
+    policies: [{
+      effect: "allow",
+      permission_groups: permissionGroups.map(({ id: id2 }) => ({ id: id2 })),
+      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
+    }]
+  };
+  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
+  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
+    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
+  }
+  return { id: created.id, value: created.value, name, permissionNames };
+}
+async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Access service-token name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/service_tokens`;
+  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = tokens.filter((token) => token.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
+  if (matches[0]) {
+    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
+      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
+    }
+    return { credentials: config.existing, created: false };
+  }
+  const created = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
+  }, fetcher);
+  if (!created.id || !created.client_id || !created.client_secret) {
+    throw new Error("Cloudflare did not return the new Access service-token secret");
+  }
+  return {
+    credentials: {
+      tokenId: created.id,
+      clientId: created.client_id,
+      clientSecret: created.client_secret
+    },
+    created: true
+  };
+}
+async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/policies`;
+  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === config.name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
+  const desired = {
+    name: config.name,
+    decision: "non_identity",
+    include: [{ service_token: { token_id: config.serviceTokenId } }]
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
+    method: matches[0] ? "PUT" : "POST",
+    body: JSON.stringify(desired)
+  }, fetcher);
+  return { policy, created: !matches[0] };
+}
+async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
+  const desired = {
+    name: config.name,
+    type: "self_hosted",
+    domain: config.hostname,
+    session_duration: "24h",
+    service_auth_401_redirect: true,
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare WARP enrollment application name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/access/apps`;
+  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
+  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
+    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
+  }
+  const desired = {
+    name,
+    type: "warp",
+    policies: [{ id: config.policyId, precedence: 1 }]
+  };
+  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!application.id || application.type && application.type !== "warp") {
+    throw new Error("Cloudflare did not return the WARP enrollment application");
+  }
+  return { application, created: !matches[0] };
+}
+async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare VNET name is invalid");
+  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
+  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
+  if (matches[0])
+    return { virtualNetwork: matches[0], created: false };
+  const virtualNetwork = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
+  }, fetcher);
+  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
+    throw new Error("Cloudflare did not return the VNET id");
+  }
+  return { virtualNetwork, created: true };
+}
+async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
+    throw new Error("Cloudflare WARP device profile name is invalid");
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
+    throw new Error("Cloudflare service-token id is invalid");
+  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
+    throw new Error("Cloudflare VNET id is invalid");
+  const precedence = config.precedence ?? 100;
+  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
+    throw new Error("Cloudflare WARP device profile precedence is invalid");
+  }
+  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
+  const listPath = `/accounts/${config.accountId}/devices/policies`;
+  const path = `/accounts/${config.accountId}/devices/policy`;
+  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
+  const matches = policies.filter((policy2) => policy2.name === name);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
+  if (matches[0]?.match && matches[0].match !== match) {
+    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
+  }
+  const desired = {
+    name,
+    match,
+    precedence,
+    description: "ForgeZero non-interactive compute enrollment",
+    enabled: true,
+    allow_mode_switch: false,
+    allowed_to_leave: false,
+    auto_connect: 0,
+    switch_locked: true,
+    service_mode_v2: { mode: "warp" },
+    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
+  };
+  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
+  if (!policy.id)
+    throw new Error("Cloudflare did not return the WARP device profile id");
+  return { policy, created: !matches[0] };
+}
+async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
+    throw new Error("Cloudflare Worker script name is invalid");
+  }
+  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      secrets: {
+        CF_ACCESS_CLIENT_ID: {
+          name: "CF_ACCESS_CLIENT_ID",
+          type: "secret_text",
+          text: config.credentials.clientId
+        },
+        CF_ACCESS_CLIENT_SECRET: {
+          name: "CF_ACCESS_CLIENT_SECRET",
+          type: "secret_text",
+          text: config.credentials.clientSecret
+        }
+      }
+    })
+  }, fetcher);
+}
+async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
+  const title = config.title.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
+  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
+  const matches = namespaces.filter((namespace2) => namespace2.title === title);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
+  if (matches[0])
+    return { namespace: matches[0], created: false };
+  const namespace = await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ title })
+  }, fetcher);
+  return { namespace, created: true };
+}
+async function ensureCloudflareTunnel(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Tunnel name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/cfd_tunnel`;
+  const tunnels = await cf(config, `${path}?is_deleted=false&name=${encodeURIComponent(name)}&per_page=1000`, {}, fetcher);
+  const matches = tunnels.filter((tunnel2) => tunnel2.name === name && !tunnel2.deleted_at);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Tunnel ${name} is ambiguous`);
+  const created = !matches[0];
+  const tunnel = matches[0] ?? await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, config_src: "cloudflare" })
+  }, fetcher);
+  const connectorToken = await cf(config, `${path}/${encodeURIComponent(tunnel.id)}/token`, {}, fetcher);
+  if (!connectorToken || connectorToken.length > 16384) {
+    throw new Error("Cloudflare returned an invalid Tunnel connector token");
+  }
+  return { tunnel, connectorToken, created };
+}
+
+// src/cloudflare-bootstrap.ts
+var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
+async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
+  const metadata = await handle.stat();
+  if (!metadata.isFile())
+    throw new Error(`${path} must be a regular file`);
+  if (metadata.nlink !== 1)
+    throw new Error(`${path} must not have multiple hard links`);
+  const uid = ownerUid();
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+    throw new Error(`${path} must be owned by the current operator`);
+  if ((metadata.mode & 63) !== 0)
+    throw new Error(`${path} must not be accessible by group or other users`);
+  if ((metadata.mode & 256) === 0)
+    throw new Error(`${path} must be readable by its owner`);
+  if (metadata.size < 1 || metadata.size > maximumBytes)
+    throw new Error(`${path} has an invalid size`);
+}
+async function readOwnerOnlyFile(path, maximumBytes) {
+  const absolute = resolve2(path);
+  let handle;
+  try {
+    handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+    await assertOwnerOnlyHandle(absolute, handle, maximumBytes);
+    return await handle.readFile({ encoding: "utf8" });
+  } catch (cause) {
+    if (cause instanceof Error && cause.message.startsWith(absolute))
+      throw cause;
+    throw new Error(`cannot securely read owner-only file ${absolute}`);
+  } finally {
+    await handle?.close();
+  }
+}
+async function readOwnerApiToken(path) {
+  const token = (await readOwnerOnlyFile(path, 4096)).trim();
+  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+    throw new Error(`${resolve2(path)} must contain exactly one Cloudflare API token`);
+  }
+  return token;
+}
+async function readCloudflareBootstrapTokens(files) {
+  const entries = await Promise.all([
+    ["apiToken", files.apiTokenFile],
+    ["tunnelApiToken", files.tunnelApiTokenFile],
+    ["dnsApiToken", files.dnsApiTokenFile],
+    ["kvApiToken", files.kvApiTokenFile],
+    ["accessApiToken", files.accessApiTokenFile],
+    ["workerApiToken", files.workerApiTokenFile]
+  ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
+  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const unified = tokens.apiToken;
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
+    if (!tokens[key] && !unified)
+      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  }
+  return tokens;
+}
+var validateId = (value, label) => {
+  const normalized = value.trim().toLowerCase();
+  if (!/^[a-f0-9]{32}$/.test(normalized))
+    throw new Error(`${label} must be a 32-character hexadecimal id`);
+  return normalized;
+};
+var validateName = (value, label, maximum, allowSpaces = true) => {
+  const normalized = value.trim();
+  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+    throw new Error(`${label} is invalid`);
+  }
+  return normalized;
+};
+var privateAddress = (value) => {
+  const address = value.trim().toLowerCase();
+  const family = isIP3(address);
+  if (family === 4) {
+    const [a, b] = address.split(".").map(Number);
+    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
+      return address;
+  }
+  if (family === 6) {
+    const first = Number.parseInt(address.split(":", 1)[0], 16);
+    if (Number.isFinite(first) && (first & 65024) === 64512)
+      return address;
+  }
+  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+};
+function validateCloudflareBootstrapCoordinates(input) {
+  const nodeInputs = input.nodes?.length ? input.nodes : [{
+    nodeName: input.tunnelName,
+    hostname: input.hostname,
+    service: input.service,
+    tunnelName: input.tunnelName,
+    applicationName: input.applicationName
+  }];
+  if (nodeInputs.length < 1 || nodeInputs.length > 32) {
+    throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
+  }
+  const nodes = nodeInputs.map((node) => {
+    const nodeName = node.nodeName.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
+      throw new Error("Cloudflare node name is invalid");
+    const hostname = node.hostname.trim().toLowerCase();
+    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+      throw new Error("Cloudflare public node hostname is invalid");
+    }
+    const serviceUrl = new URL(node.service);
+    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
+      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
+    }
+    return {
+      nodeName,
+      hostname,
+      service: serviceUrl.toString().replace(/\/$/, ""),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
+      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
+      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+    };
+  });
+  for (const [label, values] of [
+    ["node name", nodes.map(({ nodeName }) => nodeName)],
+    ["hostname", nodes.map(({ hostname }) => hostname)],
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
+    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+  ]) {
+    if (new Set(values).size !== values.length)
+      throw new Error(`Cloudflare fleet ${label} must be unique`);
+  }
+  const first = nodes[0];
+  const workerScriptName = input.workerScriptName.trim();
+  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
+    throw new Error("Cloudflare Worker script name is invalid");
+  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
+  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
+    throw new Error("Cloudflare Worker compatibility date is invalid");
+  }
+  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
+  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
+    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
+  }
+  const workerDirectory = resolve2(input.workerDirectory);
+  const workerMain = input.workerMain.trim();
+  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
+    throw new Error("Cloudflare Worker main must be a project-relative path");
+  }
+  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
+    throw new Error("Cloudflare runtime-token name prefix is invalid");
+  }
+  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
+    throw new Error("private-network runtime token requires runtime-token creation");
+  }
+  const privateNetwork = input.privateNetwork ? {
+    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
+    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
+    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
+    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
+    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
+  } : undefined;
+  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
+    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
+  }
+  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
+    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
+  }
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    hostname: first.hostname,
+    service: first.service,
+    tunnelName: first.tunnelName,
+    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
+    workerScriptName,
+    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
+    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
+    applicationName: first.applicationName,
+    workerDirectory,
+    workerMain,
+    workerCompatibilityDate,
+    publicDomains,
+    createRuntimeTokens: input.createRuntimeTokens,
+    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
+    runtimeTokenNamePrefix,
+    nodes,
+    ...privateNetwork ? { privateNetwork } : {}
+  };
+}
+function planCloudflareBootstrap(input, outputPath) {
+  const coordinates = validateCloudflareBootstrapCoordinates(input);
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-plan",
+    mode: "attended-token-file",
+    outputFile: resolve2(outputPath),
+    coordinates,
+    operations: [
+      "create or reuse one Workers KV namespace",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      ...coordinates.createRuntimeTokens ? [
+        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
+      ] : [],
+      "deploy the shared Worker once with the created NODES binding and stable custom domains",
+      "create or reuse one shared Access service token/policy and one self-hosted application per node",
+      ...coordinates.privateNetwork ? [
+        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
+      ] : [],
+      "write the Access client id and secret to the existing Worker as encrypted secrets",
+      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+    ],
+    secrets: [
+      "API tokens are read only from owner-only files and are never written to output",
+      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
+      "the normal API process does not receive or import the management token files"
+    ]
+  };
+}
+var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
+  const child = Bun.spawn([...command], {
+    cwd,
+    env: { ...env },
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text()
+  ]);
+  return { exitCode, stdout, stderr };
+};
+var inheritedWorkerEnvironment = () => {
+  const allowed = [
+    "PATH",
+    "HOME",
+    "TMPDIR",
+    "XDG_CONFIG_HOME",
+    "XDG_CACHE_HOME",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "NODE_EXTRA_CA_CERTS",
+    "HTTPS_PROXY",
+    "HTTP_PROXY",
+    "NO_PROXY"
+  ];
+  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
+};
+var redact = (text3, secrets) => {
+  let safe = text3.slice(0, 4096);
+  for (const secret of secrets)
+    if (secret)
+      safe = safe.split(secret).join("[REDACTED]");
+  return safe.trim();
+};
+async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
+  const validated = validateCloudflareBootstrapCoordinates(coordinates);
+  const workerDirectoryMetadata = await stat(validated.workerDirectory);
+  if (!workerDirectoryMetadata.isDirectory())
+    throw new Error("Cloudflare Worker directory is not a directory");
+  const workerMain = resolve2(validated.workerDirectory, validated.workerMain);
+  const workerMainMetadata = await stat(workerMain);
+  if (!workerMainMetadata.isFile())
+    throw new Error("Cloudflare Worker main is not a regular file");
+  const wrangler = resolve2(validated.workerDirectory, "node_modules/.bin/wrangler");
+  const wranglerMetadata = await stat(wrangler);
+  if (!wranglerMetadata.isFile())
+    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
+  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
+    throw new Error("Cloudflare KV namespace id is invalid");
+  const temporaryDirectory = await mkdtemp(join5(tmpdir(), "fz-wrangler-"));
+  await chmod(temporaryDirectory, 448);
+  const configurationPath = join5(temporaryDirectory, "wrangler.json");
+  try {
+    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({
+        name: validated.workerScriptName,
+        main: workerMain,
+        compatibility_date: validated.workerCompatibilityDate,
+        workers_dev: false,
+        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
+        observability: { enabled: true },
+        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
+      }, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const result = await runner({
+      command: [wrangler, "deploy", "--config", configurationPath],
+      cwd: validated.workerDirectory,
+      env: {
+        ...inheritedWorkerEnvironment(),
+        XDG_CONFIG_HOME: temporaryDirectory,
+        XDG_CACHE_HOME: temporaryDirectory,
+        WRANGLER_LOG_PATH: join5(temporaryDirectory, "wrangler.log"),
+        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
+        CLOUDFLARE_API_TOKEN: apiToken,
+        WRANGLER_SEND_METRICS: "false"
+      }
+    });
+    if (result.exitCode !== 0) {
+      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
+      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
+    }
+  } finally {
+    await rm(temporaryDirectory, { recursive: true, force: true });
+  }
+}
+async function readExistingOutput(path) {
+  try {
+    await lstat(path);
+  } catch (cause) {
+    if (cause.code === "ENOENT")
+      return;
+    throw cause;
+  }
+  const text3 = await readOwnerOnlyFile(path, 1048576);
+  let output;
+  try {
+    output = JSON.parse(text3);
+  } catch {
+    throw new Error(`${resolve2(path)} is not valid bootstrap JSON`);
+  }
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
+    throw new Error(`${resolve2(path)} is not a ForgeZero Cloudflare bootstrap output`);
+  }
+  return output;
+}
+async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
+  const output = await readExistingOutput(resolve2(checkpointPath));
+  if (!output || output.phase !== "complete") {
+    throw new Error("Cloudflare connector handoff requires a completed bootstrap checkpoint");
+  }
+  const normalizedNodeName = nodeName.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalizedNodeName)) {
+    throw new Error("Cloudflare connector handoff node name is invalid");
+  }
+  const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
+  const expected = coordinates.nodes.find((node) => node.nodeName === normalizedNodeName);
+  const matches = output.resources.nodes?.filter((node) => node.nodeName === normalizedNodeName) ?? [];
+  if (!expected || matches.length !== 1) {
+    throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
+  }
+  const resource = matches[0];
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !resource.applicationId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(resource.tunnelId) || !/^[A-Za-z0-9._-]{40,16384}$/.test(resource.connectorToken)) {
+    throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
+  }
+  return {
+    nodeName: resource.nodeName,
+    hostname: resource.hostname,
+    service: resource.service,
+    tunnelId: resource.tunnelId,
+    connectorToken: resource.connectorToken
+  };
+}
+async function readCloudflareHostHandoff(checkpointPath, nodeName) {
+  const connector = await readCloudflareConnectorHandoff(checkpointPath, nodeName);
+  const output = await readExistingOutput(resolve2(checkpointPath));
+  const kv = output?.resources.runtimeTokens?.kv;
+  if (!output || output.phase !== "complete" || !/^[a-f0-9]{32}$/i.test(output.coordinates.accountId) || !/^[a-f0-9]{32}$/i.test(output.coordinates.zoneId) || !/^[a-f0-9]{32}$/i.test(output.resources.kvNamespaceId) || !kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv.value)) {
+    throw new Error("Cloudflare host handoff is missing the exact-account KV runtime capability");
+  }
+  const network = output.resources.runtimeTokens?.privateNetwork?.value;
+  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+    throw new Error("Cloudflare host handoff private-network capability is malformed");
+  }
+  const privateNetwork = output.resources.privateNetwork;
+  const access = output.resources.access;
+  if (Boolean(privateNetwork) !== Boolean(network)) {
+    throw new Error("Cloudflare host handoff private-network resources and capability disagree");
+  }
+  if (privateNetwork && (!access?.clientId || !access.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(privateNetwork.warpOrganization) || !/^[0-9a-f-]{36}$/i.test(privateNetwork.virtualNetworkId) || !privateNetwork.deviceProfileId)) {
+    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
+  }
+  return {
+    ...connector,
+    accountId: output.coordinates.accountId,
+    zoneId: output.coordinates.zoneId,
+    kvNamespaceId: output.resources.kvNamespaceId,
+    kvRuntimeToken: kv.value,
+    ...network ? { privateNetworkRuntimeToken: network } : {},
+    ...privateNetwork && access ? { warp: {
+      organization: privateNetwork.warpOrganization,
+      clientId: access.clientId,
+      clientSecret: access.clientSecret,
+      virtualNetworkId: privateNetwork.virtualNetworkId,
+      deviceProfileId: privateNetwork.deviceProfileId
+    } } : {}
+  };
+}
+async function prepareOwnerOutputDirectory(absolutePath) {
+  const directory = dirname3(absolutePath);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const directoryMetadata = await stat(directory);
+  const uid = ownerUid();
+  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+    throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
+  }
+  return directory;
+}
+async function writeOwnerBootstrapOutput(path, output) {
+  const absolute = resolve2(path);
+  const directory = await prepareOwnerOutputDirectory(absolute);
+  const temporary = `${absolute}.${randomUUID()}.tmp`;
+  let handle;
+  try {
+    handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    await handle.writeFile(`${JSON.stringify(output, null, 2)}
+`, { encoding: "utf8" });
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await rename(temporary, absolute);
+    await chmod(absolute, 384);
+    const directoryHandle = await open(directory, constants.O_RDONLY);
+    try {
+      await directoryHandle.sync();
+    } finally {
+      await directoryHandle.close();
+    }
+  } finally {
+    await handle?.close();
+    await unlink(temporary).catch((cause) => {
+      if (cause.code !== "ENOENT")
+        throw cause;
+    });
+  }
+}
+var tokenFor = (tokens, key) => {
+  const token = tokens[key]?.trim() || tokens.apiToken?.trim();
+  if (!token)
+    throw new Error(`Cloudflare ${key} is not configured`);
+  return token;
+};
+var initialManagementToken = (tokens) => {
+  const token = tokens.apiToken?.trim();
+  if (!token) {
+    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
+  }
+  return token;
+};
+var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+  const coordinates = validateCloudflareBootstrapCoordinates(input);
+  const absoluteOutput = resolve2(outputPath);
+  const existing = await readExistingOutput(absoluteOutput);
+  if (existing && !sameCoordinates(existing.coordinates, coordinates)) {
+    throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
+  }
+  await prepareOwnerOutputDirectory(absoluteOutput);
+  const namespace = await ensureCloudflareKvNamespace({
+    accountId: coordinates.accountId,
+    title: coordinates.kvNamespaceTitle,
+    apiToken: tokenFor(tokens, "kvApiToken")
+  }, fetcher);
+  const nodeResources = [];
+  const createdNodes = [];
+  let resources;
+  for (const node of coordinates.nodes) {
+    const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let created = false;
+    if (checkpointed) {
+      nodeResources.push(checkpointed);
+    } else {
+      const tunnel = await ensureCloudflareTunnel({
+        accountId: coordinates.accountId,
+        name: node.tunnelName,
+        apiToken: tokenFor(tokens, "tunnelApiToken")
+      }, fetcher);
+      created = tunnel.created;
+      nodeResources.push({
+        nodeName: node.nodeName,
+        hostname: node.hostname,
+        service: node.service,
+        tunnelName: node.tunnelName,
+        tunnelId: tunnel.tunnel.id,
+        connectorToken: tunnel.connectorToken
+      });
+    }
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
+    const firstNode = nodeResources[0];
+    resources = {
+      tunnelId: firstNode.tunnelId,
+      kvNamespaceId: namespace.namespace.id,
+      hostname: firstNode.hostname,
+      service: firstNode.service,
+      connectorToken: firstNode.connectorToken,
+      nodes: [...nodeResources],
+      ...existing?.resources.access ? { access: existing.resources.access } : {},
+      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
+      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
+      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (!resources)
+    throw new Error("Cloudflare fleet has no nodes");
+  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
+    resources = {
+      ...resources,
+      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
+        accountId: coordinates.accountId,
+        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
+        permissionNames: ["Workers KV Storage Write"],
+        apiToken: initialManagementToken(tokens)
+      }, fetcher) }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "runtime-tokens-created",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
+    resources = {
+      ...resources,
+      runtimeTokens: {
+        ...resources.runtimeTokens,
+        privateNetwork: await createCloudflareAccountRuntimeToken({
+          accountId: coordinates.accountId,
+          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
+          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
+          apiToken: initialManagementToken(tokens)
+        }, fetcher)
+      }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "runtime-tokens-created",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  if (!resources.worker) {
+    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
+    resources = {
+      ...resources,
+      worker: {
+        scriptName: coordinates.workerScriptName,
+        publicDomains: coordinates.publicDomains,
+        deployed: true
+      }
+    };
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "worker-deployed",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  const serviceToken = await ensureCloudflareAccessServiceToken({
+    accountId: coordinates.accountId,
+    name: coordinates.serviceTokenName,
+    apiToken: tokenFor(tokens, "accessApiToken"),
+    existing: resources.access
+  }, fetcher);
+  resources = { ...resources, access: serviceToken.credentials };
+  await writeOwnerBootstrapOutput(absoluteOutput, {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "access-token-provisioned",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources
+  });
+  const policy = await ensureCloudflareAccessPolicy({
+    accountId: coordinates.accountId,
+    name: coordinates.policyName,
+    serviceTokenId: serviceToken.credentials.tokenId,
+    apiToken: tokenFor(tokens, "accessApiToken")
+  }, fetcher);
+  if (!policy.policy.id)
+    throw new Error("Cloudflare did not return the Access policy id");
+  resources = {
+    ...resources,
+    access: { ...serviceToken.credentials, policyId: policy.policy.id }
+  };
+  await writeOwnerBootstrapOutput(absoluteOutput, {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "access-token-provisioned",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources
+  });
+  let privateNetworkCreated = false;
+  if (coordinates.privateNetwork && !resources.privateNetwork) {
+    const managementToken = initialManagementToken(tokens);
+    const virtualNetwork = await ensureCloudflareVirtualNetwork({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.virtualNetworkName,
+      comment: "ForgeZero private database network",
+      apiToken: managementToken
+    }, fetcher);
+    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.enrollmentApplicationName,
+      policyId: policy.policy.id,
+      apiToken: tokenFor(tokens, "accessApiToken")
+    }, fetcher);
+    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
+      accountId: coordinates.accountId,
+      name: coordinates.privateNetwork.deviceProfileName,
+      serviceTokenId: serviceToken.credentials.tokenId,
+      virtualNetworkId: virtualNetwork.virtualNetwork.id,
+      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
+      apiToken: managementToken
+    }, fetcher);
+    const routes = [];
+    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
+      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
+      const route = await ensureCloudflarePrivateDatabaseRoute({
+        accountId: coordinates.accountId,
+        tunnelId: resource.tunnelId,
+        privateAddress: node.privateAddress,
+        virtualNetworkId: virtualNetwork.virtualNetwork.id,
+        comment: `ForgeZero ${node.nodeName} database`,
+        apiToken: managementToken
+      }, fetcher);
+      await ensureCloudflareWarpDatabaseInclude({
+        accountId: coordinates.accountId,
+        policyId: deviceProfile.policy.id,
+        privateAddress: node.privateAddress,
+        description: `ForgeZero ${node.nodeName} database`,
+        apiToken: managementToken
+      }, fetcher);
+      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
+    }
+    resources = {
+      ...resources,
+      privateNetwork: {
+        warpOrganization: coordinates.privateNetwork.warpOrganization,
+        virtualNetworkId: virtualNetwork.virtualNetwork.id,
+        deviceProfileId: deviceProfile.policy.id,
+        enrollmentApplicationId: enrollment.application.id,
+        routes
+      }
+    };
+    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "access-token-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  for (const node of coordinates.nodes) {
+    const application = await ensureCloudflareAccessApplication({
+      accountId: coordinates.accountId,
+      name: node.applicationName,
+      hostname: node.hostname,
+      policyId: policy.policy.id,
+      apiToken: tokenFor(tokens, "accessApiToken")
+    }, fetcher);
+    if (!application.application.id)
+      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
+    resources = {
+      ...resources,
+      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
+      access: {
+        ...resources.access,
+        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
+      }
+    };
+    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
+    createdNode.application = application.created;
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "access-token-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources
+    });
+  }
+  await configureCloudflareWorkerAccessSecrets({
+    accountId: coordinates.accountId,
+    scriptName: coordinates.workerScriptName,
+    credentials: serviceToken.credentials,
+    apiToken: tokenFor(tokens, "workerApiToken")
+  }, fetcher);
+  for (const node of resources.nodes) {
+    await configureCloudflareEdge({
+      accountId: coordinates.accountId,
+      zoneId: coordinates.zoneId,
+      tunnelId: node.tunnelId,
+      hostname: node.hostname,
+      service: node.service,
+      apiToken: tokenFor(tokens, "tunnelApiToken"),
+      tunnelApiToken: tokenFor(tokens, "tunnelApiToken"),
+      dnsApiToken: tokenFor(tokens, "dnsApiToken")
+    }, fetcher);
+  }
+  const output = {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap",
+    phase: "complete",
+    updatedAt: new Date().toISOString(),
+    coordinates,
+    resources,
+    created: {
+      tunnel: createdNodes.some(({ tunnel }) => tunnel),
+      kvNamespace: namespace.created,
+      serviceToken: serviceToken.created,
+      policy: policy.created,
+      application: createdNodes.some(({ application }) => application),
+      privateNetwork: privateNetworkCreated,
+      workerDeployed: true,
+      nodes: createdNodes
+    }
+  };
+  await writeOwnerBootstrapOutput(absoluteOutput, output);
+  return output;
+}
+async function runAttendedCloudflareBootstrap(request2, dependencies = {}) {
+  const plan = planCloudflareBootstrap(request2.coordinates, request2.checkpointPath);
+  if (request2.mode === "plan") {
+    return {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap-evidence",
+      phase: "planned",
+      checkpointFile: plan.outputFile,
+      workerScriptName: plan.coordinates.workerScriptName,
+      publicDomains: plan.coordinates.publicDomains,
+      nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
+    };
+  }
+  if (!request2.tokenFiles || !Object.values(request2.tokenFiles).some(Boolean)) {
+    throw new Error("Cloudflare apply requires owner-only management token file paths");
+  }
+  if (plan.coordinates.createRuntimeTokens && !request2.tokenFiles.apiTokenFile) {
+    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
+  }
+  const tokens = await readCloudflareBootstrapTokens(request2.tokenFiles);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-evidence",
+    phase: "complete",
+    checkpointFile: plan.outputFile,
+    kvNamespaceId: output.resources.kvNamespaceId,
+    workerScriptName: output.coordinates.workerScriptName,
+    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
+    runtimeTokenIds: {
+      kv: output.resources.runtimeTokens?.kv.id,
+      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
+    },
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+      nodeName,
+      hostname,
+      tunnelId,
+      applicationId
+    }))
+  };
+}
+
+// src/bootstrap.ts
+init_dist();
+var PLATFORM_BOOTSTRAP_PROFILES = [
+  "platform-db-api",
+  "platform-api"
+];
+var STATE_PATH = "/var/lib/forgezero/bootstrap.json";
+var CREDS = "/etc/forgezero/creds";
+var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
+var TUNNEL_CREDENTIAL = `${CREDS}/cloudflared-token.cred`;
+var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
+var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
+var WARP_CLIENT_ID_CREDENTIAL = `${CREDS}/warp-auth-client-id.cred`;
+var WARP_CLIENT_SECRET_CREDENTIAL = `${CREDS}/warp-auth-client-secret.cred`;
+var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
+var PLATFORM_ENROL_SOURCE = "/run/forgezero-platform-enrol-token";
+var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
+var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
+var PACKAGED_AGENT_BIN = fileURLToPath(new URL("./fz-agent.js", import.meta.url));
+var privateOrigin = (value) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`database coordinator is malformed: ${value}`);
+  }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error(`database coordinators must be credential-free HTTP(S) origins: ${value}`);
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const v4 = host.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/)?.slice(1).map(Number);
+  const privateV4 = v4 && v4.every((part) => part >= 0 && part <= 255) && (v4[0] === 10 || v4[0] === 172 && v4[1] >= 16 && v4[1] <= 31 || v4[0] === 192 && v4[1] === 168);
+  const privateV6 = host === "::1" || /^f[cd][0-9a-f]:/i.test(host);
+  if (!privateV4 && !privateV6 && host !== "127.0.0.1" && host !== "localhost") {
+    throw new Error(`database coordinator must use a private address: ${value}`);
+  }
+  return url.origin;
+};
+var privateCidr = (value) => {
+  const match = value.match(/^(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\/(\d|[12]\d|3[0-2])$/);
+  if (!match || match[1].split(".").some((part) => Number(part) > 255))
+    throw new Error(`private firewall CIDR is malformed: ${value}`);
+  return value;
+};
+var privateFile = (host, path, label) => {
+  if (!host.exists(path))
+    throw new Error(`${label} file is missing: ${path}`);
+  const metadata = host.inspect?.(path);
+  if (metadata && (!metadata.regular || metadata.symbolic || metadata.uid !== 0 || metadata.links !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 16 * 1024)) {
+    throw new Error(`${label} must be a root-owned, owner-only regular file with one link and at most 16 KiB`);
+  }
+  const value = host.read(path).trim();
+  if (!value)
+    throw new Error(`${label} file is empty: ${path}`);
+  return value;
+};
+function validateBootstrapConfig(value) {
+  if (!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?){2,}$/.test(value.nodeHostname)) {
+    throw new Error("node hostname must be a lowercase public FQDN");
+  }
+  let telemetry;
+  try {
+    telemetry = new URL(value.telemetryEndpoint);
+  } catch {
+    throw new Error("telemetry endpoint is malformed");
+  }
+  if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
+    throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
+  }
+  if (value.kind === "tenant") {
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
+      throw new Error("tenant realm is malformed");
+    if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
+      throw new Error("tenant API must be public HTTPS or loopback HTTP");
+    }
+    if (!value.enrolTokenFile)
+      throw new Error("tenant bootstrap requires --enrol-token-file");
+    if (value.bootstrapRunner) {
+      if (!value.bootstrapRunner.sshPrivateKeyFile.startsWith("/") || /[\r\n]/.test(value.bootstrapRunner.sshPrivateKeyFile)) {
+        throw new Error("bootstrap runner SSH private-key file must be absolute");
+      }
+      let targetTelemetry;
+      try {
+        targetTelemetry = new URL(value.bootstrapRunner.targetTelemetryEndpoint);
+      } catch {
+        throw new Error("bootstrap target telemetry endpoint is malformed");
+      }
+      if (targetTelemetry.protocol !== "https:" || targetTelemetry.username || targetTelemetry.password || targetTelemetry.search || targetTelemetry.hash || targetTelemetry.port && targetTelemetry.port !== "443") {
+        throw new Error("bootstrap target telemetry must be public HTTPS on port 443");
+      }
+    }
+    return value;
+  }
+  if (!PLATFORM_BOOTSTRAP_PROFILES.includes(value.profile))
+    throw new Error("unsupported platform software profile");
+  if (!["production", "development"].includes(value.environment))
+    throw new Error("platform environment must be production or development");
+  let api;
+  try {
+    api = new URL(value.apiUrl);
+  } catch {
+    throw new Error("platform API URL is malformed");
+  }
+  if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash) {
+    throw new Error("platform API must be public HTTPS without credentials, query or fragment");
+  }
+  const expected = value.profile === "platform-api" ? { role: "none", mode: "default" } : { role: undefined, mode: "default" };
+  if (expected.role && value.database.role !== expected.role || value.database.serverMode !== expected.mode || value.profile === "platform-db-api" && !["master", "joiner"].includes(value.database.role)) {
+    throw new Error("platform profile, database role and Coordinator mode disagree");
+  }
+  if (value.database.role !== "none" && !value.database.address)
+    throw new Error("database nodes require a private address");
+  if (value.database.role === "joiner" && !value.database.master)
+    throw new Error("database joiners require the master starter address");
+  if (!/^(?:dev-)?fz-n[1-9][0-9]{0,2}$/.test(value.computeReference))
+    throw new Error("platform compute reference is malformed");
+  if (!value.database.bootstrapSecretFile)
+    throw new Error("platform bootstrap requires the shared cluster bootstrap-code file");
+  const write = value.database.coordinators.map(privateOrigin);
+  if (write.length < 1 || write.length > 16 || new Set(write).size !== write.length) {
+    throw new Error("database coordinators must contain 1-16 unique private origins");
+  }
+  value.database.coordinators = write;
+  const runtime = validatePlatformSharedEnvironment(value.runtime.environment, {
+    allowPendingCloudflareHandoff: Boolean(value.cloudflareHandoff)
+  });
+  if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.repository !== value.repository || runtime.branch !== value.branch || runtime.databaseCoordinators.join(",") !== write.join(",")) {
+    throw new Error("platform runtime coordinates disagree with immutable bootstrap coordinates");
+  }
+  if (runtime.deployProfile !== value.environment)
+    throw new Error("runtime deployment profile disagrees with bootstrap environment");
+  if (value.database.address !== runtime.databaseAddress || value.database.master !== runtime.databaseMaster) {
+    throw new Error("runtime database topology disagrees with bootstrap topology");
+  }
+  if (!Number.isSafeInteger(value.firewall.sshPort) || value.firewall.sshPort < 1 || value.firewall.sshPort > 65535) {
+    throw new Error("firewall SSH port is invalid");
+  }
+  value.firewall.privateCidrs = value.firewall.privateCidrs.map(privateCidr);
+  if (value.firewall.enabled && (value.firewall.privateCidrs.length < 1 || new Set(value.firewall.privateCidrs).size !== value.firewall.privateCidrs.length)) {
+    throw new Error("enabled firewall requires unique private cluster CIDRs");
+  }
+  if (Number(value.computeReference.match(/n(\d+)$/)?.[1]) > 3 && !value.platformEnrolTokenFile) {
+    throw new Error("post-genesis platform computes require an API-issued enrolment token file");
+  }
+  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.checkpointFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
+    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  }
+  value.runtime.environment = runtime;
+  return value;
+}
+function planBootstrap(input, initialized = false) {
+  const config = validateBootstrapConfig(structuredClone(input));
+  const software = config.kind === "tenant" ? [
+    ...config.software ?? [],
+    ...config.bootstrapRunner && !config.software?.some(({ id: id2 }) => id2 === "openssh-client") ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
+    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : []
+  ] : [
+    ...config.firewall.enabled ? [{ id: "ufw", version: "ubuntu-26.04" }] : [],
+    { id: "bun", version: "1.3.14" },
+    { id: "nginx", version: "ubuntu-26.04" },
+    ...config.profile === "platform-api" ? [] : [{ id: "arangodb", version: "3.11.14" }],
+    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : []
+  ];
+  return {
+    kind: config.kind,
+    mode: initialized ? "repair" : "install",
+    profile: config.kind === "platform" ? config.profile : config.profile ?? "tenant-managed",
+    software,
+    statePath: STATE_PATH,
+    steps: [
+      { id: "agent", label: "Install and verify the common Agent supervision boundary", mutation: true },
+      { id: "software", label: "Install exact Agent-owned software coordinates in order", mutation: true },
+      { id: "credentials", label: "Seal bootstrap credentials with systemd-creds", mutation: true },
+      ...config.kind === "platform" && config.database.role !== "none" ? [{ id: "database", label: "Provision Community 3.11.14 cluster and Coordinator mode", mutation: true }] : [],
+      ...config.kind === "platform" ? [
+        { id: "runtime", label: "Install the shared environment, API slots, edge and activation boundary", mutation: true },
+        { id: "deploy", label: "Create the first invite when required and health-gate the initial deployment", mutation: true },
+        { id: "enrol", label: "Consume the API-bound platform capability and enable signed control", mutation: true }
+      ] : [],
+      ...config.installCloudflared ? [{ id: "cloudflared-install-only", label: "Install cloudflared without creating Cloudflare resources", mutation: true }] : [],
+      { id: "state", label: "Persist immutable bootstrap profile and evidence coordinates", mutation: true },
+      { id: "status", label: "Verify services and immutable profile", mutation: false }
+    ]
+  };
+}
+var checked = async (host, argv, label, options) => {
+  const result = await host.exec(argv, options);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed: ${result.output.trim()}`);
+  return result.output;
+};
+var shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+var unitEscape = (value) => {
+  if (/[^A-Za-z0-9_./:@,+-]/.test(value))
+    throw new Error(`unsafe systemd coordinate: ${value}`);
+  return value;
+};
+function databaseUnit(config) {
+  const db = config.database;
+  const join6 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
+  return `[Unit]
+Description=ForgeZero ArangoDB Community 3.11.14 cluster (${db.role})
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=arangodb
+Group=arangodb
+LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join6}
+Restart=always
+RestartSec=5
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/forgezero-cluster
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function databaseVerifyUnit(config) {
+  const { address } = config.database;
+  return `[Unit]
+Description=Verify ForgeZero ArangoDB Community 3.11.14 writable Coordinator
+Requires=forgezero-db.service
+After=forgezero-db.service
+PartOf=forgezero-db.service
+
+[Service]
+Type=oneshot
+User=arangodb
+Group=arangodb
+LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default")quit(0);last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+RemainAfterExit=yes
+TimeoutStartSec=200
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function tunnelUnit() {
+  return `[Unit]
+Description=ForgeZero Cloudflare Tunnel connector
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+DynamicUser=yes
+LoadCredentialEncrypted=cloudflared-token:${TUNNEL_CREDENTIAL}
+ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate run --token-file %d/cloudflared-token
+Restart=always
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+var derive = (root, label) => {
+  if (!/^[a-f0-9]{64}$/i.test(root))
+    throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
+  return createHmac("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
+};
+async function seal(host, name, destination, value) {
+  if (host.exists(destination))
+    return;
+  const result = await host.exec(["systemd-creds", "encrypt", `--name=${name}`, "-", destination], { stdin: value });
+  if (result.exitCode !== 0)
+    throw new Error(`could not seal ${name}: ${result.output.trim()}`);
+}
+function stateFor(config) {
+  return `${JSON.stringify({
+    format: 1,
+    kind: config.kind,
+    profile: config.kind === "platform" ? config.profile : config.profile ?? "tenant-managed",
+    nodeHostname: config.nodeHostname,
+    apiUrl: config.apiUrl,
+    ...config.kind === "platform" ? {
+      environment: config.environment,
+      databaseRole: config.database.role,
+      databaseServerMode: config.database.serverMode,
+      databaseAddress: config.database.address,
+      databaseCoordinators: config.database.coordinators,
+      databaseModeEvidence: config.database.role === "none" ? undefined : DB_MODE_EVIDENCE,
+      collectorUnit: config.runtime.environment.otlpCollectorUnit,
+      cloudflared: Boolean(config.cloudflareHandoff)
+    } : { realm: config.realm }
+  }, null, 2)}
+`;
+}
+async function bootstrapStatus(host = localBootstrapHost()) {
+  if (!host.exists(STATE_PATH))
+    return { initialized: false, services: {}, problems: ["bootstrap state is missing"] };
+  let state;
+  try {
+    state = JSON.parse(host.read(STATE_PATH));
+  } catch {
+    return { initialized: false, services: {}, problems: ["bootstrap state is malformed"] };
+  }
+  const units = ["forgezero-agent.service", "forgezero-agent.socket"];
+  if (state.kind === "platform")
+    units.push("nginx.service");
+  if (state.kind === "platform" && state.collectorUnit)
+    units.push(state.collectorUnit);
+  if (state.kind === "platform" && state.cloudflared)
+    units.push("cloudflared.service");
+  if (state.kind === "platform" && state.databaseRole !== "none")
+    units.push("forgezero-db.service", "forgezero-db-verify.service");
+  const services = {};
+  const problems = [];
+  for (const unit of units) {
+    const result = await host.exec(["systemctl", "is-active", "--quiet", unit]);
+    services[unit] = result.exitCode === 0;
+    if (result.exitCode !== 0)
+      problems.push(`${unit} is not active`);
+  }
+  if (state.kind === "platform") {
+    const [blue, green] = await Promise.all([
+      host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
+      host.exec(["systemctl", "is-active", "--quiet", "forgezero@green.service"])
+    ]);
+    services["forgezero@active.service"] = blue.exitCode === 0 || green.exitCode === 0;
+    if (!services["forgezero@active.service"])
+      problems.push("neither API slot is active");
+  }
+  if (!host.exists("/var/lib/forgezero/enrolment.json"))
+    problems.push("durable Agent enrolment state is missing");
+  return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
+}
+async function applyBootstrap(input, host = localBootstrapHost()) {
+  const config = validateBootstrapConfig(structuredClone(input));
+  if (host.uid() !== 0)
+    throw new Error("fz bootstrap --apply must run as root");
+  if (config.kind === "tenant") {
+    const token = privateFile(host, config.enrolTokenFile, "tenant enrolment token");
+    if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(token))
+      throw new Error("tenant enrolment token is malformed");
+  }
+  let cloudflare;
+  if (config.kind === "platform" && config.cloudflareHandoff) {
+    cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.checkpointFile, config.cloudflareHandoff.nodeName);
+    const expected = config.runtime.environment.cloudflare;
+    if (cloudflare.hostname !== config.nodeHostname)
+      throw new Error("Cloudflare checkpoint hostname disagrees with platform node hostname");
+    if (expected && (cloudflare.service !== expected.tunnelService || cloudflare.accountId !== expected.accountId || cloudflare.zoneId !== expected.zoneId || cloudflare.kvNamespaceId !== expected.kvNamespaceId || cloudflare.tunnelId !== expected.tunnelId)) {
+      throw new Error("Cloudflare checkpoint disagrees with immutable platform runtime coordinates");
+    }
+    const discovered = {
+      accountId: cloudflare.accountId,
+      zoneId: cloudflare.zoneId,
+      kvNamespaceId: cloudflare.kvNamespaceId,
+      tunnelId: cloudflare.tunnelId,
+      tunnelService: cloudflare.service,
+      ...cloudflare.warp ? { warp: {
+        organization: cloudflare.warp.organization,
+        virtualNetworkId: cloudflare.warp.virtualNetworkId,
+        deviceProfileId: cloudflare.warp.deviceProfileId
+      } } : {}
+    };
+    if (expected && JSON.stringify(expected) !== JSON.stringify(discovered)) {
+      throw new Error("Cloudflare checkpoint disagrees with immutable WARP/runtime coordinates");
+    }
+    config.runtime.environment.cloudflare = expected ?? discovered;
+    if (config.runtime.environment.databaseNetworkMode === "cloudflare-warp" !== Boolean(cloudflare.warp)) {
+      throw new Error("Cloudflare checkpoint private-network mode disagrees with the platform database network mode");
+    }
+  }
+  const plan = planBootstrap(config, host.exists(STATE_PATH));
+  const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
+  host.mkdir(CREDS, 448);
+  host.mkdir("/var/lib/forgezero", 448);
+  if (config.kind === "tenant" && config.bootstrapRunner && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
+    await seal(host, "bootstrap-ssh-key", BOOTSTRAP_SSH_CREDENTIAL, privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key"));
+    host.remove(config.bootstrapRunner.sshPrivateKeyFile);
+  }
+  if (cloudflare?.warp) {
+    await seal(host, "warp-auth-client-id", WARP_CLIENT_ID_CREDENTIAL, cloudflare.warp.clientId);
+    await seal(host, "warp-auth-client-secret", WARP_CLIENT_SECRET_CREDENTIAL, cloudflare.warp.clientSecret);
+  }
+  await host.installAgent(config, alreadyEnrolled && config.kind === "platform" ? PLATFORM_ENROL_SOURCE : undefined);
+  if (config.kind === "platform" && config.firewall.enabled) {
+    await host.ensureSoftware(plan.software.filter(({ id: id2 }) => id2 === "ufw"));
+  } else
+    await host.ensureSoftware(plan.software);
+  if (config.kind === "platform" && config.firewall.enabled) {
+    await checked(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
+    await checked(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
+    await checked(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
+    for (const cidr of config.firewall.privateCidrs) {
+      if (config.database.role !== "none")
+        await checked(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
+      for (const port of [config.runtime.bluePort, config.runtime.greenPort])
+        await checked(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
+    }
+    await checked(host, ["ufw", "--force", "enable"], "firewall activation");
+    await host.ensureSoftware(plan.software.filter(({ id: id2 }) => id2 !== "ufw"));
+  }
+  if (config.kind === "platform") {
+    const root = privateFile(host, config.database.bootstrapSecretFile, "database bootstrap secret");
+    if (!host.exists(JWT_CREDENTIAL)) {
+      await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
+    }
+    await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
+    await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
+    const credentialFiles = config.runtime.credentialFiles ?? {};
+    for (const [name, source] of Object.entries({
+      "bootstrap-smtp-password": credentialFiles.smtpPassword,
+      "backup-s3-secret": credentialFiles.backupS3Secret
+    })) {
+      if (source) {
+        const destination = `${CREDS}/${name}.cred`;
+        if (!host.exists(destination)) {
+          await seal(host, name, destination, privateFile(host, source, name));
+          host.remove(source);
+        }
+      }
+    }
+    if (cloudflare) {
+      await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
+      if (cloudflare.privateNetworkRuntimeToken)
+        await seal(host, "cloudflare-network-token", `${CREDS}/cloudflare-network-token.cred`, cloudflare.privateNetworkRuntimeToken);
+    }
+    const runtime = config.runtime;
+    const envPath = `${runtime.environment.sharedDirectory}/.env`;
+    const credentials = platformApiCredentialSpecs({
+      smtp: Boolean(credentialFiles.smtpPassword),
+      cloudflareKv: Boolean(cloudflare),
+      cloudflareNetwork: Boolean(cloudflare?.privateNetworkRuntimeToken)
+    });
+    const units = renderPlatformApiUnits({
+      serviceUser: runtime.serviceUser,
+      sharedDirectory: runtime.environment.sharedDirectory,
+      sharedEnvironmentFile: envPath,
+      slotsDirectory: runtime.slotsDirectory,
+      bluePort: runtime.bluePort,
+      greenPort: runtime.greenPort,
+      collectorUnit: runtime.environment.otlpCollectorUnit,
+      credentials
+    });
+    const edge = renderPlatformNginx({ publicPort: runtime.environment.publicApiPort, initialSlotPort: runtime.bluePort });
+    const activation = renderPlatformActivationFiles({
+      root: config.deployRoot ?? "/opt/forgezero",
+      serviceUser: runtime.serviceUser,
+      bluePort: runtime.bluePort,
+      greenPort: runtime.greenPort,
+      healthPath: runtime.healthPath,
+      keepReleases: runtime.keepReleases
+    });
+    await checked(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
+      await checked(host, ["id", runtime.serviceUser], "existing API service account");
+    });
+    host.mkdir(runtime.environment.sharedDirectory, 488);
+    host.mkdir(runtime.slotsDirectory, 493);
+    host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
+    await checked(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
+    host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
+    host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
+    host.write("/etc/systemd/system/forgezero@green.service.d/port.conf", units.dropIns.green, 420);
+    host.write("/etc/nginx/conf.d/forgezero-upstream.conf", edge.upstream, 420);
+    host.write("/etc/nginx/conf.d/forgezero.conf", edge.site, 420);
+    host.write("/etc/forgezero/deploy.env", activation.environment, 420);
+    host.write("/usr/local/libexec/forgezero-activate", activation.helper, 493);
+    host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
+    await checked(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
+    const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
+    await checked(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    const otlpStatus = (await checked(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
+    if (!/^2\d\d$/.test(otlpStatus))
+      throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
+    await checked(host, ["nginx", "-t"], "nginx configuration");
+    await checked(host, ["systemctl", "daemon-reload"], "systemd reload");
+    await checked(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    if (config.database.role === "master") {
+      const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
+      if (!host.exists(invite)) {
+        host.write(invite, `plt_${randomBytes5(24).toString("hex")}
+`, 384);
+        await checked(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
+      }
+    }
+    if (config.database.role !== "none") {
+      host.mkdir("/var/lib/forgezero-cluster", 448);
+      await checked(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
+      host.write("/etc/systemd/system/forgezero-db.service", databaseUnit(config), 420);
+      host.write("/etc/systemd/system/forgezero-db-verify.service", databaseVerifyUnit(config), 420);
+      await checked(host, ["systemctl", "daemon-reload"], "database unit reload");
+      await checked(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
+      const evidence = {
+        expectedMode: "default",
+        role: "COORDINATOR",
+        unit: "forgezero-db-verify.service",
+        verifiedAt: new Date().toISOString()
+      };
+      host.write(DB_MODE_EVIDENCE, `${JSON.stringify(evidence, null, 2)}
+`, 384);
+    }
+    if (!alreadyEnrolled) {
+      const enrolToken = config.platformEnrolTokenFile ? privateFile(host, config.platformEnrolTokenFile, "platform enrolment token") : `fze_${derive(derive(root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}`;
+      if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolToken))
+        throw new Error("platform enrolment token is malformed");
+      host.write(PLATFORM_ENROL_SOURCE, `${enrolToken}
+`, 384);
+    }
+    await checked(host, [
+      "runuser",
+      "-u",
+      "forgezero-agent",
+      "--",
+      "/usr/local/bin/fz-agent",
+      "deploy",
+      ...config.database.role === "master" ? ["--release-executor"] : []
+    ], "initial Agent deployment");
+    if (!alreadyEnrolled) {
+      await host.installAgent(config, PLATFORM_ENROL_SOURCE);
+      if (config.platformEnrolTokenFile)
+        host.remove(config.platformEnrolTokenFile);
+    }
+  }
+  if (config.kind === "platform" && cloudflare) {
+    if (!host.exists(TUNNEL_CREDENTIAL)) {
+      await seal(host, "cloudflared-token", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
+    }
+    host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
+    await checked(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
+    await checked(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
+  }
+  host.write(STATE_PATH, stateFor(config), 384);
+  const status = await bootstrapStatus(host);
+  if (!status.initialized)
+    throw new Error(`bootstrap verification failed: ${status.problems.join("; ")}`);
+  let launch;
+  if (config.kind === "platform" && config.database.role === "master") {
+    const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
+    if (!host.exists(invitePath))
+      throw new Error("platform invite is missing after deployment");
+    const token = host.read(invitePath).trim();
+    if (!/^plt_[a-f0-9]{48}$/.test(token))
+      throw new Error("platform invite is malformed");
+    launch = {
+      command: `sudo -u ${shellQuote(config.runtime.serviceUser)} env FZ_SHARED_DIR=${shellQuote(config.runtime.environment.sharedDirectory)} /usr/local/bin/fz genesis --mode 2-of-3 --api ${shellQuote(config.apiUrl)} --app ${shellQuote(config.runtime.environment.appOrigin)}`,
+      inviteUrl: `${config.runtime.environment.appOrigin}/invite?token=${encodeURIComponent(token)}`
+    };
+  }
+  return { plan, applied: true, status, ...launch ? { launch } : {} };
+}
+var exactKeys2 = (value, allowed, label) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  const record2 = value;
+  const unknown = Object.keys(record2).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`${label} contains unknown fields: ${unknown.join(", ")}`);
+  return record2;
+};
+function strictBootstrapDocument(value) {
+  const root = exactKeys2(value, [
+    "kind",
+    "environment",
+    "profile",
+    "computeReference",
+    "nodeHostname",
+    "apiUrl",
+    "repository",
+    "branch",
+    "deployRoot",
+    "telemetryEndpoint",
+    "database",
+    "platformEnrolTokenFile",
+    "runtime",
+    "firewall",
+    "installCloudflared",
+    "cloudflareHandoff",
+    "realm",
+    "enrolTokenFile",
+    "software",
+    "bootstrapRunner"
+  ], "bootstrap config");
+  if (root.kind === "platform") {
+    exactKeys2(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
+    if (root.cloudflareHandoff !== undefined)
+      exactKeys2(root.cloudflareHandoff, ["checkpointFile", "nodeName"], "Cloudflare handoff");
+    exactKeys2(root.database, ["role", "serverMode", "address", "master", "coordinators", "bootstrapSecretFile"], "database config");
+    const runtime = exactKeys2(root.runtime, [
+      "environment",
+      "serviceUser",
+      "slotsDirectory",
+      "bluePort",
+      "greenPort",
+      "healthPath",
+      "keepReleases",
+      "credentialFiles"
+    ], "runtime config");
+    exactKeys2(runtime.environment, [
+      "softwareProfile",
+      "databaseRole",
+      "databaseCoordinators",
+      "databaseAddress",
+      "databaseMaster",
+      "databaseNetworkMode",
+      "databaseReplicationFactor",
+      "databaseWriteConcern",
+      "nodeHostname",
+      "nodeRegion",
+      "databaseUser",
+      "nodeRole",
+      "appOrigin",
+      "apiOrigin",
+      "publicApiPort",
+      "sharedDirectory",
+      "seedSyncPeers",
+      "seedSyncMembers",
+      "seedSyncEpoch",
+      "concurrencyLimit",
+      "drainDeadlineMs",
+      "otlpEndpoint",
+      "otlpCollectorUnit",
+      "agentOtlpEndpoint",
+      "custodianEmail",
+      "smtp",
+      "repository",
+      "branch",
+      "deployProfile",
+      "otlpFlushIntervalMs",
+      "otlpTraceSampleRatio",
+      "backup",
+      "cloudflare"
+    ], "runtime environment");
+    if (runtime.credentialFiles !== undefined)
+      exactKeys2(runtime.credentialFiles, ["smtpPassword", "backupS3Secret"], "runtime credential files");
+    const environment = runtime.environment;
+    if (environment.smtp !== undefined)
+      exactKeys2(environment.smtp, ["host", "port", "user", "from"], "SMTP config");
+    if (environment.backup !== undefined)
+      exactKeys2(environment.backup, ["endpoint", "region", "bucket", "accessKeyId"], "backup config");
+    if (environment.cloudflare !== undefined)
+      exactKeys2(environment.cloudflare, ["accountId", "zoneId", "kvNamespaceId", "tunnelId", "tunnelService", "warp"], "Cloudflare runtime config");
+    if (environment.cloudflare && typeof environment.cloudflare === "object" && environment.cloudflare.warp !== undefined) {
+      exactKeys2(environment.cloudflare.warp, ["organization", "virtualNetworkId", "deviceProfileId"], "Cloudflare WARP runtime config");
+    }
+  } else if (root.kind === "tenant") {
+    if (root.bootstrapRunner !== undefined)
+      exactKeys2(root.bootstrapRunner, ["sshPrivateKeyFile", "targetTelemetryEndpoint"], "bootstrap runner config");
+    for (const key of ["environment", "profile", "computeReference", "database", "platformEnrolTokenFile", "runtime", "cloudflareHandoff"]) {
+      if (root[key] !== undefined && key !== "profile")
+        throw new Error(`tenant bootstrap cannot contain ${key}`);
+    }
+  } else
+    throw new Error("bootstrap config kind must be platform or tenant");
+  return value;
+}
+function readBootstrapConfig(path) {
+  const metadata = lstatSync2(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
+    throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
+  }
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync4(path, "utf8"))));
+}
+function localBootstrapHost() {
+  const execute = async (argv, options = {}) => {
+    const child = Bun.spawn([...argv], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
+    if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
+      child.stdin.write(options.stdin);
+      child.stdin.end();
+    }
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  };
+  return {
+    uid: () => process.getuid?.() ?? -1,
+    exists: existsSync4,
+    read: (path) => readFileSync4(path, "utf8"),
+    write(path, content, mode) {
+      mkdirSync4(dirname4(path), { recursive: true, mode: 493 });
+      const temporary = `${path}.next.${process.pid}`;
+      writeFileSync4(temporary, content, { mode });
+      chmodSync2(temporary, mode);
+      renameSync3(temporary, path);
+    },
+    mkdir: (path, mode) => mkdirSync4(path, { recursive: true, mode }),
+    remove: (path) => rmSync(path, { force: true }),
+    inspect(path) {
+      const value = lstatSync2(path);
+      return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
+    },
+    exec: execute,
+    async ensureSoftware(requirements) {
+      const result = await execute([
+        "runuser",
+        "-u",
+        "forgezero-agent",
+        "--",
+        "/usr/local/bin/fz-agent",
+        "software-ensure",
+        ...requirements.map(({ id: id2, version }) => `--require=${id2}@${version}`)
+      ]);
+      if (result.exitCode !== 0)
+        throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
+      return result;
+    },
+    async installAgent(config, enrolTokenSourcePath) {
+      const capabilities = await readCapabilities(localRunner);
+      const deployRoot = config.deployRoot ?? "/opt/forgezero";
+      if (config.kind === "platform") {
+        const lifecycle = config.database.role === "none" ? {
+          apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
+          apiHealthUrl: "http://127.0.0.1:3000/api/health"
+        } : {
+          apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
+          databaseUnit: "forgezero-db.service",
+          apiHealthUrl: "http://127.0.0.1:3000/api/health",
+          databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
+          databasePorts: [8529]
+        };
+        mkdirSync4(dirname4(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync4(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+`, { mode: 256 });
+      }
+      const plan = planInstall({
+        capabilities,
+        socketPath: DEFAULT_SOCKET,
+        seedPath: "/var/lib/forgezero/node.seed",
+        controlSocketPath: "/run/forgezero/control.sock",
+        repository: config.repository,
+        branch: config.branch,
+        profile: config.kind === "platform" ? config.profile : config.profile,
+        deployRoot,
+        publicApiUrl: config.apiUrl,
+        gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
+        gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
+        generateGitIdentity: true,
+        pullDeployments: true,
+        pullMigrations: config.kind === "platform",
+        pullBootstrap: config.kind === "tenant" && Boolean(config.bootstrapRunner),
+        bootstrapSshCredentialPath: config.kind === "tenant" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+        bootstrapTargetTelemetryEndpoint: config.kind === "tenant" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
+        lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
+        ...config.kind === "platform" && config.runtime.environment.cloudflare?.warp ? {
+          warpOrganization: config.runtime.environment.cloudflare.warp.organization,
+          warpClientIdCredentialPath: WARP_CLIENT_ID_CREDENTIAL,
+          warpClientSecretCredentialPath: WARP_CLIENT_SECRET_CREDENTIAL,
+          cloudflareAccountId: config.runtime.environment.cloudflare.accountId,
+          cloudflareTunnelId: config.runtime.environment.cloudflare.tunnelId,
+          cloudflareVirtualNetworkId: config.runtime.environment.cloudflare.warp.virtualNetworkId,
+          cloudflareWarpPolicyId: config.runtime.environment.cloudflare.warp.deviceProfileId
+        } : {},
+        enforceEgress: true,
+        nodeHostname: config.nodeHostname,
+        telemetryEndpoint: config.telemetryEndpoint,
+        binPath: "/usr/local/lib/forgezero/agent/fz-agent",
+        sourceBinPath: PACKAGED_AGENT_BIN,
+        ...config.kind === "tenant" || enrolTokenSourcePath ? {
+          enrolTokenSourcePath: config.kind === "tenant" ? config.enrolTokenFile : enrolTokenSourcePath,
+          enrolTokenCredentialPath: ENROL_CREDENTIAL,
+          enrolStatePath: "/var/lib/forgezero/enrolment.json",
+          apiUrl: config.apiUrl,
+          project: config.kind === "tenant" ? config.realm : "platform",
+          environment: config.kind === "tenant" ? undefined : config.environment,
+          nodeLabel: config.kind === "tenant" ? config.nodeHostname : config.computeReference
+        } : {}
+      });
+      for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
+        mkdirSync4(dirname4(unit.path), { recursive: true, mode: 493 });
+        writeFileSync4(unit.path, unit.unit, { mode: 420 });
+      }
+      await applyPlan(plan, localRunner);
+      return plan;
+    }
+  };
+}
+
+// src/cli/cloudflare-bootstrap.ts
+import { constants as constants2, closeSync, fstatSync, openSync, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname5, resolve as resolve3 } from "path";
+var exactKeys3 = (value, allowed, label) => {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`${label} contains unsupported field ${unknown[0]}`);
+};
+var record2 = (value, label) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  return value;
+};
+function readOwnerConfig(path) {
+  const absolute = resolve3(path);
+  let descriptor;
+  try {
+    descriptor = openSync(absolute, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    const metadata = fstatSync(descriptor);
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size < 2 || metadata.size > 131072 || uid !== undefined && metadata.uid !== uid || (metadata.mode & 63) !== 0) {
+      throw new Error(`${absolute} must be one operator-owned 0600 regular file`);
+    }
+    return JSON.parse(readFileSync5(descriptor, "utf8"));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error(`${absolute} is not valid Cloudflare bootstrap JSON`);
+    if (cause instanceof Error && cause.message.startsWith(absolute))
+      throw cause;
+    throw new Error(`cannot securely read Cloudflare bootstrap config ${absolute}`);
+  } finally {
+    if (descriptor !== undefined)
+      closeSync(descriptor);
+  }
+}
+function readCloudflareBootstrapCommandConfig(path, mode) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
+  const baseDirectory = dirname5(resolve3(path));
+  exactKeys3(input, ["format", "kind", "checkpointPath", "coordinates", "tokenFiles"], "Cloudflare bootstrap config");
+  if (input.format !== 1 || input.kind !== "forgezero-cloudflare-bootstrap-request") {
+    throw new Error("Cloudflare bootstrap config format/kind is invalid");
+  }
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  const coordinateSource = record2(input.coordinates, "Cloudflare bootstrap coordinates");
+  exactKeys3(coordinateSource, [
+    "accountId",
+    "zoneId",
+    "hostname",
+    "service",
+    "tunnelName",
+    "kvNamespaceTitle",
+    "workerScriptName",
+    "serviceTokenName",
+    "policyName",
+    "applicationName",
+    "workerDirectory",
+    "workerMain",
+    "workerCompatibilityDate",
+    "publicDomains",
+    "createRuntimeTokens",
+    "createPrivateNetworkRuntimeToken",
+    "runtimeTokenNamePrefix",
+    "nodes",
+    "privateNetwork"
+  ], "Cloudflare bootstrap coordinates");
+  if (coordinateSource.nodes !== undefined) {
+    if (!Array.isArray(coordinateSource.nodes))
+      throw new Error("Cloudflare bootstrap coordinates.nodes must be an array");
+    for (const node of coordinateSource.nodes) {
+      exactKeys3(record2(node, "Cloudflare bootstrap node"), [
+        "nodeName",
+        "hostname",
+        "service",
+        "tunnelName",
+        "applicationName",
+        "privateAddress"
+      ], "Cloudflare bootstrap node");
+    }
+  }
+  if (coordinateSource.privateNetwork !== undefined) {
+    exactKeys3(record2(coordinateSource.privateNetwork, "Cloudflare bootstrap privateNetwork"), [
+      "warpOrganization",
+      "virtualNetworkName",
+      "deviceProfileName",
+      "enrollmentApplicationName",
+      "deviceProfilePrecedence"
+    ], "Cloudflare bootstrap privateNetwork");
+  }
+  if (typeof coordinateSource.workerDirectory !== "string" || !coordinateSource.workerDirectory.trim()) {
+    throw new Error("Cloudflare bootstrap coordinates.workerDirectory is required");
+  }
+  const coordinates = validateCloudflareBootstrapCoordinates({
+    ...coordinateSource,
+    workerDirectory: resolve3(baseDirectory, coordinateSource.workerDirectory)
+  });
+  let tokenFiles;
+  if (input.tokenFiles !== undefined) {
+    const source = record2(input.tokenFiles, "Cloudflare bootstrap tokenFiles");
+    const keys = [
+      "apiTokenFile",
+      "tunnelApiTokenFile",
+      "dnsApiTokenFile",
+      "kvApiTokenFile",
+      "accessApiTokenFile",
+      "workerApiTokenFile"
+    ];
+    exactKeys3(source, keys, "Cloudflare bootstrap tokenFiles");
+    for (const key of keys) {
+      if (source[key] !== undefined && (typeof source[key] !== "string" || !source[key].trim())) {
+        throw new Error(`Cloudflare bootstrap tokenFiles.${key} must be a non-empty file path`);
+      }
+    }
+    tokenFiles = Object.fromEntries(keys.flatMap((key) => typeof source[key] === "string" ? [[key, resolve3(baseDirectory, source[key])]] : []));
+  }
+  if (mode === "apply" && (!tokenFiles || !Object.values(tokenFiles).some(Boolean))) {
+    throw new Error("Cloudflare apply config requires tokenFiles with owner-only file paths");
+  }
+  return {
+    mode,
+    coordinates,
+    checkpointPath: resolve3(baseDirectory, input.checkpointPath),
+    ...tokenFiles ? { tokenFiles } : {}
+  };
+}
+async function runCloudflareBootstrapCommand(configPath, apply, dependencies = {}) {
+  const request2 = readCloudflareBootstrapCommandConfig(configPath, apply ? "apply" : "plan");
+  const evidence = await (dependencies.run ?? runAttendedCloudflareBootstrap)(request2);
+  (dependencies.write ?? ((text3) => process.stdout.write(text3)))(`${JSON.stringify(evidence, null, 2)}
+`);
+  return evidence;
+}
+
+// src/metal-bootstrap.ts
+import { createHash as createHash3, randomBytes as randomBytes6 } from "crypto";
+import {
+  chmodSync as chmodSync3,
+  chownSync,
+  copyFileSync,
+  existsSync as existsSync5,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync6,
+  realpathSync,
+  renameSync as renameSync4,
+  statSync,
+  symlinkSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync6
+} from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join8, resolve as resolve4 } from "path";
+import { isIP as isIP5 } from "net";
+
+// src/metal-isolation.ts
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join7 } from "path";
+
+// src/metal-provision.ts
+import { dirname as dirname6, isAbsolute, join as join6 } from "path";
+import { isIP as isIP4 } from "net";
+
+// src/ubuntu.ts
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: "ubuntu-resolute-20260731",
+  family: "ubuntu-26.04",
+  version: "2026-07-31",
+  label: "Ubuntu 26.04 LTS Resolute",
+  url: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+  sha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05"
+});
+
+// src/metal-provision.ts
+var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
+var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
+var IPV4_PREFIX = /^(?:25[0-5]|2[0-4]\d|1?\d?\d)\.(?:25[0-5]|2[0-4]\d|1?\d?\d)\.(?:25[0-5]|2[0-4]\d|1?\d?\d)$/;
+var LINUX_LIST = /^\d+(?:-\d+)?(?:,\d+(?:-\d+)?)*$/;
+
+class MetalProvisionError extends Error {
+}
+function membersOfLinuxList(value, label) {
+  if (!LINUX_LIST.test(value))
+    throw new MetalProvisionError(`invalid ${label} list`);
+  const members = [];
+  for (const part of value.split(",")) {
+    const [startText, endText = startText] = part.split("-");
+    const start = Number(startText);
+    const end = Number(endText);
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start || end > 65535) {
+      throw new MetalProvisionError(`invalid ${label} list`);
+    }
+    for (let value2 = start;value2 <= end; value2 += 1)
+      members.push(value2);
+  }
+  if (new Set(members).size !== members.length)
+    throw new MetalProvisionError(`${label} list overlaps itself`);
+  return members;
+}
+function validateMetalProfile(profile) {
+  if (!SAFE_NAME.test(profile.volumeGroup))
+    throw new MetalProvisionError("invalid volume group");
+  if (!DEVICE.test(profile.bridge))
+    throw new MetalProvisionError("invalid bridge");
+  if (!IPV4_PREFIX.test(profile.subnetPrefix))
+    throw new MetalProvisionError("invalid subnet prefix");
+  if (!Number.isInteger(profile.addressStart) || !Number.isInteger(profile.addressEnd) || profile.addressStart < 2 || profile.addressEnd > 254 || profile.addressStart > profile.addressEnd)
+    throw new MetalProvisionError("invalid guest address range");
+  for (const path of [profile.stateDir, profile.seedDir, profile.unitDir]) {
+    if (!isAbsolute(path))
+      throw new MetalProvisionError("metal paths must be absolute");
+  }
+  new URL(profile.apiUrl);
+  let telemetryEndpoint;
+  try {
+    telemetryEndpoint = new URL(profile.agentTelemetryEndpoint);
+  } catch {
+    throw new MetalProvisionError("Agent telemetry endpoint must be an absolute public HTTPS URL");
+  }
+  if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP4(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
+    throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
+  const imageKeys = Object.keys(profile.images);
+  if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
+    throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
+  }
+  if (!Array.isArray(profile.cpuPools) || profile.cpuPools.length === 0) {
+    throw new MetalProvisionError("at least one exclusive CPU pool is required");
+  }
+  const keys = new Set;
+  const assigned = new Set;
+  const assignedMemory = new Set;
+  let poolsWithMemory = 0;
+  for (const pool of profile.cpuPools) {
+    if (!SAFE_NAME.test(pool.key) || keys.has(pool.key))
+      throw new MetalProvisionError("invalid or duplicate CPU pool key");
+    keys.add(pool.key);
+    const cpus = membersOfLinuxList(pool.cpus, "CPU");
+    if (!Number.isInteger(pool.physicalCores) || pool.physicalCores < 1 || pool.physicalCores > cpus.length) {
+      throw new MetalProvisionError("invalid CPU pool physical-core count");
+    }
+    for (const cpu of cpus) {
+      if (assigned.has(cpu))
+        throw new MetalProvisionError("CPU pools overlap");
+      assigned.add(cpu);
+    }
+    if (pool.memoryNodes) {
+      poolsWithMemory += 1;
+      for (const node of membersOfLinuxList(pool.memoryNodes, "memory-node")) {
+        if (assignedMemory.has(node))
+          throw new MetalProvisionError("guest memory-node pools overlap");
+        assignedMemory.add(node);
+      }
+    }
+  }
+  if (poolsWithMemory !== 0 && poolsWithMemory !== profile.cpuPools.length) {
+    throw new MetalProvisionError("every CPU pool must name memory nodes when NUMA isolation is enabled");
+  }
+  const housekeeping = membersOfLinuxList(profile.housekeepingCpus, "housekeeping CPU");
+  if (housekeeping.some((cpu) => assigned.has(cpu))) {
+    throw new MetalProvisionError("housekeeping CPUs overlap guest CPU pools");
+  }
+  if (profile.housekeepingMemoryNodes) {
+    const housekeepingMemory = membersOfLinuxList(profile.housekeepingMemoryNodes, "housekeeping memory-node");
+    if (housekeepingMemory.some((node) => assignedMemory.has(node))) {
+      throw new MetalProvisionError("housekeeping memory nodes overlap guest memory-node pools");
+    }
+  } else if (assignedMemory.size > 0) {
+    throw new MetalProvisionError("NUMA-isolated guest pools require housekeeping memory nodes");
+  }
+}
+
+// src/metal-isolation.ts
+var members = (list) => list.split(",").flatMap((part) => {
+  const [first, last = first] = part.split("-").map(Number);
+  return Array.from({ length: last - first + 1 }, (_, index) => first + index);
+});
+var compact = (values) => {
+  const sorted = [...new Set(values)].sort((left, right) => left - right);
+  const ranges = [];
+  for (let index = 0;index < sorted.length; ) {
+    const first = sorted[index];
+    let last = first;
+    while (sorted[index + 1] === last + 1)
+      last = sorted[++index];
+    ranges.push(first === last ? String(first) : `${first}-${last}`);
+    index += 1;
+  }
+  return ranges.join(",");
+};
+var memoryDirective = (nodes) => nodes ? `AllowedMemoryNodes=${nodes}
+` : "";
+function metalGuestSliceUnit(profile) {
+  validateMetalProfile(profile);
+  const cpus = compact(profile.cpuPools.flatMap((pool) => members(pool.cpus)));
+  const nodes = compact(profile.cpuPools.flatMap((pool) => pool.memoryNodes ? members(pool.memoryNodes) : [])) || undefined;
+  return `[Unit]
+Description=ForgeZero exclusive guest CPU and memory boundary
+
+[Slice]
+AllowedCPUs=${cpus}
+${memoryDirective(nodes)}`;
+}
+function metalHousekeepingDropIn(profile, kind) {
+  validateMetalProfile(profile);
+  return `[${kind === "slice" ? "Slice" : "Scope"}]
+AllowedCPUs=${profile.housekeepingCpus}
+${memoryDirective(profile.housekeepingMemoryNodes)}`;
+}
+var defaultExec = async (argv) => {
+  const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe" });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text()
+  ]);
+  return { exitCode, stdout, stderr };
+};
+var checked2 = async (exec, argv) => {
+  const result = await exec(argv);
+  if (result.exitCode !== 0)
+    throw new Error(`${argv[0]} failed: ${(result.stderr || result.stdout).trim()}`);
+  return result;
+};
+var requireGuestsInSlice = async (exec) => {
+  const active = await checked2(exec, [
+    "systemctl",
+    "list-units",
+    "--type=service",
+    "--state=running",
+    "--plain",
+    "--no-legend",
+    "forgezero-guest@*.service"
+  ]);
+  for (const line of active.stdout.split(`
+`)) {
+    const service = line.trim().split(/\s+/)[0];
+    if (!service)
+      continue;
+    const cgroup = await checked2(exec, ["systemctl", "show", "-p", "ControlGroup", "--value", service]);
+    if (!cgroup.stdout.trim().includes("/forgezero-guests.slice/")) {
+      throw new Error(`${service} must be drained and restarted into forgezero-guests.slice`);
+    }
+  }
+};
+async function applyMetalIsolation(profile, exec = defaultExec) {
+  validateMetalProfile(profile);
+  await requireGuestsInSlice(exec);
+  const unitDir = profile.unitDir;
+  mkdirSync5(unitDir, { recursive: true });
+  writeFileSync5(join7(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  for (const unit of ["system.slice", "user.slice"]) {
+    const directory = join7(unitDir, `${unit}.d`);
+    mkdirSync5(directory, { recursive: true });
+    writeFileSync5(join7(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+  }
+  const initDirectory = join7(unitDir, "init.scope.d");
+  mkdirSync5(initDirectory, { recursive: true });
+  writeFileSync5(join7(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  await checked2(exec, ["systemctl", "daemon-reload"]);
+  await requireGuestsInSlice(exec);
+  const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
+  if (profile.housekeepingMemoryNodes)
+    properties.push(`AllowedMemoryNodes=${profile.housekeepingMemoryNodes}`);
+  for (const unit of ["system.slice", "user.slice", "init.scope"]) {
+    await checked2(exec, ["systemctl", "set-property", "--runtime", unit, ...properties]);
+  }
+}
+
+// src/metal-bootstrap.ts
+var PROFILE_PATH = "/etc/forgezero/metal.json";
+var STATE_PATH2 = "/etc/forgezero/metal.initialized.json";
+var SEED_CREDENTIAL_PATH = "/etc/forgezero/creds/metal-agent-seed.cred";
+var UNIT_DIRECTORY = "/etc/systemd/system";
+var AGENT_PATH = "/usr/local/bin/fz-agent";
+var HELPER_SOCKET = "/run/forgezero-metal/helper.sock";
+var UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
+var MAX_CONFIG_BYTES = 256 * 1024;
+var SUPPORTED_BUN_VERSION = "1.3.14";
+var SUPPORTED_BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
+
+class MetalBootstrapError extends Error {
+}
+var defaultExec2 = async (argv, stdin) => {
+  const child = Bun.spawn([...argv], {
+    stdin: stdin === undefined ? undefined : new Blob([stdin]),
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    child.exited,
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text()
+  ]);
+  return { exitCode, stdout, stderr };
+};
+var runChecked = async (exec, argv, stdin) => {
+  const result = await exec(argv, stdin);
+  if (result.exitCode !== 0) {
+    throw new MetalBootstrapError(`${argv.join(" ")} failed: ${(result.stderr || result.stdout).trim() || `exit ${result.exitCode}`}`);
+  }
+  return result;
+};
+var exactKeys4 = (value, allowed, label) => {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new MetalBootstrapError(`${label} contains unknown fields: ${unknown.join(", ")}`);
+};
+var validUnit = (unit) => {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}\.service$/.test(unit)) {
+    throw new MetalBootstrapError("hostTelemetryUnit must be a systemd .service unit");
+  }
+  if (/^(forgezero@.*|forgezero-agent|forgezero-metal-agent|forgezero-metal-helper|forgezero-db)\.service$/.test(unit)) {
+    throw new MetalBootstrapError("the OTLP collector must be independently supervised");
+  }
+};
+function validateMetalBootstrapConfig(config) {
+  if (!config || typeof config !== "object")
+    throw new MetalBootstrapError("metal bootstrap config must be an object");
+  exactKeys4(config, ["kind", "metalHostname", "profile", "hostTelemetryEndpoint", "hostTelemetryUnit", "agentSeedFile"], "metal bootstrap config");
+  if (config.kind !== "metal")
+    throw new MetalBootstrapError("metal bootstrap config kind must be metal");
+  if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(config.metalHostname)) {
+    throw new MetalBootstrapError("invalid metal inventory hostname");
+  }
+  if (!config.profile || typeof config.profile !== "object")
+    throw new MetalBootstrapError("metal profile must be an object");
+  exactKeys4(config.profile, [
+    "volumeGroup",
+    "bridge",
+    "subnetPrefix",
+    "addressStart",
+    "addressEnd",
+    "gateway",
+    "nameservers",
+    "stateDir",
+    "seedDir",
+    "unitDir",
+    "apiUrl",
+    "agentTelemetryEndpoint",
+    "images",
+    "cpuPools",
+    "housekeepingCpus",
+    "housekeepingMemoryNodes",
+    "bunVersion",
+    "bunInstallerSha256",
+    "agentVersion",
+    "confidential"
+  ], "metal profile");
+  if (Array.isArray(config.profile.cpuPools)) {
+    for (const pool of config.profile.cpuPools)
+      exactKeys4(pool, ["key", "cpus", "physicalCores", "memoryNodes"], "metal CPU pool");
+  }
+  validateMetalProfile(config.profile);
+  if (config.profile.stateDir !== "/etc/forgezero/metal-guests" || config.profile.seedDir !== "/var/lib/forgezero/seed" || config.profile.unitDir !== UNIT_DIRECTORY || config.profile.legacyStateDir !== undefined) {
+    throw new MetalBootstrapError("metal bootstrap uses fixed state, seed, and systemd unit directories");
+  }
+  const image = config.profile.images[Object.keys(config.profile.images)[0]];
+  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve4(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
+    throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
+  }
+  if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunInstallerSha256 !== SUPPORTED_BUN_INSTALLER_SHA256 || config.profile.agentVersion !== VERSION2) {
+    throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
+  }
+  let api;
+  try {
+    api = new URL(config.profile.apiUrl);
+  } catch {
+    throw new MetalBootstrapError("metal API must be a public HTTPS origin");
+  }
+  if (api.protocol !== "https:" || api.username || api.password || api.pathname !== "/" || api.search || api.hash || isIP5(api.hostname) !== 0 || !api.hostname.includes(".") || api.hostname.endsWith(".local")) {
+    throw new MetalBootstrapError("metal API must be a credential-free public HTTPS origin");
+  }
+  if (config.profile.nameservers?.some((address) => isIP5(address) === 0)) {
+    throw new MetalBootstrapError("metal nameservers must be literal IP addresses");
+  }
+  if (isIP5(`${config.profile.subnetPrefix}.1`) !== 4 || isIP5(config.profile.gateway) !== 4 || !config.profile.gateway.startsWith(`${config.profile.subnetPrefix}.`)) {
+    throw new MetalBootstrapError("metal gateway must be an IPv4 address in the reviewed subnet");
+  }
+  if (config.profile.confidential && (!Number.isSafeInteger(config.profile.confidential.cbitpos) || config.profile.confidential.cbitpos < 1 || config.profile.confidential.cbitpos > 63 || !Number.isSafeInteger(config.profile.confidential.reducedPhysBits) || config.profile.confidential.reducedPhysBits < 0 || config.profile.confidential.reducedPhysBits > 63 || !/^0x[0-9a-fA-F]{1,16}$/.test(config.profile.confidential.policy)))
+    throw new MetalBootstrapError("invalid confidential-compute coordinate");
+  if (config.hostTelemetryEndpoint !== "http://127.0.0.1:4318") {
+    throw new MetalBootstrapError("metal host OTLP must use exact loopback http://127.0.0.1:4318");
+  }
+  validUnit(config.hostTelemetryUnit);
+  if (config.agentSeedFile)
+    validateOwnerOnlyPath(config.agentSeedFile, false);
+  return config;
+}
+function validateOwnerOnlyPath(path, requireRootOwner) {
+  if (!isAbsolute2(path) || resolve4(path) !== path || path.includes("/../")) {
+    throw new MetalBootstrapError("private bootstrap paths must be canonical absolute paths");
+  }
+  const metadata = lstatSync3(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || realpathSync(path) !== path) {
+    throw new MetalBootstrapError("private bootstrap path must be a regular non-symlink file");
+  }
+  if ((metadata.mode & 63) !== 0)
+    throw new MetalBootstrapError("private bootstrap file must be owner-only");
+  const caller = typeof process.getuid === "function" ? process.getuid() : -1;
+  if (requireRootOwner && metadata.uid !== 0 || !requireRootOwner && metadata.uid !== 0 && metadata.uid !== caller) {
+    throw new MetalBootstrapError(requireRootOwner ? "private bootstrap file must be root-owned" : "private bootstrap file has an unexpected owner");
+  }
+}
+function readMetalBootstrapConfig(path) {
+  validateOwnerOnlyPath(path, false);
+  const metadata = statSync(path);
+  if (metadata.size < 2 || metadata.size > MAX_CONFIG_BYTES)
+    throw new MetalBootstrapError("metal bootstrap config size is invalid");
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
+  }
+  return validateMetalBootstrapConfig(parsed);
+}
+function planMetalBootstrap(config) {
+  validateMetalBootstrapConfig(config);
+  return {
+    kind: "metal",
+    metalHostname: config.metalHostname,
+    profilePath: PROFILE_PATH,
+    units: [
+      "forgezero-metal-helper.service",
+      "forgezero-agent-update-helper.service",
+      "forgezero-metal-agent-egress.service",
+      "forgezero-metal-agent.service"
+    ],
+    steps: [
+      "install fixed KVM/LVM/cloud-init/nftables prerequisites",
+      "verify bridge, volume group, pinned guest image, KVM and optional SEV device",
+      "install the published Agent binary and root-owned immutable metal profile",
+      "seal or generate the metal identity seed as a systemd credential",
+      "apply reviewed CPU/NUMA host and guest isolation",
+      "install helper, update, egress and identity-only Agent units",
+      "enable units and prove services, local sockets, egress policy and OTLP collector"
+    ],
+    requiresRoot: true,
+    consumes: config.agentSeedFile ? [config.agentSeedFile] : []
+  };
+}
+var atomicWrite2 = (path, body, mode) => {
+  mkdirSync6(dirname7(path), { recursive: true, mode: 493 });
+  const temporary = `${path}.next-${process.pid}`;
+  writeFileSync6(temporary, body, { mode, flag: "wx" });
+  chmodSync3(temporary, mode);
+  chownSync(temporary, 0, 0);
+  renameSync4(temporary, path);
+};
+var validateAgentSourcePath = (source) => {
+  if (!isAbsolute2(source) || !lstatSync3(source).isFile() || lstatSync3(source).isSymbolicLink()) {
+    throw new MetalBootstrapError("published Agent source path must be an absolute regular non-symlink file");
+  }
+};
+var ensureAccount = async (exec) => {
+  if ((await exec(["/usr/bin/getent", "group", "forgezero-metal"])).exitCode !== 0) {
+    await runChecked(exec, ["/usr/sbin/groupadd", "--system", "forgezero-metal"]);
+  }
+  if ((await exec(["/usr/bin/getent", "group", "forgezero-update"])).exitCode !== 0) {
+    await runChecked(exec, ["/usr/sbin/groupadd", "--system", "forgezero-update"]);
+  }
+  if ((await exec(["/usr/bin/id", "forgezero-metal"])).exitCode !== 0) {
+    await runChecked(exec, [
+      "/usr/sbin/useradd",
+      "--system",
+      "--no-create-home",
+      "--shell",
+      "/usr/sbin/nologin",
+      "--gid",
+      "forgezero-metal",
+      "forgezero-metal"
+    ]);
+  }
+  await runChecked(exec, ["/usr/sbin/usermod", "-a", "-G", "forgezero-update", "forgezero-metal"]);
+};
+function renderMetalUnits(config) {
+  validateMetalBootstrapConfig(config);
+  const egress = systemdAgentEgressDirectives([4318]);
+  const updateEgress = systemdAgentEgressDirectives();
+  return {
+    "forgezero-metal-helper.service": `[Unit]
+Description=ForgeZero constrained physical-host helper
+After=local-fs.target
+
+[Service]
+Type=simple
+User=root
+Group=forgezero-metal
+UMask=0007
+RuntimeDirectory=forgezero-metal
+RuntimeDirectoryMode=0770
+ExecStart=${AGENT_PATH} metal-helper --profile=${PROFILE_PATH}
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=10min
+LimitCORE=0
+PrivateTmp=true
+ProtectHome=true
+RestrictAddressFamilies=AF_UNIX
+
+[Install]
+WantedBy=multi-user.target
+`,
+    "forgezero-agent-update-helper.service": `[Unit]
+Description=ForgeZero verified Agent update helper
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=forgezero-update
+Environment=FZ_AGENT_UPDATE_SOCKET=${UPDATE_SOCKET}
+ExecStart=${AGENT_PATH} update-helper
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-update
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+ReadWritePaths=/opt/forgezero/agent /var/lib/forgezero
+${updateEgress}
+
+[Install]
+WantedBy=multi-user.target
+`,
+    "forgezero-metal-agent-egress.service": `[Unit]
+Description=ForgeZero physical Agent host egress policy
+After=systemd-resolved.service nftables.service
+Requires=systemd-resolved.service
+Before=forgezero-metal-agent.service
+
+[Service]
+Type=notify
+NotifyAccess=all
+User=root
+Group=root
+ExecStart=${AGENT_PATH} egress-policy --user=forgezero-metal --loopback-user=forgezero-metal --loopback-tcp-port=4318 --public-tcp-port=443
+Restart=on-failure
+RestartSec=2
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+CapabilityBoundingSet=CAP_NET_ADMIN
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+
+[Install]
+WantedBy=multi-user.target
+`,
+    "forgezero-metal-agent.service": `[Unit]
+Description=ForgeZero identity-only physical-host Agent
+After=network-online.target ${config.hostTelemetryUnit} forgezero-metal-helper.service forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+Wants=network-online.target ${config.hostTelemetryUnit}
+Requires=forgezero-metal-helper.service forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+BindsTo=forgezero-metal-agent-egress.service
+
+[Service]
+Type=simple
+User=forgezero-metal
+Group=forgezero-metal
+SupplementaryGroups=forgezero-update
+LoadCredentialEncrypted=metal-agent-seed:${SEED_CREDENTIAL_PATH}
+Environment=FZ_SEED_CREDENTIAL=metal-agent-seed
+Environment=FZ_AGENT_ROLE=metal
+Environment=FZ_METAL_HOSTNAME=${config.metalHostname}
+Environment=FZ_API=${config.profile.apiUrl}
+Environment=FZ_METAL_HELPER_SOCKET=${HELPER_SOCKET}
+Environment=FZ_DRAIN_DEADLINE_MS=120000
+Environment=NODE_ENV=production
+Environment=OTEL_EXPORTER_OTLP_ENDPOINT=${config.hostTelemetryEndpoint}
+Environment=OTEL_SERVICE_NAME=forgezero-metal-agent
+ExecStart=${AGENT_PATH}
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=130s
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+${egress}
+
+[Install]
+WantedBy=multi-user.target
+`
+  };
+}
+var installAgentBinary = (source, version) => {
+  validateAgentSourcePath(source);
+  const release = `/opt/forgezero/agent/versions/${version}/dist`;
+  mkdirSync6(release, { recursive: true, mode: 493 });
+  copyFileSync(source, join8(release, "fz-agent.js"));
+  chmodSync3(join8(release, "fz-agent.js"), 493);
+  chownSync(join8(release, "fz-agent.js"), 0, 0);
+  mkdirSync6("/opt/forgezero/agent", { recursive: true, mode: 493 });
+  for (const [link, target] of [
+    ["/opt/forgezero/agent/current.next", `versions/${version}`],
+    [AGENT_PATH, "/opt/forgezero/agent/current/dist/fz-agent.js"]
+  ]) {
+    try {
+      unlinkSync2(link);
+    } catch {}
+    symlinkSync(target, link);
+    if (link.endsWith("current.next"))
+      renameSync4(link, "/opt/forgezero/agent/current");
+  }
+};
+var preflight = async (config, exec) => {
+  await runChecked(exec, ["/usr/bin/systemctl", "is-active", "--quiet", config.hostTelemetryUnit]);
+  await runChecked(exec, [
+    "/usr/bin/curl",
+    "--silent",
+    "--show-error",
+    "--fail",
+    "--max-time",
+    "5",
+    "--request",
+    "POST",
+    "--header",
+    "Content-Type: application/json",
+    "--data-binary",
+    "{}",
+    `${config.hostTelemetryEndpoint}/v1/metrics`
+  ]);
+  await runChecked(exec, ["/usr/sbin/vgs", config.profile.volumeGroup]);
+  await runChecked(exec, ["/usr/sbin/ip", "link", "show", config.profile.bridge]);
+  if (!existsSync5("/dev/kvm"))
+    throw new MetalBootstrapError("/dev/kvm is required");
+  if (config.profile.confidential) {
+    if (!existsSync5("/dev/sev"))
+      throw new MetalBootstrapError("/dev/sev is required by the confidential profile");
+    await runChecked(exec, ["/usr/bin/qemu-system-x86_64", "-object", "sev-snp-guest,help"]);
+  }
+  const digest = (await runChecked(exec, ["/usr/bin/sha256sum", config.profile.images[Object.keys(config.profile.images)[0]].path])).stdout.split(/\s+/)[0];
+  if (digest !== config.profile.images[Object.keys(config.profile.images)[0]].sha256)
+    throw new MetalBootstrapError("pinned guest image digest mismatch");
+};
+var assertSupportedMetalHost = () => {
+  if (process.platform !== "linux" || process.arch !== "x64") {
+    throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
+  }
+  const release = readFileSync6("/etc/os-release", "utf8");
+  if (!/^ID=ubuntu$/m.test(release) || !/^VERSION_ID="?26\.04"?$/m.test(release)) {
+    throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
+  }
+};
+var ensurePinnedGuestImage = async (config, exec) => {
+  const image = config.profile.images[SUPPORTED_GUEST_IMAGE.key];
+  if (existsSync5(image.path))
+    return;
+  mkdirSync6(dirname7(image.path), { recursive: true, mode: 493 });
+  const temporary = `${image.path}.next-${process.pid}`;
+  try {
+    await runChecked(exec, [
+      "/usr/bin/curl",
+      "--fail",
+      "--location",
+      "--proto",
+      "=https",
+      "--tlsv1.2",
+      "--output",
+      temporary,
+      SUPPORTED_GUEST_IMAGE.url
+    ]);
+    const digest = (await runChecked(exec, ["/usr/bin/sha256sum", temporary])).stdout.split(/\s+/)[0];
+    if (digest !== image.sha256)
+      throw new MetalBootstrapError("downloaded guest image digest mismatch");
+    chmodSync3(temporary, 292);
+    chownSync(temporary, 0, 0);
+    renameSync4(temporary, image.path);
+  } catch (cause) {
+    try {
+      unlinkSync2(temporary);
+    } catch {}
+    throw cause;
+  }
+};
+async function applyMetalBootstrap(config, options) {
+  validateMetalBootstrapConfig(config);
+  if ((options.getuid ?? process.getuid)?.() !== 0)
+    throw new MetalBootstrapError("fz bootstrap metal --apply must run as root");
+  assertSupportedMetalHost();
+  if (existsSync5(STATE_PATH2) && !options.repair)
+    throw new MetalBootstrapError("metal host is already initialized; use explicit repair");
+  if (config.agentSeedFile)
+    validateOwnerOnlyPath(config.agentSeedFile, true);
+  if (config.agentSeedFile && existsSync5(SEED_CREDENTIAL_PATH)) {
+    throw new MetalBootstrapError("repair refuses replacement seed material while the sealed metal identity exists");
+  }
+  validateAgentSourcePath(options.agentSourcePath);
+  const exec = options.exec ?? defaultExec2;
+  await runChecked(exec, ["/usr/bin/apt-get", "update"]);
+  await runChecked(exec, [
+    "/usr/bin/apt-get",
+    "install",
+    "-y",
+    "--no-install-recommends",
+    "qemu-system-x86",
+    "qemu-utils",
+    "cloud-image-utils",
+    "lvm2",
+    "nftables",
+    "curl"
+  ]);
+  await ensurePinnedGuestImage(config, exec);
+  await preflight(config, exec);
+  await ensureAccount(exec);
+  installAgentBinary(options.agentSourcePath, config.profile.agentVersion);
+  mkdirSync6("/etc/forgezero/creds", { recursive: true, mode: 448 });
+  mkdirSync6(config.profile.stateDir, { recursive: true, mode: 448 });
+  mkdirSync6(config.profile.seedDir, { recursive: true, mode: 448 });
+  const persistedProfile = {
+    ...config.profile,
+    metalHostname: config.metalHostname,
+    hostTelemetryEndpoint: config.hostTelemetryEndpoint,
+    hostTelemetryUnit: config.hostTelemetryUnit
+  };
+  atomicWrite2(PROFILE_PATH, `${JSON.stringify(persistedProfile, null, 2)}
+`, 384);
+  if (!existsSync5(SEED_CREDENTIAL_PATH)) {
+    const seed = config.agentSeedFile ? readFileSync6(config.agentSeedFile, "utf8").trim() : randomBytes6(32).toString("base64url");
+    if (seed.length < 32 || /[\0\r\n]/.test(seed))
+      throw new MetalBootstrapError("metal Agent seed is invalid");
+    await runChecked(exec, ["/usr/bin/systemd-creds", "encrypt", "--name=metal-agent-seed", "-", SEED_CREDENTIAL_PATH], `${seed}
+`);
+    chmodSync3(SEED_CREDENTIAL_PATH, 256);
+    chownSync(SEED_CREDENTIAL_PATH, 0, 0);
+    if (config.agentSeedFile)
+      unlinkSync2(config.agentSeedFile);
+  }
+  await applyMetalIsolation(config.profile, (argv) => exec(argv));
+  for (const [unit, body] of Object.entries(renderMetalUnits(config)))
+    atomicWrite2(join8(UNIT_DIRECTORY, unit), body, 420);
+  await runChecked(exec, ["/usr/bin/systemctl", "daemon-reload"]);
+  await runChecked(exec, [
+    "/usr/bin/systemctl",
+    "enable",
+    "--now",
+    "forgezero-agent-update-helper.service",
+    "forgezero-metal-helper.service",
+    "forgezero-metal-agent-egress.service",
+    "forgezero-metal-agent.service"
+  ]);
+  for (let attempt = 0;attempt < 100 && (!socketReady(HELPER_SOCKET) || !socketReady(UPDATE_SOCKET)); attempt += 1) {
+    await Bun.sleep(100);
+  }
+  const status = await metalBootstrapStatus(exec);
+  const operationalProblems = options.repair ? status.problems.filter((problem) => problem !== "metal initialized state does not bind the current profile") : status.problems;
+  if (operationalProblems.length)
+    throw new MetalBootstrapError(`metal bootstrap verification failed: ${operationalProblems.join("; ")}`);
+  const identity = await runChecked(exec, [
+    "/usr/bin/systemd-run",
+    "--pipe",
+    "--wait",
+    "--quiet",
+    "--collect",
+    `--property=LoadCredentialEncrypted=metal-agent-seed:${SEED_CREDENTIAL_PATH}`,
+    "--setenv=FZ_SEED_CREDENTIAL=metal-agent-seed",
+    AGENT_PATH,
+    "identity"
+  ]);
+  const publicIdentity = identity.stdout.trim();
+  if (!publicIdentity || /[\r\n]/.test(publicIdentity))
+    throw new MetalBootstrapError("metal public identity proof was invalid");
+  const state = {
+    initializedAt: new Date().toISOString(),
+    role: "metal",
+    metalHostname: config.metalHostname,
+    profileSha256: createHash3("sha256").update(JSON.stringify(config.profile)).digest("hex")
+  };
+  atomicWrite2(STATE_PATH2, `${JSON.stringify(state, null, 2)}
+`, 384);
+  return { ...status, initialized: true, problems: [], metalHostname: config.metalHostname, publicIdentity };
+}
+var socketReady = (path) => {
+  try {
+    return lstatSync3(path).isSocket();
+  } catch {
+    return false;
+  }
+};
+async function metalBootstrapStatus(exec = defaultExec2) {
+  const problems = [];
+  let profileValid = false, imageVerified = false, metalHostname, profileSha256;
+  let profileMode = null;
+  if (existsSync5(PROFILE_PATH)) {
+    try {
+      const metadata = statSync(PROFILE_PATH);
+      profileMode = metadata.mode & 511;
+      if (profileMode !== 384 || metadata.uid !== 0)
+        problems.push("metal profile is not root-owned mode 0600");
+      const persisted = JSON.parse(readFileSync6(PROFILE_PATH, "utf8"));
+      const { metalHostname: profileHostname, hostTelemetryEndpoint, hostTelemetryUnit, ...profile } = persisted;
+      validateMetalProfile(profile);
+      profileValid = true;
+      profileSha256 = createHash3("sha256").update(JSON.stringify(profile)).digest("hex");
+      if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(profileHostname) || hostTelemetryEndpoint !== "http://127.0.0.1:4318") {
+        problems.push("persisted metal host coordinates are invalid");
+      }
+      try {
+        validUnit(hostTelemetryUnit);
+      } catch {
+        problems.push("persisted metal OTLP collector unit is invalid");
+      }
+      if ((await exec(["/usr/bin/systemctl", "is-active", "--quiet", hostTelemetryUnit])).exitCode !== 0) {
+        problems.push(`${hostTelemetryUnit} is inactive`);
+      } else if ((await exec([
+        "/usr/bin/curl",
+        "--silent",
+        "--show-error",
+        "--fail",
+        "--max-time",
+        "5",
+        "--request",
+        "POST",
+        "--header",
+        "Content-Type: application/json",
+        "--data-binary",
+        "{}",
+        `${hostTelemetryEndpoint}/v1/metrics`
+      ])).exitCode !== 0) {
+        problems.push("local OTLP metrics receiver did not accept a proof request");
+      }
+      const image = profile.images[Object.keys(profile.images)[0]];
+      if (existsSync5(image.path)) {
+        const digest = (await exec(["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
+        imageVerified = digest === image.sha256;
+      }
+      if (!imageVerified)
+        problems.push("pinned guest image is absent or has the wrong digest");
+    } catch (cause) {
+      problems.push(`metal profile invalid: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+  } else
+    problems.push("metal profile is missing");
+  if (existsSync5(STATE_PATH2)) {
+    try {
+      const state = JSON.parse(readFileSync6(STATE_PATH2, "utf8"));
+      metalHostname = state.metalHostname;
+      if (state.role !== "metal" || !metalHostname || state.profileSha256 !== profileSha256) {
+        problems.push("metal initialized state does not bind the current profile");
+      }
+    } catch {
+      problems.push("metal initialized state is invalid");
+    }
+  }
+  const units = {};
+  for (const unit of [
+    "forgezero-metal-helper.service",
+    "forgezero-agent-update-helper.service",
+    "forgezero-metal-agent-egress.service",
+    "forgezero-metal-agent.service"
+  ]) {
+    if (!existsSync5(join8(UNIT_DIRECTORY, unit)))
+      units[unit] = "missing";
+    else
+      units[unit] = (await exec(["/usr/bin/systemctl", "is-active", "--quiet", unit])).exitCode === 0 ? "active" : "inactive";
+    if (units[unit] !== "active")
+      problems.push(`${unit} is ${units[unit]}`);
+  }
+  const helperSocketReady = socketReady(HELPER_SOCKET);
+  const updateSocketReady = socketReady(UPDATE_SOCKET);
+  if (!helperSocketReady)
+    problems.push("metal helper socket is not ready");
+  if (!updateSocketReady)
+    problems.push("Agent update helper socket is not ready");
+  return {
+    initialized: existsSync5(STATE_PATH2),
+    profileValid,
+    profileMode,
+    imageVerified,
+    units,
+    helperSocketReady,
+    updateSocketReady,
+    metalHostname,
+    problems
+  };
+}
+
+// src/cli/index.ts
+var RECOMMENDED_MODE = (THRESHOLD_MODES.find((mode) => mode.recommended) ?? THRESHOLD_MODES[0]).id;
+var DEFAULT_MODE = RECOMMENDED_MODE;
+var PACKAGED_AGENT_BIN2 = fileURLToPath2(new URL("./fz-agent.js", import.meta.url));
+function parseOptions(argv) {
+  const options = {
+    api: process.env.FZ_API ?? "http://localhost:8787",
+    apiExplicit: Boolean(process.env.FZ_API),
+    app: process.env.FZ_APP,
+    realm: process.env.FZ_REALM ?? "platform",
+    realmExplicit: Boolean(process.env.FZ_REALM),
+    json: false,
+    apply: false,
+    enrol: false,
+    socket: process.env.SSH_AUTH_SOCK,
+    mode: DEFAULT_MODE,
+    user: process.env.FZ_USER ?? "operator",
+    userExplicit: Boolean(process.env.FZ_USER),
+    phraseStdin: false,
+    preserveEnv: false,
+    projectRoot: process.cwd(),
+    deployProfile: "app",
+    deploySoftware: [],
+    deployChannel: "production",
+    requireAttestation: false,
+    force: false,
+    noBrowser: false,
+    provider: "github",
+    branch: "main",
+    authMode: "public",
+    targets: [],
+    wait: false,
+    timeoutSeconds: 900,
+    queries: []
+  };
+  const positional = [];
+  for (let index = 0;index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--api") {
+      options.api = argv[++index] ?? options.api;
+      options.apiExplicit = true;
+    } else if (token === "--app")
+      options.app = argv[++index];
+    else if (token === "--realm") {
+      options.realm = argv[++index] ?? options.realm;
+      options.realmExplicit = true;
+    } else if (token === "--socket")
+      options.socket = argv[++index];
+    else if (token === "--json")
+      options.json = true;
+    else if (token === "--apply")
+      options.apply = true;
+    else if (token === "--enrol")
+      options.enrol = true;
+    else if (token === "--preserve-env")
+      options.preserveEnv = true;
+    else if (token === "--root")
+      options.projectRoot = argv[++index] ?? options.projectRoot;
+    else if (token === "--name")
+      options.projectName = argv[++index];
+    else if (token === "--purpose")
+      options.projectPurpose = argv[++index];
+    else if (token === "--profile")
+      options.deployProfile = argv[++index] ?? options.deployProfile;
+    else if (token === "--software")
+      options.deploySoftware.push(argv[++index] ?? "");
+    else if (token === "--channel") {
+      const channel = argv[++index];
+      if (channel === "development" || channel === "production")
+        options.deployChannel = channel;
+      else
+        options.optionError = "--channel must be production or development.";
+    } else if (token === "--attestation")
+      options.requireAttestation = true;
+    else if (token === "--force")
+      options.force = true;
+    else if (token === "--no-browser")
+      options.noBrowser = true;
+    else if (token === "--project")
+      options.projectKey = argv[++index];
+    else if (token === "--pipeline")
+      options.pipelineKey = argv[++index];
+    else if (token === "--revision")
+      options.revision = argv[++index];
+    else if (token === "--label")
+      options.label = argv[++index];
+    else if (token === "--provider") {
+      const value = argv[++index];
+      if (value === "github" || value === "gitlab" || value === "generic")
+        options.provider = value;
+      else
+        options.optionError = "--provider must be github, gitlab, or generic.";
+    } else if (token === "--repository")
+      options.repository = argv[++index];
+    else if (token === "--branch")
+      options.branch = argv[++index] ?? options.branch;
+    else if (token === "--clone-url")
+      options.cloneUrl = argv[++index];
+    else if (token === "--auth") {
+      const value = argv[++index];
+      if (value === "public" || value === "node-ssh" || value === "vault-token")
+        options.authMode = value;
+      else
+        options.optionError = "--auth must be public, node-ssh, or vault-token.";
+    } else if (token === "--git-secret")
+      options.gitSecret = argv[++index];
+    else if (token === "--git-username")
+      options.gitUsername = argv[++index];
+    else if (token === "--known-hosts")
+      options.knownHostsFile = argv[++index];
+    else if (token === "--target")
+      options.targets.push(argv[++index] ?? "");
+    else if (token === "--target-key")
+      options.targetKey = argv[++index];
+    else if (token === "--wait")
+      options.wait = true;
+    else if (token === "--timeout") {
+      const value = Number(argv[++index] ?? "");
+      if (Number.isFinite(value) && value > 0 && value <= 86400)
+        options.timeoutSeconds = value;
+      else
+        options.optionError = "--timeout must be between 1 and 86400 seconds.";
+    } else if (token === "--data")
+      options.data = argv[++index];
+    else if (token === "--data-file")
+      options.dataFile = argv[++index];
+    else if (token === "--bootstrap-config")
+      options.bootstrapConfigPath = argv[++index];
+    else if (token === "--query")
+      options.queries.push(argv[++index] ?? "");
+    else if (token === "--key")
+      options.key = argv[++index];
+    else if (token === "--mode")
+      options.mode = argv[++index] ?? options.mode;
+    else if (token === "--user") {
+      options.user = argv[++index] ?? options.user;
+      options.userExplicit = true;
+    } else if (token === "--token-file")
+      options.tokenFile = argv[++index];
+    else if (token === "--phrase-file")
+      options.phraseFile = argv[++index];
+    else if (token === "--phrase-stdin")
+      options.phraseStdin = true;
+    else
+      positional.push(token);
+  }
+  return { command: positional[0] ?? "help", args: positional.slice(1), options };
+}
+var out = {
+  line: (text3 = "") => process.stdout.write(`${text3}
+`),
+  step: (text3) => process.stdout.write(`  ${text3}
+`),
+  warn: (text3) => process.stderr.write(`  ! ${text3}
+`),
+  fail: (text3) => process.stderr.write(`  \u2717 ${text3}
+`),
+  ok: (text3) => process.stdout.write(`  \u2713 ${text3}
+`)
+};
+var sessionCookie = null;
+var storedSession = null;
+function captureSession(response) {
+  const setCookie = response.headers.get("set-cookie");
+  if (!setCookie)
+    return;
+  const cookie = setCookie.split(";")[0];
+  sessionCookie = cookie;
+  if (storedSession && (cookie !== storedSession.cookie || Date.now() - storedSession.lastUsedAtTs >= 60000)) {
+    storedSession = { ...storedSession, cookie, lastUsedAtTs: Date.now() };
+    saveSession(storedSession);
+  }
+}
+function requestHeaders(apiBase, cookie) {
+  return {
+    "content-type": "application/json",
+    origin: new URL(apiBase).origin,
+    ...cookie ? { cookie } : {}
+  };
+}
+async function api(options, path, init) {
+  const base = options.realm === "platform" ? "/api" : `/api/t/${encodeURIComponent(options.realm)}`;
+  const response = await fetch(`${options.api}${base}${path}`, {
+    method: init?.method ?? "GET",
+    headers: { ...requestHeaders(options.api, sessionCookie), "user-agent": `forgezero-cli/${VERSION2}` },
+    body: init?.body === undefined ? undefined : JSON.stringify(init.body)
+  });
+  captureSession(response);
+  let body = null;
+  try {
+    body = await response.json();
+  } catch {
+    body = null;
+  }
+  const challenge = body?.security;
+  if (response.status === 428 && challenge?.scope === "action" && challenge.requestKey && custodyIdentity && !path.startsWith("/security/step-up/")) {
+    const proved = await proveWithAgent(options, challenge.requestKey);
+    if (proved) {
+      const replay = await fetch(`${options.api}${base}${path}`, {
+        method: init?.method ?? "GET",
+        headers: {
+          ...requestHeaders(options.api, sessionCookie),
+          "x-security-request-key": challenge.requestKey
+        },
+        body: init?.body === undefined ? undefined : JSON.stringify(init.body)
+      });
+      captureSession(replay);
+      let replayed = null;
+      try {
+        replayed = await replay.json();
+      } catch {
+        replayed = null;
+      }
+      return { status: replay.status, body: replayed };
+    }
+  }
+  if (response.status === 428 && challenge?.scope === "action" && challenge.requestKey && storedSession && !path.startsWith("/security/step-up/")) {
+    const proved = await proveWithBrowser(options, challenge.requestKey, base);
+    if (proved) {
+      const replay = await fetch(`${options.api}${base}${path}`, {
+        method: init?.method ?? "GET",
+        headers: {
+          ...requestHeaders(options.api, sessionCookie),
+          "user-agent": `forgezero-cli/${VERSION2}`,
+          "x-security-request-key": challenge.requestKey
+        },
+        body: init?.body === undefined ? undefined : JSON.stringify(init.body)
+      });
+      captureSession(replay);
+      let replayed = null;
+      try {
+        replayed = await replay.json();
+      } catch {}
+      return { status: replay.status, body: replayed };
+    }
+  }
+  if (response.status === 401 && storedSession) {
+    removeSession(storedSession.api, storedSession.realm);
+    storedSession = null;
+    sessionCookie = null;
+  }
+  return { status: response.status, body };
+}
+function sleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -10438,7 +13799,7 @@ function requireSession() {
 function readOwnerOnlySecret(path, label) {
   let metadata;
   try {
-    metadata = lstatSync2(path);
+    metadata = lstatSync4(path);
   } catch {
     throw new Error(`The ${label} file ${path} is unreadable.`);
   }
@@ -10452,7 +13813,7 @@ function readOwnerOnlySecret(path, label) {
   if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`The ${label} file ${path} is not owned by the current user.`);
   }
-  const value = readFileSync4(path, "utf8").trim();
+  const value = readFileSync7(path, "utf8").trim();
   if (!value)
     throw new Error(`The ${label} file ${path} is empty.`);
   return value;
@@ -10625,7 +13986,7 @@ async function cmdApi(options, args) {
     let body = undefined;
     if (options.data !== undefined && options.dataFile)
       throw new Error("Use only one of --data or --data-file.");
-    const encoded = options.data === "-" ? await Bun.stdin.text() : options.dataFile ? readFileSync4(options.dataFile, "utf8") : options.data;
+    const encoded = options.data === "-" ? await Bun.stdin.text() : options.dataFile ? readFileSync7(options.dataFile, "utf8") : options.data;
     if (encoded !== undefined)
       body = JSON.parse(encoded);
     const result = await api(options, `${url.pathname}${url.search}`, { method, body });
@@ -10750,7 +14111,7 @@ async function cmdAgent(options, args) {
       deployRoot: process.env.FZ_DEPLOY_ROOT ?? "/opt/forgezero"
     } : {},
     binPath: process.env.FZ_AGENT_BIN ?? "/usr/local/lib/forgezero/agent/fz-agent",
-    sourceBinPath: process.env.FZ_AGENT_SOURCE_BIN ?? PACKAGED_AGENT_BIN,
+    sourceBinPath: process.env.FZ_AGENT_SOURCE_BIN ?? PACKAGED_AGENT_BIN2,
     user: process.env.FZ_AGENT_USER,
     apiUrl: options.api,
     project: process.env.FZ_PROJECT,
@@ -10774,17 +14135,17 @@ async function cmdAgent(options, args) {
     return 0;
   }
   try {
-    writeFileSync4(plan.unitPath, plan.unit, { mode: 420 });
+    writeFileSync7(plan.unitPath, plan.unit, { mode: 420 });
     out.ok(`Wrote ${plan.unitPath}`);
     for (const auxiliary of plan.auxiliaryUnits) {
-      mkdirSync4(dirname3(auxiliary.path), { recursive: true, mode: 493 });
-      writeFileSync4(auxiliary.path, auxiliary.unit, { mode: 420 });
+      mkdirSync7(dirname8(auxiliary.path), { recursive: true, mode: 493 });
+      writeFileSync7(auxiliary.path, auxiliary.unit, { mode: 420 });
       out.ok(`Wrote ${auxiliary.path}`);
     }
     if (options.enrol) {
-      if (existsSync4(enrolTokenSourcePath)) {
-        const source = statSync(enrolTokenSourcePath);
-        const token = readFileSync4(enrolTokenSourcePath, "utf8").trim();
+      if (existsSync6(enrolTokenSourcePath)) {
+        const source = statSync2(enrolTokenSourcePath);
+        const token = readFileSync7(enrolTokenSourcePath, "utf8").trim();
         if (!source.isFile() || (source.mode & 511) !== 384 || source.uid !== 0) {
           throw new Error("The preloaded enrolment token must be a root-owned 0600 file in /run.");
         }
@@ -10797,7 +14158,7 @@ async function cmdAgent(options, args) {
         if (await prompt.exited !== 0 || !/^fze_[A-Za-z0-9_-]{40,100}$/.test(token)) {
           throw new Error("A valid fze_ enrolment token was not provided.");
         }
-        writeFileSync4(enrolTokenSourcePath, `${token}
+        writeFileSync7(enrolTokenSourcePath, `${token}
 `, { mode: 384, flag: "wx" });
       }
     }
@@ -10808,13 +14169,13 @@ async function cmdAgent(options, args) {
     out.line();
     out.line("  Add this machine-specific PUBLIC key as a read-only deploy key:");
     out.line();
-    out.line(`  ${readFileSync4(gitPublicKeyPath, "utf8").trim()}`);
+    out.line(`  ${readFileSync7(gitPublicKeyPath, "utf8").trim()}`);
     out.line();
     return 0;
   } catch (cause) {
     if (options.enrol) {
       try {
-        unlinkSync2(enrolTokenSourcePath);
+        unlinkSync3(enrolTokenSourcePath);
       } catch {}
     }
     out.fail(`Could not write ${plan.unitPath}: ${cause.message}`);
@@ -10822,6 +14183,203 @@ async function cmdAgent(options, args) {
     return 1;
   }
 }
+var bootstrapAnswer = (question, fallback) => {
+  const suffix = fallback ? ` [${fallback}]` : "";
+  const value = globalThis.prompt(`${question}${suffix}:`)?.trim();
+  if (value)
+    return value;
+  if (fallback !== undefined)
+    return fallback;
+  throw new Error(`${question} is required (or use --bootstrap-config).`);
+};
+function interactiveBootstrap(kind) {
+  if (!process.stdin.isTTY)
+    throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
+  if (kind === "tenant") {
+    const runnerKey = bootstrapAnswer("Bootstrap runner SSH private-key file (blank to disable)", "");
+    return {
+      kind,
+      apiUrl: bootstrapAnswer("Platform API URL"),
+      realm: bootstrapAnswer("Tenant realm slug"),
+      nodeHostname: bootstrapAnswer("Node hostname", hostname()),
+      telemetryEndpoint: bootstrapAnswer("Public HTTPS OTLP endpoint"),
+      enrolTokenFile: bootstrapAnswer("Root-only enrolment token file"),
+      profile: bootstrapAnswer("Deploy profile", "app"),
+      ...runnerKey ? { bootstrapRunner: {
+        sshPrivateKeyFile: runnerKey,
+        targetTelemetryEndpoint: bootstrapAnswer("Public HTTPS OTLP endpoint for bootstrapped targets")
+      } } : {}
+    };
+  }
+  const environment = bootstrapAnswer("Environment (production/development)", "production");
+  const profile = bootstrapAnswer("Profile (platform-db-api/platform-api)", "platform-db-api");
+  const role = profile === "platform-api" ? "none" : bootstrapAnswer("Database role (master/joiner)", "master");
+  const serverMode = "default";
+  const address = role === "none" ? undefined : bootstrapAnswer("Private database address");
+  const master = role === "joiner" ? bootstrapAnswer("Master starter private address") : undefined;
+  const coordinators = bootstrapAnswer("Writable Coordinator origins (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean);
+  const computeReference = bootstrapAnswer("API-owned compute reference", environment === "production" ? "fz-n1" : "dev-fz-n1");
+  const nodeHostname = bootstrapAnswer("Public node hostname");
+  const apiUrl = bootstrapAnswer("Platform API URL");
+  const appOrigin = bootstrapAnswer("Public App origin");
+  const repository = bootstrapAnswer("API Git repository");
+  const branch = bootstrapAnswer("Deployment branch", environment === "production" ? "main" : "dev");
+  const telemetryEndpoint = bootstrapAnswer("Public HTTPS Agent OTLP endpoint");
+  const collectorUnit = bootstrapAnswer("Independent local OTLP collector unit", "otelcol.service");
+  const replicationFactor = Number(bootstrapAnswer("Database replication factor", "3"));
+  const writeConcern = Number(bootstrapAnswer("Database write concern", "2"));
+  const seedPeers = bootstrapAnswer("Seed WebSocket peers (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean);
+  const smtpHost = bootstrapAnswer("Bootstrap SMTP host (blank to disable)", "");
+  const smtpPort = smtpHost ? Number(bootstrapAnswer("Bootstrap SMTP port", "587")) : undefined;
+  const smtpUser = smtpHost ? bootstrapAnswer("Bootstrap SMTP user (blank if none)", "") : undefined;
+  const smtpFrom = smtpHost ? bootstrapAnswer("Bootstrap SMTP From address") : undefined;
+  const smtpPassword = smtpHost ? bootstrapAnswer("Root-only SMTP password file") : undefined;
+  const backupEndpoint = bootstrapAnswer("Backup S3 HTTPS endpoint (blank to disable)", "");
+  const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
+  const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
+  const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
+  const backupS3Secret = backupEndpoint ? bootstrapAnswer("Root-only backup S3 secret file") : undefined;
+  const cloudflareCheckpoint = bootstrapAnswer("Completed Cloudflare bootstrap checkpoint (blank for no public edge)", "");
+  const cloudflareNodeName = cloudflareCheckpoint ? bootstrapAnswer("Cloudflare checkpoint node name", computeReference) : undefined;
+  const databaseNetworkMode = cloudflareCheckpoint ? bootstrapAnswer("Database network (private-lan/cloudflare-warp)", "private-lan") : "private-lan";
+  const bootstrapSecretFile = bootstrapAnswer("Root-only shared cluster bootstrap-code file");
+  const index = Number(computeReference.match(/n(\d+)$/)?.[1] ?? 0);
+  const platformEnrolTokenFile = index > 3 ? bootstrapAnswer("Root-only API-issued platform enrolment-token file") : undefined;
+  return {
+    kind,
+    environment,
+    profile,
+    computeReference,
+    nodeHostname,
+    apiUrl,
+    repository,
+    branch,
+    telemetryEndpoint,
+    database: {
+      role,
+      serverMode,
+      address,
+      master,
+      coordinators,
+      bootstrapSecretFile
+    },
+    platformEnrolTokenFile,
+    runtime: {
+      environment: {
+        softwareProfile: profile,
+        databaseRole: role,
+        databaseCoordinators: coordinators,
+        databaseAddress: address,
+        databaseMaster: master,
+        databaseNetworkMode,
+        databaseReplicationFactor: replicationFactor,
+        databaseWriteConcern: writeConcern,
+        databaseUser: "forgezero-api",
+        nodeHostname,
+        nodeRegion: bootstrapAnswer("Published node region"),
+        nodeRole: "guest",
+        appOrigin,
+        apiOrigin: apiUrl,
+        publicApiPort: Number(bootstrapAnswer("Loopback public API port", "3000")),
+        sharedDirectory: "/opt/forgezero/shared",
+        seedSyncPeers: seedPeers,
+        seedSyncMembers: Number(bootstrapAnswer("Seed quorum members", "3")),
+        seedSyncEpoch: bootstrapAnswer("Seed epoch"),
+        concurrencyLimit: Number(bootstrapAnswer("Initial concurrency limit", "128")),
+        drainDeadlineMs: Number(bootstrapAnswer("Drain deadline milliseconds", "30000")),
+        otlpEndpoint: "http://127.0.0.1:4318",
+        otlpCollectorUnit: collectorUnit,
+        agentOtlpEndpoint: telemetryEndpoint,
+        otlpFlushIntervalMs: 1e4,
+        otlpTraceSampleRatio: 0.1,
+        custodianEmail: role === "master" ? bootstrapAnswer("First custodian email") : undefined,
+        ...smtpHost && smtpPort && smtpFrom ? { smtp: { host: smtpHost, port: smtpPort, user: smtpUser || undefined, from: smtpFrom } } : {},
+        ...backupEndpoint && backupRegion && backupBucket && backupAccessKeyId ? {
+          backup: { endpoint: backupEndpoint, region: backupRegion, bucket: backupBucket, accessKeyId: backupAccessKeyId }
+        } : {},
+        repository,
+        branch,
+        deployProfile: environment
+      },
+      serviceUser: "forgezero-api",
+      slotsDirectory: "/opt/forgezero/slots",
+      bluePort: 3001,
+      greenPort: 3002,
+      healthPath: "/api/health",
+      keepReleases: 5,
+      credentialFiles: {
+        smtpPassword,
+        backupS3Secret
+      }
+    },
+    firewall: {
+      enabled: bootstrapAnswer("Enable host firewall? (yes/no)", "yes") === "yes",
+      sshPort: Number(bootstrapAnswer("SSH port", "22")),
+      privateCidrs: bootstrapAnswer("Private cluster CIDRs (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean)
+    },
+    installCloudflared: cloudflareCheckpoint ? true : bootstrapAnswer("Install cloudflared binary only? (yes/no)", "no") === "yes",
+    ...cloudflareCheckpoint && cloudflareNodeName ? {
+      cloudflareHandoff: { checkpointFile: cloudflareCheckpoint, nodeName: cloudflareNodeName }
+    } : {}
+  };
+}
+async function cmdBootstrap(options, args) {
+  try {
+    const operation = args[0] ?? "status";
+    if (operation === "platform" && args[1] === "cloudflare") {
+      if (!options.bootstrapConfigPath) {
+        throw new Error("Cloudflare bootstrap requires --bootstrap-config <owner-only-cloudflare-json>");
+      }
+      await runCloudflareBootstrapCommand(options.bootstrapConfigPath, options.apply);
+      return 0;
+    }
+    if (operation === "status") {
+      if (existsSync6("/etc/forgezero/metal.initialized.json")) {
+        const status2 = await metalBootstrapStatus();
+        out.line(JSON.stringify(status2, null, 2));
+        return status2.initialized && status2.problems.length === 0 ? 0 : 1;
+      }
+      const status = await bootstrapStatus();
+      out.line(JSON.stringify(status, null, 2));
+      return status.initialized ? 0 : 1;
+    }
+    if (operation === "metal") {
+      if (!options.bootstrapConfigPath) {
+        throw new Error("metal bootstrap requires --bootstrap-config <owner-only-metal-json>");
+      }
+      const config2 = readMetalBootstrapConfig(options.bootstrapConfigPath);
+      if (!options.apply) {
+        out.line(JSON.stringify(planMetalBootstrap(config2), null, 2));
+        out.step("Review the plan, then repeat with --apply as root.");
+        return 0;
+      }
+      const result2 = await applyMetalBootstrap(config2, { agentSourcePath: PACKAGED_AGENT_BIN2 });
+      out.line(JSON.stringify(result2, null, 2));
+      return 0;
+    }
+    if (!["platform", "tenant", "repair"].includes(operation)) {
+      throw new Error("Usage: fz bootstrap platform [cloudflare]|tenant|metal|status|repair [--bootstrap-config <path>] [--apply]");
+    }
+    const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
+      throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
+    })() : interactiveBootstrap(operation);
+    if (operation !== "repair" && config.kind !== operation) {
+      throw new Error(`bootstrap config kind ${config.kind} does not match requested ${operation}`);
+    }
+    const plan = planBootstrap(config, operation === "repair");
+    if (!options.apply) {
+      out.line(JSON.stringify(plan, null, 2));
+      out.step("Review the plan, then repeat with --apply as root.");
+      return 0;
+    }
+    const result = await applyBootstrap(config);
+    out.line(JSON.stringify(result, null, 2));
+    return 0;
+  } catch (cause) {
+    out.fail(cause instanceof Error ? cause.message : String(cause));
+    return 1;
+  }
+}
 async function cmdGenesis(options) {
   try {
     if (options.realm !== "platform") {
@@ -10840,10 +14398,10 @@ async function cmdGenesis(options) {
 ` + `  On the server:   the token file is read automatically, or set FZ_SHARED_DIR
 ` + `  From a laptop:   copy it to a chmod 600 file and pass --token-file <path>
 
-` + "  The token is what setup.sh created. It is single use.");
+` + "  The token is what `fz bootstrap platform` created. It is single use.");
     }
     if (!/^plt_[A-Za-z0-9_-]{32,100}$/.test(token)) {
-      throw new Error("The platform invitation is malformed; expected the one-use plt_ token from setup.sh.");
+      throw new Error("The platform invitation is malformed; expected the one-use plt_ token from `fz bootstrap platform`.");
     }
     const session = await authorizeDeviceSession(options, (approval, app) => {
       const ceremony = new URL("/custody/ceremony", app);
@@ -10880,7 +14438,7 @@ async function cmdUnlock(options) {
     if (options.key || options.userExplicit) {
       throw new Error("SSH/user unlock coordinates are not accepted. SSH keys cannot open a WebAuthn-PRF custody envelope; use --phrase-file or --phrase-stdin.");
     }
-    const phraseText = options.phraseFile ? readOwnerOnlySecret(options.phraseFile, "recovery phrase") : options.phraseStdin ? readFileSync4(0, "utf8").trim() : "";
+    const phraseText = options.phraseFile ? readOwnerOnlySecret(options.phraseFile, "recovery phrase") : options.phraseStdin ? readFileSync7(0, "utf8").trim() : "";
     const phrase = phraseText ? phraseText.split(/\s+/) : [];
     if (phrase.length !== 24) {
       throw new Error(`Recovery phrase must contain exactly 24 words; received ${phrase.length}. Use --phrase-file or --phrase-stdin.`);
@@ -10999,7 +14557,7 @@ function projectFromCheckout(options) {
   try {
     return loadConfig({
       cwd: options.projectRoot,
-      readFile: (path) => existsSync4(path) ? readFileSync4(path, "utf8") : undefined
+      readFile: (path) => existsSync6(path) ? readFileSync7(path, "utf8") : undefined
     }).config.project;
   } catch (cause) {
     throw new Error(`No --project was given and the checkout has no usable .fz/config.json: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -11118,7 +14676,7 @@ async function cmdDeploy(options, args) {
         branch: options.branch,
         cloneUrl: required(options.cloneUrl, "--clone-url"),
         sourceAuth,
-        ...options.knownHostsFile ? { knownHosts: readFileSync4(options.knownHostsFile, "utf8") } : {},
+        ...options.knownHostsFile ? { knownHosts: readFileSync7(options.knownHostsFile, "utf8") } : {},
         projectKey
       } });
       const pipelineKey2 = String(created.pipelineKey);
@@ -11215,6 +14773,14 @@ function usage() {
     fz agent install        Install the node agent as a systemd service, so
                             applications on this box read secrets through a
                             local socket instead of holding an API key
+	 fz bootstrap platform   Install/repair a typed elastic platform compute
+	 fz bootstrap platform cloudflare
+	                         Plan/apply token-file-only KV, Worker, Access, DNS
+	                         and one Tunnel per explicit platform API node
+	 fz bootstrap tenant     Install/enrol reusable tenant compute tooling
+	 fz bootstrap metal      Plan/install an identity-only physical provisioner
+	 fz bootstrap status     Verify persisted profile and supervised units
+	 fz bootstrap repair     Reapply an explicitly supplied reviewed config
     fz project init         Create vendor-neutral, Git-persisted AI context
     fz project sync         Regenerate Claude/Codex/Gemini/Copilot/Cursor adapters
     fz project check        Fail when truth sources or generated adapters drift
@@ -11252,6 +14818,8 @@ function usage() {
     --apply                 Write the unit rather than printing it (root)
     --enrol                Bind this machine with a one-time token prompted
                            securely by systemd (tenant-owned compute)
+	 --bootstrap-config <p>  Private JSON coordinates for unattended bootstrap;
+	                         secret values remain in separate owner-only files
     --root <path>           Project root for project/deploy commands
     --name <name>           Project or deploy name during init
     --purpose <text>        Product outcome during project init
@@ -11330,6 +14898,9 @@ async function runCli() {
     case "agent":
       code = await cmdAgent(options, args);
       break;
+    case "bootstrap":
+      code = await cmdBootstrap(options, args);
+      break;
     case "project":
       code = cmdProject(options, args);
       break;
@@ -11359,7 +14930,7 @@ async function runCli() {
       usage();
       code = 1;
   }
-  if (args.length > 0 && code === 0 && !["agent", "project", "deploy", "api", "ui", "routes"].includes(command)) {
+  if (args.length > 0 && code === 0 && !["agent", "bootstrap", "project", "deploy", "api", "ui", "routes"].includes(command)) {
     out.warn(`Ignored: ${args.join(" ")}`);
   }
   process.exit(code);