@forgezero/agent 0.1.35 → 0.1.36

package/dist/fz-agent.js

@@ -3,8 +3,8 @@
 
 // src/index.ts
 import { randomBytes as randomBytes5 } from "crypto";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync8, existsSync as existsSync13, mkdirSync as mkdirSync9, chmodSync as chmodSync12 } from "fs";
-import { dirname as dirname7, join as join6 } from "path";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync9, existsSync as existsSync13, mkdirSync as mkdirSync9, chmodSync as chmodSync13 } from "fs";
+import { dirname as dirname7, join as join7 } from "path";
 
 // ../access/dist/security.js
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));
@@ -4884,6 +4884,7 @@ function createQueue(options = {}) {
 
 // src/software.ts
 import { readFileSync } from "fs";
+var PINNED_BUN_VERSION = "1.3.14";
 var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
@@ -4895,7 +4896,8 @@ var SOFTWARE_CATALOG = [
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   {
@@ -4922,6 +4924,11 @@ var UBUNTU_2604_X64 = [
     requirement: { id: "ufw", version: "ubuntu-26.04" },
     check: "command -v ufw >/dev/null",
     install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y ufw"
+  },
+  {
+    requirement: { id: "openssh-client", version: "ubuntu-26.04" },
+    check: "command -v ssh >/dev/null && command -v scp >/dev/null && command -v ssh-keyscan >/dev/null && command -v ssh-keygen >/dev/null",
+    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y openssh-client"
   }
 ];
 function observeSoftwareHost(osRelease = readFileSync("/etc/os-release", "utf8"), architecture = process.arch) {
@@ -4946,7 +4953,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "nginx", "arangodb", "cloudflared", "ufw"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "nginx", "arangodb", "cloudflared", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -6633,8 +6640,317 @@ function startMigrationPull(options) {
   };
 }
 
+// src/ssh-bootstrap.ts
+import { chmodSync as chmodSync5, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+import { fileURLToPath } from "url";
+class SshBootstrapError extends Error {
+  code;
+  constructor(code, message = code) {
+    super(message);
+    this.code = code;
+  }
+}
+var defaultExec = async (argv, options = {}) => {
+  const child = Bun.spawn([...argv], {
+    stdin: options.stdin === undefined ? "ignore" : "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
+  });
+  if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
+    child.stdin.write(options.stdin);
+    child.stdin.end();
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: options.secret ? "" : `${stdout}${stderr}`.slice(0, 8192) };
+};
+var checked = async (exec, argv, code, options) => {
+  const result = await exec(argv, options);
+  if (result.exitCode !== 0)
+    throw new SshBootstrapError(code);
+  return result.output.trim();
+};
+var validateClaim = (claim) => {
+  if (!/^[A-Za-z0-9_-]{1,64}$/.test(claim.computeKey) || !/^[A-Za-z0-9_-]{16,128}$/.test(claim.claimToken) || !/^fze_[A-Za-z0-9_-]{32,128}$/.test(claim.enrolmentToken) || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(claim.realm) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.projectKey) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.environmentKey))
+    throw new SshBootstrapError("CLAIM_INVALID");
+  const { host, port, user, hostKeySha256, nodeHostname } = claim.target;
+  if (!host || host.length > 253 || /[\s/@]/.test(host) || !Number.isSafeInteger(port) || port < 1 || port > 65535 || !/^[a-z_][a-z0-9_-]{0,31}$/.test(user) || !/^SHA256:[A-Za-z0-9+/]{43}$/.test(hostKeySha256) || !/^[a-z0-9](?:[a-z0-9.-]{1,251}[a-z0-9])$/.test(nodeHostname) || !nodeHostname.includes(".")) {
+    throw new SshBootstrapError("CLAIM_INVALID");
+  }
+};
+var target = (claim, pinned) => {
+  const address = pinned.addresses[0];
+  return `${claim.target.user}@${address.includes(":") ? `[${address}]` : address}`;
+};
+var sshOptions = (claim, pinned, knownHosts, keyPath) => [
+  "-F",
+  "/dev/null",
+  "-o",
+  "BatchMode=yes",
+  "-o",
+  "IdentitiesOnly=yes",
+  "-o",
+  `IdentityFile=${keyPath}`,
+  "-o",
+  "IdentityAgent=none",
+  "-o",
+  `UserKnownHostsFile=${knownHosts}`,
+  "-o",
+  "StrictHostKeyChecking=yes",
+  "-o",
+  `HostKeyAlias=${pinned.hostKeyAlias}`,
+  "-o",
+  "CheckHostIP=no",
+  "-o",
+  "ProxyCommand=none",
+  "-o",
+  "ProxyJump=none",
+  "-o",
+  "ForwardAgent=no",
+  "-o",
+  "ClearAllForwardings=yes",
+  "-o",
+  "ConnectTimeout=10",
+  "-p",
+  String(claim.target.port)
+];
+var scpOptions = (claim, pinned, knownHosts, keyPath) => {
+  const options = sshOptions(claim, pinned, knownHosts, keyPath);
+  const portFlag = options.lastIndexOf("-p");
+  if (portFlag < 0)
+    throw new SshBootstrapError("SSH_OPTIONS_INVALID");
+  options[portFlag] = "-P";
+  return options;
+};
+async function pinnedKnownHost(claim, pinned, directory, exec) {
+  const address = pinned.addresses[0];
+  const scanned = await checked(exec, [
+    "ssh-keyscan",
+    "-T",
+    "5",
+    "-p",
+    String(claim.target.port),
+    "-t",
+    "ed25519",
+    address
+  ], "HOST_KEY_SCAN_FAILED");
+  const candidates = scanned.split(`
+`).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+  let matched;
+  for (const line of candidates) {
+    const fingerprint = await checked(exec, ["ssh-keygen", "-E", "sha256", "-lf", "-"], "HOST_KEY_INVALID", { stdin: `${line}
+` });
+    if (fingerprint.split(/\s+/).includes(claim.target.hostKeySha256)) {
+      matched = line;
+      break;
+    }
+  }
+  if (!matched)
+    throw new SshBootstrapError("HOST_KEY_MISMATCH");
+  const key = matched.split(/\s+/).slice(1).join(" ");
+  if (!/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}$/.test(key))
+    throw new SshBootstrapError("HOST_KEY_INVALID");
+  const path = join2(directory, "known_hosts");
+  writeFileSync3(path, `${pinned.hostKeyAlias} ${key}
+`, { mode: 384, flag: "wx" });
+  return path;
+}
+var remoteInstallScript = `set -Eeuo pipefail
+umask 077
+work="$1"
+if [[ "$(/usr/local/bin/bun --version 2>/dev/null || true)" != "${PINNED_BUN_VERSION}" ]]; then
+  tmp="$(mktemp -d)"; trap 'rm -rf -- "$tmp"' EXIT
+  curl -fsSL https://bun.sh/install -o "$tmp/install"
+  echo "${BUN_INSTALLER_SHA256}  $tmp/install" | sha256sum -c -
+  BUN_INSTALL="$tmp/bun" BUN_VERSION=${PINNED_BUN_VERSION} bash "$tmp/install" >/dev/null
+  sudo -n install -d -m 0755 /usr/local/lib/forgezero/runtime
+  sudo -n install -m 0755 "$tmp/bun/bin/bun" /usr/local/lib/forgezero/runtime/bun.next
+  sudo -n mv -Tf /usr/local/lib/forgezero/runtime/bun.next /usr/local/lib/forgezero/runtime/bun
+  sudo -n ln -sfn /usr/local/lib/forgezero/runtime/bun /usr/local/bin/bun
+fi
+sudo -n install -d -m 0755 /usr/local/lib/forgezero/agent /usr/local/bin /run/forgezero-bootstrap
+sudo -n install -m 0755 "$work/fz.js" /usr/local/lib/forgezero/agent/fz.js
+sudo -n install -m 0755 "$work/fz-agent.js" /usr/local/lib/forgezero/agent/fz-agent.js
+sudo -n ln -sfn /usr/local/lib/forgezero/agent/fz.js /usr/local/bin/fz
+sudo -n install -m 0600 "$work/config.json" /run/forgezero-bootstrap/config.json
+sudo -n install -m 0600 "$work/enrol.token" /run/forgezero-bootstrap/enrol.token
+sudo -n /usr/local/bin/fz bootstrap tenant --bootstrap-config /run/forgezero-bootstrap/config.json --apply
+sudo -n rm -rf -- /run/forgezero-bootstrap
+`;
+async function executeSshBootstrap(claim, options) {
+  validateClaim(claim);
+  if (!options.sshKeyPath.startsWith("/") || /[\r\n]/.test(options.sshKeyPath))
+    throw new SshBootstrapError("SSH_KEY_INVALID");
+  const telemetry = new URL(options.targetTelemetryEndpoint);
+  if (telemetry.protocol !== "https:" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash || telemetry.port && telemetry.port !== "443")
+    throw new SshBootstrapError("TARGET_TELEMETRY_INVALID");
+  const api = new URL(options.platformApiUrl);
+  if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash)
+    throw new SshBootstrapError("TARGET_API_INVALID");
+  const exec = options.exec ?? defaultExec;
+  const directory = mkdtempSync(join2(tmpdir(), "forgezero-ssh-bootstrap-"));
+  chmodSync5(directory, 448);
+  let remoteDirectory = "";
+  let pinned;
+  try {
+    const sourceHost = claim.target.host.includes(":") ? `[${claim.target.host}]` : claim.target.host;
+    const resolved = await resolvePinnedGitTarget(`ssh://${claim.target.user}@${sourceHost}:${claim.target.port}/`, options.resolveHost);
+    if (!resolved || resolved.protocol !== "ssh")
+      throw new SshBootstrapError("TARGET_ADDRESS_REFUSED");
+    pinned = resolved;
+    const knownHosts = await pinnedKnownHost(claim, pinned, directory, exec);
+    const ssh = sshOptions(claim, pinned, knownHosts, options.sshKeyPath);
+    remoteDirectory = await checked(exec, ["ssh", ...ssh, target(claim, pinned), "--", "mktemp", "-d", "/tmp/forgezero-bootstrap.XXXXXXXX"], "SSH_UNREACHABLE");
+    if (!/^\/tmp\/forgezero-bootstrap\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
+      throw new SshBootstrapError("REMOTE_PATH_INVALID");
+    const config = {
+      kind: "tenant",
+      apiUrl: api.origin,
+      realm: claim.realm,
+      nodeHostname: claim.target.nodeHostname,
+      telemetryEndpoint: telemetry.origin,
+      enrolTokenFile: "/run/forgezero-bootstrap/enrol.token",
+      profile: "app",
+      software: [{ id: "bun", version: PINNED_BUN_VERSION }]
+    };
+    const files = {
+      "config.json": `${JSON.stringify(config, null, 2)}
+`,
+      "enrol.token": `${claim.enrolmentToken}
+`
+    };
+    for (const [name, content] of Object.entries(files))
+      writeFileSync3(join2(directory, name), content, { mode: 384, flag: "wx" });
+    const fzCliPath = options.fzCliPath ?? fileURLToPath(new URL("./fz.js", import.meta.url));
+    const fzAgentPath = options.fzAgentPath ?? fileURLToPath(new URL("./fz-agent.js", import.meta.url));
+    for (const [source, name] of [[fzCliPath, "fz.js"], [fzAgentPath, "fz-agent.js"]]) {
+      if (!readFileSync4(source).length)
+        throw new SshBootstrapError("PACKAGE_ARTIFACT_MISSING");
+      await checked(exec, [
+        "scp",
+        ...scpOptions(claim, pinned, knownHosts, options.sshKeyPath),
+        source,
+        `${target(claim, pinned)}:${remoteDirectory}/${name}`
+      ], "SCP_FAILED");
+    }
+    for (const name of Object.keys(files))
+      await checked(exec, [
+        "scp",
+        ...scpOptions(claim, pinned, knownHosts, options.sshKeyPath),
+        join2(directory, name),
+        `${target(claim, pinned)}:${remoteDirectory}/${name}`
+      ], "SCP_FAILED", { secret: name === "enrol.token" });
+    await checked(exec, ["ssh", ...ssh, target(claim, pinned), "--", "bash", "-s", "--", remoteDirectory], "REMOTE_BOOTSTRAP_FAILED", { stdin: remoteInstallScript, secret: true });
+  } finally {
+    if (remoteDirectory && pinned) {
+      try {
+        const knownHosts = join2(directory, "known_hosts");
+        await exec([
+          "ssh",
+          ...sshOptions(claim, pinned, knownHosts, options.sshKeyPath),
+          target(claim, pinned),
+          "--",
+          "sudo",
+          "-n",
+          "rm",
+          "-rf",
+          "--",
+          remoteDirectory
+        ]);
+      } catch {}
+    }
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+var post3 = (options, operation, body) => postSignedNode(options, `v1/node/bootstrap/${operation}`, body);
+async function pullSshBootstrapOnce(options) {
+  const response = await post3(options, "claim", {});
+  if (!response.claim)
+    return { status: "idle" };
+  const claim = response.claim;
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  const now = options.now ?? Date.now;
+  let expires = claim.claimExpiresAtTs;
+  let timer;
+  let stopped = false;
+  let renewal = null;
+  const renew = () => {
+    if (stopped)
+      return;
+    timer = setTimer(() => {
+      renewal = post3(options, "renew", {
+        computeKey: claim.computeKey,
+        claimToken: claim.claimToken
+      }).then((value) => {
+        expires = value.claimExpiresAtTs;
+      }).finally(() => {
+        renewal = null;
+        if (!stopped)
+          renew();
+      });
+    }, Math.max(1000, Math.floor(Math.max(0, expires - now()) / 3)));
+  };
+  renew();
+  try {
+    await executeSshBootstrap(claim, options);
+    stopped = true;
+    clearTimer(timer);
+    await renewal;
+    await post3(options, "complete", { computeKey: claim.computeKey, claimToken: claim.claimToken, ok: true });
+    return { status: "completed", computeKey: claim.computeKey, attempt: claim.attempt };
+  } catch (cause) {
+    stopped = true;
+    clearTimer(timer);
+    await renewal;
+    if (cause instanceof SignedNodeHttpError && cause.status < 500)
+      throw cause;
+    const failureCode = cause instanceof SshBootstrapError ? cause.code : "BOOTSTRAP_FAILED";
+    await post3(options, "complete", { computeKey: claim.computeKey, claimToken: claim.claimToken, ok: false, failureCode });
+    return { status: "failed", computeKey: claim.computeKey, attempt: claim.attempt, failureCode };
+  }
+}
+function startSshBootstrapPull(options) {
+  const interval = Math.max(1000, options.intervalMs ?? 5000);
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const clearTimer = options.clearTimer ?? ((handle) => clearTimeout(handle));
+  let stopped = false;
+  let timer;
+  let active = null;
+  const tick = () => {
+    if (stopped || active)
+      return;
+    active = pullSshBootstrapOnce(options).then((result) => options.onEvent?.(result.status, result.status === "idle" ? undefined : {
+      computeKey: result.computeKey,
+      attempt: result.attempt,
+      ...result.status === "failed" ? { failureCode: result.failureCode } : {}
+    })).catch((cause) => options.onEvent?.("poll-failed", cause)).finally(() => {
+      active = null;
+      if (!stopped)
+        timer = setTimer(tick, interval);
+    });
+  };
+  tick();
+  return {
+    async stop() {
+      stopped = true;
+      clearTimer(timer);
+      await active;
+    },
+    get active() {
+      return !stopped;
+    }
+  };
+}
+
 // src/metal-helper-socket.ts
-import { chmodSync as chmodSync5, existsSync as existsSync6, unlinkSync as unlinkSync5 } from "fs";
+import { chmodSync as chmodSync6, existsSync as existsSync6, unlinkSync as unlinkSync5 } from "fs";
 import { connect as connect2, createServer as createServer3 } from "net";
 
 // src/metal-provision.ts
@@ -6642,14 +6958,14 @@ import { createHash as createHash3 } from "crypto";
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   readdirSync,
-  rmSync,
+  rmSync as rmSync2,
   statSync as statSync2,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute3, join as join2 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3 } from "path";
 import { isIP as isIP2 } from "net";
 
 // src/compute.ts
@@ -6875,7 +7191,7 @@ function validateMetalProfile(profile) {
 var readManifests = (stateDir) => {
   if (!existsSync5(stateDir))
     return [];
-  return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync4(join2(stateDir, name), "utf8")));
+  return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync5(join3(stateDir, name), "utf8")));
 };
 function allocateAddress(profile, computeKey, rows) {
   const existing = rows.find((row) => row.computeKey === computeKey);
@@ -7008,7 +7324,7 @@ ethernets:
 `
   };
 }
-var checked = async (exec, argv) => {
+var checked2 = async (exec, argv) => {
   const result = await exec(argv);
   if (result.exitCode !== 0) {
     throw new MetalProvisionError(`${argv[0]} failed: ${(result.stderr || result.stdout).trim()}`);
@@ -7026,7 +7342,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   }
   if (!statSync2(image.path).isFile())
     throw new MetalProvisionError("configured image is not a file");
-  const digest = (await checked(exec, ["sha256sum", image.path])).stdout.trim().split(/\s+/)[0];
+  const digest = (await checked2(exec, ["sha256sum", image.path])).stdout.trim().split(/\s+/)[0];
   if (digest !== image.sha256)
     throw new MetalProvisionError("configured image checksum mismatch");
   for (const path of [profile.stateDir, profile.seedDir, profile.unitDir])
@@ -7043,7 +7359,7 @@ async function provisionMetalGuest(profile, claim, exec) {
   const conflictingName = manifests.find((row) => row.name === name && row.computeKey !== claim.computeKey);
   if (conflictingName)
     throw new MetalProvisionError("requested guest name is already allocated");
-  const manifestPath = join2(profile.stateDir, `${name}.json`);
+  const manifestPath = join3(profile.stateDir, `${name}.json`);
   const prior = manifests.find((row) => row.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
@@ -7060,25 +7376,25 @@ async function provisionMetalGuest(profile, claim, exec) {
     allowedMemoryNodes: cpuPool.memoryNodes,
     phase: "allocating"
   };
-  const save = () => writeFileSync3(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const save = () => writeFileSync4(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
   save();
   const lv = `/dev/${profile.volumeGroup}/${name}`;
   const exists = (await exec(["lvs", "--noheadings", lv])).exitCode === 0;
   if (!exists)
-    await checked(exec, ["lvcreate", "-y", "-n", name, "-L", `${claim.spec.diskGib}G`, profile.volumeGroup]);
+    await checked2(exec, ["lvcreate", "-y", "-n", name, "-L", `${claim.spec.diskGib}G`, profile.volumeGroup]);
   if (manifest.phase === "allocating") {
-    await checked(exec, ["qemu-img", "convert", "-O", "raw", image.path, lv]);
+    await checked2(exec, ["qemu-img", "convert", "-O", "raw", image.path, lv]);
     manifest.phase = "image-ready";
     save();
   }
-  const seedBase = join2(profile.seedDir, name);
+  const seedBase = join3(profile.seedDir, name);
   const init = cloudInit(profile, claim, manifest);
-  writeFileSync3(`${seedBase}-user-data`, init.userData, { mode: 384 });
-  writeFileSync3(`${seedBase}-meta-data`, init.metaData, { mode: 384 });
-  writeFileSync3(`${seedBase}-network-config`, init.networkConfig, { mode: 384 });
+  writeFileSync4(`${seedBase}-user-data`, init.userData, { mode: 384 });
+  writeFileSync4(`${seedBase}-meta-data`, init.metaData, { mode: 384 });
+  writeFileSync4(`${seedBase}-network-config`, init.networkConfig, { mode: 384 });
   const seed = `${seedBase}-seed.iso`;
-  await checked(exec, [
+  await checked2(exec, [
     "cloud-localds",
     "-N",
     `${seedBase}-network-config`,
@@ -7108,16 +7424,16 @@ async function provisionMetalGuest(profile, claim, exec) {
     throw new MetalProvisionError("confidential compute requested but host SNP profile is absent");
   }
   const service = `forgezero-guest@${name}.service`;
-  const unitPath = join2(profile.unitDir, service);
+  const unitPath = join3(profile.unitDir, service);
   mkdirSync3(dirname3(unitPath), { recursive: true });
-  writeFileSync3(unitPath, guestUnit(spec), { mode: 420 });
-  await checked(exec, ["systemctl", "daemon-reload"]);
+  writeFileSync4(unitPath, guestUnit(spec), { mode: 420 });
+  await checked2(exec, ["systemctl", "daemon-reload"]);
   if (prior?.phase === "running") {
-    await checked(exec, ["systemctl", "restart", service]);
+    await checked2(exec, ["systemctl", "restart", service]);
   } else {
-    await checked(exec, ["systemctl", "enable", "--now", service]);
+    await checked2(exec, ["systemctl", "enable", "--now", service]);
   }
-  await checked(exec, ["systemctl", "is-active", service]);
+  await checked2(exec, ["systemctl", "is-active", service]);
   manifest.phase = "running";
   save();
   return { guestAddress: address };
@@ -7126,11 +7442,11 @@ function legacyPlatformManifest(profile, claim, name) {
   if (claim.bootstrap?.kind !== "platform-genesis" || claim.computeKey !== `platform:${name}` || claim.spec.reference !== `platform:${name}` || claim.spec.guestAddress === undefined)
     return;
   const legacyDir = profile.legacyStateDir ?? "/etc/forgezero/guests";
-  const legacyPath = join2(legacyDir, `${name}.conf`);
+  const legacyPath = join3(legacyDir, `${name}.conf`);
   if (!existsSync5(legacyPath))
     return;
   const values = new Map;
-  for (const line of readFileSync4(legacyPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync5(legacyPath, "utf8").split(/\r?\n/)) {
     if (!line || line.startsWith("#"))
       continue;
     const match = /^([A-Z][A-Z0-9_]*)=([^\s'"`$;|&<>]+)$/.exec(line);
@@ -7160,13 +7476,13 @@ async function removeMetalGuest(profile, claim, exec) {
   if (claim.action !== "delete")
     throw new MetalProvisionError("create claim cannot remove a guest");
   const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
-  const manifestPath = join2(profile.stateDir, `${name}.json`);
+  const manifestPath = join3(profile.stateDir, `${name}.json`);
   const service = `forgezero-guest@${name}.service`;
-  const unitPath = join2(profile.unitDir, service);
+  const unitPath = join3(profile.unitDir, service);
   const lv = `/dev/${profile.volumeGroup}/${name}`;
-  const manifest = existsSync5(manifestPath) ? JSON.parse(readFileSync4(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
+  const manifest = existsSync5(manifestPath) ? JSON.parse(readFileSync5(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
   if (!manifest) {
-    const seedBase = join2(profile.seedDir, name);
+    const seedBase = join3(profile.seedDir, name);
     const localArtifacts = [
       unitPath,
       `${seedBase}-seed.iso`,
@@ -7192,33 +7508,33 @@ async function removeMetalGuest(profile, claim, exec) {
     throw new MetalProvisionError("compute identity conflicts with host inventory");
   }
   if (existsSync5(unitPath))
-    await checked(exec, ["systemctl", "disable", "--now", service]);
+    await checked2(exec, ["systemctl", "disable", "--now", service]);
   else if (legacyPlatformIdentity)
-    await checked(exec, ["systemctl", "disable", "--now", service]);
+    await checked2(exec, ["systemctl", "disable", "--now", service]);
   else if ((await exec(["systemctl", "is-active", service])).exitCode === 0) {
     throw new MetalProvisionError("guest unit is active but its owned unit file is missing");
   }
   if ((await exec(["lvs", "--noheadings", lv])).exitCode === 0)
-    await checked(exec, ["lvremove", "-fy", lv]);
+    await checked2(exec, ["lvremove", "-fy", lv]);
   for (const path of [
     unitPath,
-    join2(profile.seedDir, `${name}-seed.iso`),
-    join2(profile.seedDir, `${name}-user-data`),
-    join2(profile.seedDir, `${name}-meta-data`),
-    join2(profile.seedDir, `${name}-network-config`),
+    join3(profile.seedDir, `${name}-seed.iso`),
+    join3(profile.seedDir, `${name}-user-data`),
+    join3(profile.seedDir, `${name}-meta-data`),
+    join3(profile.seedDir, `${name}-network-config`),
     manifestPath
   ])
     if (existsSync5(path))
       unlinkSync4(path);
   if (legacyPlatformIdentity) {
-    const legacyConfig = join2(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
-    const legacyDropIn = join2(profile.unitDir, `${service}.d`);
+    const legacyConfig = join3(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
+    const legacyDropIn = join3(profile.unitDir, `${service}.d`);
     if (existsSync5(legacyConfig))
       unlinkSync4(legacyConfig);
     if (existsSync5(legacyDropIn))
-      rmSync(legacyDropIn, { recursive: true });
+      rmSync2(legacyDropIn, { recursive: true });
   }
-  await checked(exec, ["systemctl", "daemon-reload"]);
+  await checked2(exec, ["systemctl", "daemon-reload"]);
   return {};
 }
 
@@ -7301,7 +7617,7 @@ function startMetalHelper(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync5(socketPath, 432));
+  server.listen(socketPath, () => chmodSync6(socketPath, 432));
   return {
     server,
     async stop() {
@@ -7341,7 +7657,7 @@ function requestMetalProvision(claim, socketPath = DEFAULT_METAL_HELPER_SOCKET)
 }
 
 // src/deployment-runner.ts
-import { chmodSync as chmodSync6, existsSync as existsSync7, realpathSync, unlinkSync as unlinkSync6 } from "fs";
+import { chmodSync as chmodSync7, existsSync as existsSync7, realpathSync, unlinkSync as unlinkSync6 } from "fs";
 import { isAbsolute as isAbsolute4, resolve, sep } from "path";
 import { connect as connect3, createServer as createServer4 } from "net";
 var DEFAULT_DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
@@ -7490,7 +7806,7 @@ function startDeploymentRunner(options) {
   const ready = new Promise((resolveReady, rejectReady) => {
     server.once("error", rejectReady);
     server.listen(socketPath, () => {
-      chmodSync6(socketPath, options.socketMode ?? 432);
+      chmodSync7(socketPath, options.socketMode ?? 432);
       server.off("error", rejectReady);
       resolveReady();
     });
@@ -7720,8 +8036,8 @@ function startNodeAttestation(options) {
 }
 
 // src/metal-isolation.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join3 } from "path";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join4 } from "path";
 var members = (list) => list.split(",").flatMap((part) => {
   const [first, last = first] = part.split("-").map(Number);
   return Array.from({ length: last - first + 1 }, (_, index) => first + index);
@@ -7758,7 +8074,7 @@ function metalHousekeepingDropIn(profile, kind) {
 AllowedCPUs=${profile.housekeepingCpus}
 ${memoryDirective(profile.housekeepingMemoryNodes)}`;
 }
-var defaultExec = async (argv) => {
+var defaultExec2 = async (argv) => {
   const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe" });
   const [exitCode, stdout, stderr] = await Promise.all([
     child.exited,
@@ -7767,14 +8083,14 @@ var defaultExec = async (argv) => {
   ]);
   return { exitCode, stdout, stderr };
 };
-var checked2 = async (exec, argv) => {
+var checked3 = async (exec, argv) => {
   const result = await exec(argv);
   if (result.exitCode !== 0)
     throw new Error(`${argv[0]} failed: ${(result.stderr || result.stdout).trim()}`);
   return result;
 };
 var requireGuestsInSlice = async (exec) => {
-  const active = await checked2(exec, [
+  const active = await checked3(exec, [
     "systemctl",
     "list-units",
     "--type=service",
@@ -7788,33 +8104,33 @@ var requireGuestsInSlice = async (exec) => {
     const service = line.trim().split(/\s+/)[0];
     if (!service)
       continue;
-    const cgroup = await checked2(exec, ["systemctl", "show", "-p", "ControlGroup", "--value", service]);
+    const cgroup = await checked3(exec, ["systemctl", "show", "-p", "ControlGroup", "--value", service]);
     if (!cgroup.stdout.trim().includes("/forgezero-guests.slice/")) {
       throw new Error(`${service} must be drained and restarted into forgezero-guests.slice`);
     }
   }
 };
-async function applyMetalIsolation(profile, exec = defaultExec) {
+async function applyMetalIsolation(profile, exec = defaultExec2) {
   validateMetalProfile(profile);
   await requireGuestsInSlice(exec);
   const unitDir = profile.unitDir;
   mkdirSync4(unitDir, { recursive: true });
-  writeFileSync4(join3(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  writeFileSync5(join4(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
   for (const unit of ["system.slice", "user.slice"]) {
-    const directory = join3(unitDir, `${unit}.d`);
+    const directory = join4(unitDir, `${unit}.d`);
     mkdirSync4(directory, { recursive: true });
-    writeFileSync4(join3(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+    writeFileSync5(join4(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
   }
-  const initDirectory = join3(unitDir, "init.scope.d");
+  const initDirectory = join4(unitDir, "init.scope.d");
   mkdirSync4(initDirectory, { recursive: true });
-  writeFileSync4(join3(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
-  await checked2(exec, ["systemctl", "daemon-reload"]);
+  writeFileSync5(join4(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  await checked3(exec, ["systemctl", "daemon-reload"]);
   await requireGuestsInSlice(exec);
   const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
   if (profile.housekeepingMemoryNodes)
     properties.push(`AllowedMemoryNodes=${profile.housekeepingMemoryNodes}`);
   for (const unit of ["system.slice", "user.slice", "init.scope"]) {
-    await checked2(exec, ["systemctl", "set-property", "--runtime", unit, ...properties]);
+    await checked3(exec, ["systemctl", "set-property", "--runtime", unit, ...properties]);
   }
 }
 
@@ -7842,7 +8158,7 @@ async function closeServerWithin(server, timeoutMs) {
 }
 
 // src/lifecycle-helper.ts
-import { chmodSync as chmodSync7, existsSync as existsSync9, readFileSync as readFileSync5, unlinkSync as unlinkSync7 } from "fs";
+import { chmodSync as chmodSync8, existsSync as existsSync9, readFileSync as readFileSync6, unlinkSync as unlinkSync7 } from "fs";
 import { connect as connect4, createConnection, createServer as createServer5, isIP as isIP3 } from "net";
 var DEFAULT_LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
 var MAX_REQUEST_BYTES4 = 16 * 1024;
@@ -7886,7 +8202,7 @@ function validateLifecycleProfile(profile) {
   }
 }
 function loadLifecycleProfile(path) {
-  const profile = JSON.parse(readFileSync5(path, "utf8"));
+  const profile = JSON.parse(readFileSync6(path, "utf8"));
   validateLifecycleProfile(profile);
   return profile;
 }
@@ -8024,7 +8340,7 @@ function startLifecycleHelper(options) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync7(socketPath, 432));
+  server.listen(socketPath, () => chmodSync8(socketPath, 432));
   return {
     server,
     async stop() {
@@ -8064,7 +8380,7 @@ function requestLifecycleAction(claim, socketPath = DEFAULT_LIFECYCLE_HELPER_SOC
 }
 
 // src/warp-config.ts
-import { chmodSync as chmodSync8, mkdirSync as mkdirSync5, renameSync as renameSync3, symlinkSync, unlinkSync as unlinkSync8, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync as chmodSync9, mkdirSync as mkdirSync5, renameSync as renameSync3, symlinkSync, unlinkSync as unlinkSync8, writeFileSync as writeFileSync6 } from "fs";
 var xml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 function renderWarpMdm(options) {
   if (!/^[a-z0-9][a-z0-9-]{0,62}$/i.test(options.organization))
@@ -8088,8 +8404,8 @@ function materializeWarpMdm(options) {
   mkdirSync5(runtimePath.replace(/\/[^/]+$/, ""), { recursive: true, mode: 448 });
   mkdirSync5(servicePath.replace(/\/[^/]+$/, ""), { recursive: true, mode: 448 });
   const next = `${runtimePath}.next`;
-  writeFileSync5(next, renderWarpMdm(options), { mode: 384 });
-  chmodSync8(next, 384);
+  writeFileSync6(next, renderWarpMdm(options), { mode: 384 });
+  chmodSync9(next, 384);
   renameSync3(next, runtimePath);
   try {
     unlinkSync8(servicePath);
@@ -8104,20 +8420,20 @@ function materializeWarpMdm(options) {
 // src/agent-update.ts
 import { createHash as createHash4, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
 import {
-  chmodSync as chmodSync9,
+  chmodSync as chmodSync10,
   closeSync,
   existsSync as existsSync10,
   fsyncSync,
   mkdirSync as mkdirSync6,
   openSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readlinkSync,
   renameSync as renameSync4,
-  rmSync as rmSync2,
+  rmSync as rmSync3,
   symlinkSync as symlinkSync2,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname4, join as join4, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join5, resolve as resolve2 } from "path";
 var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
 var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
 var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
@@ -8133,10 +8449,10 @@ var syncPath = (path) => {
 };
 var syncReleaseDirectory = (directory) => {
   for (const path of [
-    join4(directory, "package.json"),
-    join4(directory, "dist", "fz-agent.js"),
-    join4(directory, "dist", "fz.js"),
-    join4(directory, "dist"),
+    join5(directory, "package.json"),
+    join5(directory, "dist", "fz-agent.js"),
+    join5(directory, "dist", "fz.js"),
+    join5(directory, "dist"),
     directory,
     dirname4(directory)
   ])
@@ -8189,27 +8505,27 @@ var command = async (input) => {
   ]);
   return { exitCode, output: `${stdout}${stderr}` };
 };
-var checked3 = async (run, input, label) => {
+var checked4 = async (run, input, label) => {
   const result = await run(input);
   if (result.exitCode !== 0)
     throw new Error(`${label} failed: ${result.output.trim()}`);
   return result;
 };
 async function validateReleaseDirectory(directory, release, run) {
-  const manifest = JSON.parse(readFileSync6(join4(directory, "package.json"), "utf8"));
+  const manifest = JSON.parse(readFileSync7(join5(directory, "package.json"), "utf8"));
   if (manifest.name !== release.package || manifest.version !== release.version) {
     throw new Error("agent update manifest does not match the selected release");
   }
-  const agent = join4(directory, "dist", "fz-agent.js");
-  const cli = join4(directory, "dist", "fz.js");
+  const agent = join5(directory, "dist", "fz-agent.js");
+  const cli = join5(directory, "dist", "fz.js");
   for (const binary of [agent, cli]) {
-    if (!readFileSync6(binary, "utf8").startsWith(`#!/usr/bin/env bun
+    if (!readFileSync7(binary, "utf8").startsWith(`#!/usr/bin/env bun
 `)) {
       throw new Error("agent update artifact is not a self-contained Bun executable");
     }
-    chmodSync9(binary, 493);
+    chmodSync10(binary, 493);
   }
-  const version = (await checked3(run, { command: agent, args: ["--version"] }, "agent update smoke test")).output.trim();
+  const version = (await checked4(run, { command: agent, args: ["--version"] }, "agent update smoke test")).output.trim();
   if (version !== release.version)
     throw new Error(`agent update binary reports ${version}`);
 }
@@ -8219,12 +8535,12 @@ async function stageAgentRelease(releaseInput, options) {
     throw new Error(`agent update ${release.version} is not newer than ${options.currentVersion}`);
   }
   const root = resolve2(options.root ?? DEFAULT_AGENT_RELEASE_ROOT);
-  const versions = join4(root, "versions");
-  const finalDirectory = join4(versions, release.version);
-  const currentLink = join4(root, "current");
-  const stage2 = join4(versions, `.${release.version}.${randomUUID2()}.staging`);
-  const archive = join4(stage2, "agent.tgz");
-  const unpacked = join4(stage2, "unpacked");
+  const versions = join5(root, "versions");
+  const finalDirectory = join5(versions, release.version);
+  const currentLink = join5(root, "current");
+  const stage2 = join5(versions, `.${release.version}.${randomUUID2()}.staging`);
+  const archive = join5(stage2, "agent.tgz");
+  const unpacked = join5(stage2, "unpacked");
   const run = options.run ?? command;
   mkdirSync6(unpacked, { recursive: true, mode: 448 });
   try {
@@ -8245,8 +8561,8 @@ async function stageAgentRelease(releaseInput, options) {
     const actual = createHash4("sha512").update(bytes).digest();
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
-    writeFileSync6(archive, bytes, { mode: 384, flag: "wx" });
-    await checked3(run, {
+    writeFileSync7(archive, bytes, { mode: 384, flag: "wx" });
+    await checked4(run, {
       command: "/usr/bin/tar",
       args: [
         "-xzf",
@@ -8269,10 +8585,10 @@ async function stageAgentRelease(releaseInput, options) {
       throw new Error("agent update requires an active immutable release to roll back to");
     }
     const previousTarget = readlinkSync(currentLink);
-    if (previousTarget !== join4("versions", options.currentVersion)) {
+    if (previousTarget !== join5("versions", options.currentVersion)) {
       throw new Error("agent update current release does not match the running version");
     }
-    if (!existsSync10(join4(root, previousTarget))) {
+    if (!existsSync10(join5(root, previousTarget))) {
       throw new Error("agent update rollback release is missing");
     }
     return {
@@ -8280,51 +8596,51 @@ async function stageAgentRelease(releaseInput, options) {
       fromVersion: options.currentVersion,
       directory: finalDirectory,
       previousTarget,
-      nextTarget: join4("versions", release.version),
+      nextTarget: join5("versions", release.version),
       currentLink
     };
   } finally {
-    rmSync2(stage2, { recursive: true, force: true });
+    rmSync3(stage2, { recursive: true, force: true });
   }
 }
 function selectAgentRelease(staged) {
-  const next = join4(dirname4(staged.currentLink), `.current.${randomUUID2()}.next`);
+  const next = join5(dirname4(staged.currentLink), `.current.${randomUUID2()}.next`);
   try {
     symlinkSync2(staged.nextTarget, next);
     renameSync4(next, staged.currentLink);
     syncPath(dirname4(staged.currentLink));
   } finally {
-    rmSync2(next, { force: true });
+    rmSync3(next, { force: true });
   }
 }
 function restoreAgentRelease(staged) {
-  const next = join4(dirname4(staged.currentLink), `.current.${randomUUID2()}.rollback`);
+  const next = join5(dirname4(staged.currentLink), `.current.${randomUUID2()}.rollback`);
   try {
     symlinkSync2(staged.previousTarget, next);
     renameSync4(next, staged.currentLink);
     syncPath(dirname4(staged.currentLink));
   } finally {
-    rmSync2(next, { force: true });
+    rmSync3(next, { force: true });
   }
 }
 
 // src/agent-update-helper.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import {
-  chmodSync as chmodSync10,
+  chmodSync as chmodSync11,
   closeSync as closeSync2,
   existsSync as existsSync11,
   fsyncSync as fsyncSync2,
   mkdirSync as mkdirSync7,
   openSync as openSync2,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   renameSync as renameSync5,
-  rmSync as rmSync3,
+  rmSync as rmSync4,
   unlinkSync as unlinkSync9,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "fs";
 import { connect as connect5, createServer as createServer6 } from "net";
-import { dirname as dirname5, join as join5, resolve as resolve3 } from "path";
+import { dirname as dirname5, join as join6, resolve as resolve3 } from "path";
 var AGENT_UPDATE_GROUP = "forgezero-update";
 var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
 var AGENT_UPDATE_JOURNAL = "/var/lib/forgezero/agent-update.json";
@@ -8408,12 +8724,12 @@ function validateJournal(value, root) {
     throw new Error("Agent update failure count is invalid");
   }
   const releaseRoot = resolve3(root);
-  if (journal.currentLink !== join5(releaseRoot, "current"))
+  if (journal.currentLink !== join6(releaseRoot, "current"))
     throw new Error("Agent update current link is invalid");
-  if (journal.previousTarget !== join5("versions", receipt.fromVersion)) {
+  if (journal.previousTarget !== join6("versions", receipt.fromVersion)) {
     throw new Error("Agent update rollback target is invalid");
   }
-  if (journal.nextTarget !== join5("versions", receipt.targetVersion)) {
+  if (journal.nextTarget !== join6("versions", receipt.targetVersion)) {
     throw new Error("Agent update next target is invalid");
   }
   return journal;
@@ -8421,7 +8737,7 @@ function validateJournal(value, root) {
 function readJournal(path, root) {
   if (!existsSync11(path))
     return;
-  return validateJournal(JSON.parse(readFileSync7(path, "utf8")), root);
+  return validateJournal(JSON.parse(readFileSync8(path, "utf8")), root);
 }
 function writeAtomic(path, value, mode) {
   mkdirSync7(dirname5(path), { recursive: true, mode: 493 });
@@ -8429,7 +8745,7 @@ function writeAtomic(path, value, mode) {
   let file;
   try {
     file = openSync2(next, "wx", mode);
-    writeFileSync7(file, `${JSON.stringify(value)}
+    writeFileSync8(file, `${JSON.stringify(value)}
 `);
     fsyncSync2(file);
     closeSync2(file);
@@ -8444,7 +8760,7 @@ function writeAtomic(path, value, mode) {
   } finally {
     if (file !== undefined)
       closeSync2(file);
-    rmSync3(next, { force: true });
+    rmSync4(next, { force: true });
   }
 }
 var publicReceipt = (journal) => {
@@ -8479,7 +8795,7 @@ function readAgentUpdateReceipt(path = AGENT_UPDATE_RECEIPT) {
   try {
     if (!existsSync11(path))
       return;
-    return validateReceipt(JSON.parse(readFileSync7(path, "utf8")));
+    return validateReceipt(JSON.parse(readFileSync8(path, "utf8")));
   } catch {
     return;
   }
@@ -8503,21 +8819,21 @@ var retryAfter = (now, failures) => now + Math.min(UPDATE_RETRY_MAX_MS, UPDATE_R
 var stagedFromJournal = (journal, root) => ({
   version: journal.targetVersion,
   fromVersion: journal.fromVersion,
-  directory: join5(resolve3(root), journal.nextTarget),
+  directory: join6(resolve3(root), journal.nextTarget),
   previousTarget: journal.previousTarget,
   nextTarget: journal.nextTarget,
   currentLink: journal.currentLink
 });
-var restartAgent = async (target, run) => {
-  const helpers = target === "compute" ? COMPUTE_HELPER_UNITS : ["forgezero-metal-helper.service"];
+var restartAgent = async (target2, run) => {
+  const helpers = target2 === "compute" ? COMPUTE_HELPER_UNITS : ["forgezero-metal-helper.service"];
   for (const unit of helpers)
     await run({ command: "/usr/bin/systemctl", args: ["try-restart", unit] });
-  const service = target === "compute" ? "forgezero-agent.service" : "forgezero-metal-agent.service";
+  const service = target2 === "compute" ? "forgezero-agent.service" : "forgezero-metal-agent.service";
   if (!await runOk(run, "/usr/bin/systemctl", ["restart", service])) {
     throw new Error(`systemd could not restart ${service}`);
   }
 };
-var targetProbe = (target, run) => target === "compute" ? () => probeAgentSocket() : async () => await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-agent.service"]) && await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-helper.service"]);
+var targetProbe = (target2, run) => target2 === "compute" ? () => probeAgentSocket() : async () => await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-agent.service"]) && await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-helper.service"]);
 function probeAgentSocket(socketPath = DEFAULT_SOCKET, timeoutMs = 5000) {
   return new Promise((resolve4) => {
     const socket = connect5(socketPath);
@@ -8552,8 +8868,8 @@ function probeAgentSocket(socketPath = DEFAULT_SOCKET, timeoutMs = 5000) {
 }
 async function activateAgentRelease(staged, options = {}) {
   const run = options.run ?? runCommand;
-  const target = options.target ?? "compute";
-  const probe = options.probe ?? targetProbe(target, run);
+  const target2 = options.target ?? "compute";
+  const probe = options.probe ?? targetProbe(target2, run);
   const now = options.now ?? Date.now;
   const journalPath = options.journalPath ?? AGENT_UPDATE_JOURNAL;
   const receiptPath = options.receiptPath ?? AGENT_UPDATE_RECEIPT;
@@ -8566,7 +8882,7 @@ async function activateAgentRelease(staged, options = {}) {
   let journal = {
     schemaVersion: 1,
     attemptId,
-    target,
+    target: target2,
     fromVersion: staged.fromVersion,
     targetVersion: staged.version,
     outcome: "activating",
@@ -8582,7 +8898,7 @@ async function activateAgentRelease(staged, options = {}) {
   try {
     selectionAttempted = true;
     selectAgentRelease(staged);
-    await restartAgent(target, run);
+    await restartAgent(target2, run);
     if (!await probe())
       throw new Error("the replacement Agent did not answer its retained Vault socket");
     journal = { ...journal, outcome: "active", updatedAtTs: now(), rollbackHealthy: undefined };
@@ -8600,7 +8916,7 @@ async function activateAgentRelease(staged, options = {}) {
       try {
         restoreAgentRelease(staged);
         restored = true;
-        await restartAgent(target, run);
+        await restartAgent(target2, run);
         rollbackHealthy = await probe();
       } catch {
         rollbackHealthy = false;
@@ -8633,7 +8949,7 @@ async function recoverInterruptedAgentUpdate(options = {}) {
     return publicReceipt(journal);
   }
   const staged = stagedFromJournal(journal, root);
-  if (!existsSync11(join5(root, journal.previousTarget))) {
+  if (!existsSync11(join6(root, journal.previousTarget))) {
     throw new Error("Agent update rollback release is missing");
   }
   const run = options.run ?? runCommand;
@@ -8670,7 +8986,7 @@ function startAgentUpdateHelper(options = {}) {
   const receiptPath = options.receiptPath ?? AGENT_UPDATE_RECEIPT;
   const journalPath = options.journalPath ?? AGENT_UPDATE_JOURNAL;
   const releaseRoot = options.root ?? DEFAULT_AGENT_RELEASE_ROOT;
-  const activate = options.activate ?? ((staged, target, attemptId) => activateAgentRelease(staged, { target, attemptId, journalPath, receiptPath, now: options.now }));
+  const activate = options.activate ?? ((staged, target2, attemptId) => activateAgentRelease(staged, { target: target2, attemptId, journalPath, receiptPath, now: options.now }));
   let busy = true;
   let blocked;
   (options.recover ?? (() => recoverInterruptedAgentUpdate({
@@ -8744,7 +9060,7 @@ function startAgentUpdateHelper(options = {}) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync10(socketPath, 432));
+  server.listen(socketPath, () => chmodSync11(socketPath, 432));
   return server;
 }
 function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, timeoutMs = 90000) {
@@ -8774,10 +9090,10 @@ function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, t
 }
 
 // src/agent-heartbeat.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 
 // src/version.ts
-var VERSION3 = "0.1.35";
+var VERSION3 = "0.1.36";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");
@@ -8785,7 +9101,7 @@ var remoteOutcome4 = (cause) => cause instanceof SignedNodeHttpError && cause.st
 
 class AgentUpdateRefusedError extends Error {
 }
-function observeAgentHost(version = VERSION3, mode = "enrolled", osRelease = readFileSync8("/etc/os-release", "utf8"), architecture = process.arch) {
+function observeAgentHost(version = VERSION3, mode = "enrolled", osRelease = readFileSync9("/etc/os-release", "utf8"), architecture = process.arch) {
   const values = Object.fromEntries(osRelease.split(`
 `).flatMap((line) => {
     const separator = line.indexOf("=");
@@ -8895,7 +9211,7 @@ function startAgentHeartbeat(options) {
 }
 
 // src/software-helper.ts
-import { chmodSync as chmodSync11, existsSync as existsSync12, mkdirSync as mkdirSync8, unlinkSync as unlinkSync10 } from "fs";
+import { chmodSync as chmodSync12, existsSync as existsSync12, mkdirSync as mkdirSync8, unlinkSync as unlinkSync10 } from "fs";
 import { connect as connect6, createServer as createServer7 } from "net";
 import { dirname as dirname6 } from "path";
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
@@ -8967,7 +9283,7 @@ function startSoftwareHelper(options = {}) {
     });
     socket.on("error", () => socket.destroy());
   });
-  server.listen(socketPath, () => chmodSync11(socketPath, 432));
+  server.listen(socketPath, () => chmodSync12(socketPath, 432));
   return server;
 }
 function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
@@ -9530,7 +9846,7 @@ function createAgentTelemetry(input, options = {}) {
       logs.push(logRecord("telemetry.queue_overflow"));
     }
   };
-  const post3 = async (path, body, sentItems) => {
+  const post4 = async (path, body, sentItems) => {
     for (let attempt = 0;attempt < AGENT_OTLP_MAX_ATTEMPTS; attempt += 1) {
       try {
         const response = await send(`${config.endpoint}${path}`, {
@@ -9581,9 +9897,9 @@ function createAgentTelemetry(input, options = {}) {
       addExportDiscards(records.length);
       return;
     }
-    const target = kind === "traces" ? spans : logs;
+    const target2 = kind === "traces" ? spans : logs;
     const maximum = kind === "traces" ? AGENT_TELEMETRY_MAX_SPANS : AGENT_TELEMETRY_MAX_LOGS;
-    const combined = [...records, ...target];
+    const combined = [...records, ...target2];
     const overflow = Math.max(0, combined.length - maximum);
     const retained = combined.slice(-maximum);
     if (kind === "traces")
@@ -9736,7 +10052,7 @@ function createAgentTelemetry(input, options = {}) {
         exports.push({
           kind: "traces",
           itemCount: currentSpans.length,
-          promise: post3("/v1/traces", {
+          promise: post4("/v1/traces", {
             resourceSpans: [{ resource, scopeSpans: [{
               scope: { name: "forgezero.agent" },
               spans: currentSpans
@@ -9747,7 +10063,7 @@ function createAgentTelemetry(input, options = {}) {
         exports.push({
           kind: "metrics",
           itemCount: metricPointCount,
-          promise: post3("/v1/metrics", {
+          promise: post4("/v1/metrics", {
             resourceMetrics: [{ resource, scopeMetrics: [{
               scope: { name: "forgezero.agent" },
               metrics: metricInstruments
@@ -9758,7 +10074,7 @@ function createAgentTelemetry(input, options = {}) {
         exports.push({
           kind: "logs",
           itemCount: currentLogs.length,
-          promise: post3("/v1/logs", {
+          promise: post4("/v1/logs", {
             resourceLogs: [{ resource, scopeLogs: [{
               scope: { name: "forgezero.agent" },
               logRecords: currentLogs
@@ -9881,7 +10197,7 @@ class AgentTelemetryRuntime {
 // src/index.ts
 function loadOrCreateSeed(path) {
   if (existsSync13(path)) {
-    const seed2 = new Uint8Array(Buffer.from(readFileSync9(path, "utf8").trim(), "base64url"));
+    const seed2 = new Uint8Array(Buffer.from(readFileSync10(path, "utf8").trim(), "base64url"));
     if (seed2.length < 32) {
       throw new Error(`agent: the seed at ${path} is too short to derive a key from.`);
     }
@@ -9889,8 +10205,8 @@ function loadOrCreateSeed(path) {
   }
   mkdirSync9(dirname7(path), { recursive: true });
   const seed = new Uint8Array(randomBytes5(32));
-  writeFileSync8(path, Buffer.from(seed).toString("base64url"), { mode: 384 });
-  chmodSync12(path, 384);
+  writeFileSync9(path, Buffer.from(seed).toString("base64url"), { mode: 384 });
+  chmodSync13(path, 384);
   return seed;
 }
 var DEFAULT_SOCKET_PATH = DEFAULT_SOCKET;
@@ -9921,7 +10237,7 @@ function loadSeedCredential(name = DEFAULT_SEED_CREDENTIAL, directory = process.
   const path = `${directory}/${name}`;
   if (!existsSync13(path))
     throw new Error(`agent: the systemd credential ${name} is missing at ${path}.`);
-  const seed = new Uint8Array(Buffer.from(readFileSync9(path, "utf8").trim(), "base64url"));
+  const seed = new Uint8Array(Buffer.from(readFileSync10(path, "utf8").trim(), "base64url"));
   if (seed.length < 32)
     throw new Error(`agent: the systemd credential ${name} is too short to derive a key from.`);
   return seed;
@@ -9931,7 +10247,7 @@ function loadTextCredential(name, directory = process.env.CREDENTIALS_DIRECTORY)
     throw new Error("agent: CREDENTIALS_DIRECTORY is missing; systemd did not load the credential.");
   if (!/^[A-Za-z0-9_.-]+$/.test(name))
     throw new Error("agent: invalid systemd credential name.");
-  const value = readFileSync9(`${directory}/${name}`, "utf8").trim();
+  const value = readFileSync10(`${directory}/${name}`, "utf8").trim();
   if (!value)
     throw new Error(`agent: systemd credential ${name} is empty.`);
   return value;
@@ -10054,7 +10370,7 @@ if (import.meta.main) {
       keys: keys2,
       label: process.env.FZ_NODE_LABEL,
       edgeHostname: process.env.FZ_NODE_HOSTNAME,
-      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync9(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
+      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync10(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
       privateNetworkAttachment: privateNetworkAttachmentFromEnvironment()
     });
     console.log(`[agent] enrolled ${binding2.computeReference} in project ${binding2.projectKey}/${binding2.environmentKey}`);
@@ -10087,7 +10403,7 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-helper requires --profile=/absolute/path.json");
-    const profile2 = JSON.parse(readFileSync9(profilePath, "utf8"));
+    const profile2 = JSON.parse(readFileSync10(profilePath, "utf8"));
     const helper = startMetalHelper({
       profile: profile2,
       socketPath: process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET
@@ -10205,7 +10521,7 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-isolation requires --profile=/absolute/path.json");
-    const profile2 = JSON.parse(readFileSync9(profilePath, "utf8"));
+    const profile2 = JSON.parse(readFileSync10(profilePath, "utf8"));
     await applyMetalIsolation(profile2);
     console.log("[metal-isolation] host and guest cgroup boundaries active");
     process.exit(0);
@@ -10250,7 +10566,7 @@ if (import.meta.main) {
     if (claimArg !== "-" && !claimArg.startsWith("/")) {
       throw new Error("metal-apply claim path must be absolute");
     }
-    const raw = readFileSync9(claimArg === "-" ? "/dev/stdin" : claimArg, "utf8");
+    const raw = readFileSync10(claimArg === "-" ? "/dev/stdin" : claimArg, "utf8");
     if (Buffer.byteLength(raw) > 32 * 1024)
       throw new Error("metal-apply claim exceeds 32 KiB");
     const claim = JSON.parse(raw);
@@ -10396,7 +10712,7 @@ if (import.meta.main) {
       keys,
       label: process.env.FZ_NODE_LABEL,
       edgeHostname: process.env.FZ_NODE_HOSTNAME,
-      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync9(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
+      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync10(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
       privateNetworkAttachment: privateNetworkAttachmentFromEnvironment()
     });
     console.log(`[agent] enrolled ${binding.computeReference} in project ${binding.projectKey}/${binding.environmentKey}`);
@@ -10456,6 +10772,23 @@ if (import.meta.main) {
   }) : undefined;
   if (migrationPull)
     console.log("[agent] PQ-authenticated outbound lifecycle claims enabled");
+  const bootstrapEnabled = process.env.FZ_BOOTSTRAP_PULL === "true";
+  const bootstrapCredential = process.env.FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL;
+  const bootstrapKeyPath = bootstrapCredential && process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/${bootstrapCredential}` : undefined;
+  if (bootstrapEnabled && (!binding || !nodeApiUrl || !process.env.FZ_API || !bootstrapKeyPath || !existsSync13(bootstrapKeyPath) || !process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT)) {
+    throw new Error("agent: bootstrap runner requires enrolment, API, local SSH credential and target OTLP coordinate");
+  }
+  const bootstrapPull = bootstrapEnabled ? startSshBootstrapPull({
+    apiUrl: nodeApiUrl,
+    platformApiUrl: process.env.FZ_API,
+    nodeKey,
+    keys,
+    sshKeyPath: bootstrapKeyPath,
+    targetTelemetryEndpoint: process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT,
+    onEvent: (event) => console.log(`[agent] bootstrap ${event}`)
+  }) : undefined;
+  if (bootstrapPull)
+    console.log("[agent] PQ-authenticated delegated SSH bootstrap claims enabled");
   const systemdDeploymentSecrets = createSystemdDeploymentSecrets(process.env.FZ_DEPLOY_SYSTEMD_SECRETS);
   const deploymentSecrets = secretCache ? {
     async get(name) {
@@ -10493,10 +10826,10 @@ if (import.meta.main) {
         return [name, process.env[name]];
       })),
       gitCredentialPath: process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/git-deploy-key` : undefined,
-      knownHostsPath: source.knownHosts ? join6(root, "cache", `known-hosts-${key}`) : undefined,
+      knownHostsPath: source.knownHosts ? join7(root, "cache", `known-hosts-${key}`) : undefined,
       knownHostsContent: source.knownHosts,
       cache: deploymentSecrets,
-      capacityEvidenceDirectory: process.env.FZ_CAPACITY_EVIDENCE_DIR ?? join6(root, "cache", "capacity"),
+      capacityEvidenceDirectory: process.env.FZ_CAPACITY_EVIDENCE_DIR ?? join7(root, "cache", "capacity"),
       ensureSoftware: (requirements) => requestSoftware(requirements, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
       projectExec: process.env.FZ_DEPLOY_RUNNER_SOCKET ? (input) => requestDeploymentCommand(input, process.env.FZ_DEPLOY_RUNNER_SOCKET) : undefined
     });
@@ -10545,7 +10878,8 @@ if (import.meta.main) {
         try {
           await Promise.all([
             pull?.stop() ?? Promise.resolve(),
-            migrationPull?.stop() ?? Promise.resolve()
+            migrationPull?.stop() ?? Promise.resolve(),
+            bootstrapPull?.stop() ?? Promise.resolve()
           ]);
           const reports = await Promise.all([...new Set(managers.values())].map((manager) => manager.stop(Math.max(1, Number(process.env.FZ_DRAIN_DEADLINE_MS ?? 30000)))));
           if (reports.some(({ timedOut }) => timedOut)) {
@@ -10583,9 +10917,10 @@ if (import.meta.main) {
       const vaultDrain = vaultSync?.stop() ?? Promise.resolve();
       const attestationDrain = attestationLoop?.stop() ?? Promise.resolve();
       const migrationDrain = migrationPull?.stop() ?? Promise.resolve();
+      const bootstrapDrain = bootstrapPull?.stop() ?? Promise.resolve();
       const heartbeatDrain = heartbeat?.stop() ?? Promise.resolve();
       const pullDrained = pull ? await settleWithin(pullDrain, remaining()) : true;
-      const backgroundDrained = await settleWithin(Promise.all([vaultDrain, attestationDrain, migrationDrain, heartbeatDrain]), remaining());
+      const backgroundDrained = await settleWithin(Promise.all([vaultDrain, attestationDrain, migrationDrain, bootstrapDrain, heartbeatDrain]), remaining());
       const managerReports = await Promise.all([...new Set(managers.values())].map((manager) => manager.stop(remaining())));
       const socketClosed = await closeServerWithin(server, remaining());
       telemetry.event("agent.stopped");
@@ -10616,7 +10951,10 @@ if (import.meta.main) {
           return;
         updatePrepared = true;
         try {
-          await migrationPull?.stop();
+          await Promise.all([
+            migrationPull?.stop() ?? Promise.resolve(),
+            bootstrapPull?.stop() ?? Promise.resolve()
+          ]);
           telemetry.event("agent.update_prepared");
         } catch (cause) {
           updatePrepared = false;
@@ -10648,6 +10986,7 @@ if (import.meta.main) {
         vaultSync?.stop() ?? Promise.resolve(),
         attestationLoop?.stop() ?? Promise.resolve(),
         migrationPull?.stop() ?? Promise.resolve(),
+        bootstrapPull?.stop() ?? Promise.resolve(),
         heartbeat?.stop() ?? Promise.resolve()
       ]), remaining());
       const socketClosed = await closeServerWithin(server, remaining());
@@ -10670,6 +11009,7 @@ export {
   systemdListenFd,
   systemdAgentEgressDirectives,
   superviseAgentEgressPolicy,
+  startSshBootstrapPull,
   startSoftwareHelper,
   startProvisioningPull,
   startNodeVaultSync,
@@ -10699,6 +11039,7 @@ export {
   removeMetalGuest,
   recoverInterruptedAgentUpdate,
   readAgentUpdateReceipt,
+  pullSshBootstrapOnce,
   pullProvisioningOnce,
   pullMigrationOnce,
   pullDeploymentOnce,
@@ -10722,6 +11063,7 @@ export {
   handleRequest,
   handleApplicationRequest,
   guestNameFor,
+  executeSshBootstrap,
   executeLifecycleAction,
   ensureSoftwareRequirements,
   enrolGuestIdentity,