@forgezero/agent 0.1.38 → 0.1.40

package/dist/bootstrap.js

@@ -130,23 +130,32 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
   const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
   const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
-  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
-  const existing = current.config?.ingress ?? [];
-  const catchAll = existing.filter((rule) => !("hostname" in rule));
-  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
-  await cf(tunnelAuth, tunnelPath, {
-    method: "PUT",
-    body: JSON.stringify({ config: { ingress: [
-      { hostname: config.hostname, service: config.service },
-      ...otherHosts,
-      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
-    ] } })
-  }, fetcher);
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
-  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  const [current, records] = await Promise.all([
+    cf(tunnelAuth, tunnelPath, {}, fetcher),
+    cf(dnsAuth, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
+  ]);
   if (records.length > 1) {
     throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
   }
+  const existingRecord = records[0];
+  if (existingRecord && (existingRecord.type !== "CNAME" || existingRecord.name && existingRecord.name.toLowerCase() !== config.hostname.toLowerCase())) {
+    throw new Error(`Cloudflare DNS hostname ${config.hostname} is already owned by an incompatible ${existingRecord.type ?? "unknown"} record`);
+  }
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  const desiredIngress = [
+    { hostname: config.hostname, service: config.service },
+    ...otherHosts,
+    ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+  ];
+  if (JSON.stringify(existing) !== JSON.stringify(desiredIngress)) {
+    await cf(tunnelAuth, tunnelPath, {
+      method: "PUT",
+      body: JSON.stringify({ config: { ingress: desiredIngress } })
+    }, fetcher);
+  }
   const record = {
     type: "CNAME",
     name: config.hostname,
@@ -154,233 +163,13 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
     proxied: true,
     ttl: 1
   };
-  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
-    method: records[0] ? "PUT" : "POST",
-    body: JSON.stringify(record)
-  }, fetcher);
-}
-var exactAccountPermissionGroup = async (config, name, fetcher) => {
-  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
-  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
-  if (matches.length !== 1) {
-    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
-  }
-  return { id: matches[0].id, name };
-};
-async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
-  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
-    throw new Error("Cloudflare account id is invalid");
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
-    throw new Error("Cloudflare account runtime-token name is invalid");
-  }
-  const permissionNames = [...new Set(config.permissionNames)];
-  if (permissionNames.length === 0)
-    throw new Error("Cloudflare account runtime token needs a permission group");
-  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
-  const body = {
-    name,
-    policies: [{
-      effect: "allow",
-      permission_groups: permissionGroups.map(({ id }) => ({ id })),
-      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
-    }]
-  };
-  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
-  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
-    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
-  }
-  return { id: created.id, value: created.value, name, permissionNames };
-}
-async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare Access service-token name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/service_tokens`;
-  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = tokens.filter((token) => token.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
-  if (matches[0]) {
-    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
-      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
-    }
-    return { credentials: config.existing, created: false };
-  }
-  const created = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
-  }, fetcher);
-  if (!created.id || !created.client_id || !created.client_secret) {
-    throw new Error("Cloudflare did not return the new Access service-token secret");
-  }
-  return {
-    credentials: {
-      tokenId: created.id,
-      clientId: created.client_id,
-      clientSecret: created.client_secret
-    },
-    created: true
-  };
-}
-async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/policies`;
-  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === config.name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
-  const desired = {
-    name: config.name,
-    decision: "non_identity",
-    include: [{ service_token: { token_id: config.serviceTokenId } }]
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
-    method: matches[0] ? "PUT" : "POST",
-    body: JSON.stringify(desired)
-  }, fetcher);
-  return { policy, created: !matches[0] };
-}
-async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
-  const desired = {
-    name: config.name,
-    type: "self_hosted",
-    domain: config.hostname,
-    session_duration: "24h",
-    service_auth_401_redirect: true,
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare WARP enrollment application name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
-  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
-    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
-  }
-  const desired = {
-    name,
-    type: "warp",
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!application.id || application.type && application.type !== "warp") {
-    throw new Error("Cloudflare did not return the WARP enrollment application");
-  }
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare VNET name is invalid");
-  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
-  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
-  if (matches[0])
-    return { virtualNetwork: matches[0], created: false };
-  const virtualNetwork = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
-  }, fetcher);
-  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
-    throw new Error("Cloudflare did not return the VNET id");
-  }
-  return { virtualNetwork, created: true };
-}
-async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare WARP device profile name is invalid");
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
-    throw new Error("Cloudflare service-token id is invalid");
-  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
-    throw new Error("Cloudflare VNET id is invalid");
-  const precedence = config.precedence ?? 100;
-  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
-    throw new Error("Cloudflare WARP device profile precedence is invalid");
-  }
-  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
-  const listPath = `/accounts/${config.accountId}/devices/policies`;
-  const path = `/accounts/${config.accountId}/devices/policy`;
-  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
-  if (matches[0]?.match && matches[0].match !== match) {
-    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
-  }
-  const desired = {
-    name,
-    match,
-    precedence,
-    description: "ForgeZero non-interactive compute enrollment",
-    enabled: true,
-    allow_mode_switch: false,
-    allowed_to_leave: false,
-    auto_connect: 0,
-    switch_locked: true,
-    service_mode_v2: { mode: "warp" },
-    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!policy.id)
-    throw new Error("Cloudflare did not return the WARP device profile id");
-  return { policy, created: !matches[0] };
-}
-async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
-    throw new Error("Cloudflare Worker script name is invalid");
-  }
-  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
-    method: "PATCH",
-    body: JSON.stringify({
-      secrets: {
-        CF_ACCESS_CLIENT_ID: {
-          name: "CF_ACCESS_CLIENT_ID",
-          type: "secret_text",
-          text: config.credentials.clientId
-        },
-        CF_ACCESS_CLIENT_SECRET: {
-          name: "CF_ACCESS_CLIENT_SECRET",
-          type: "secret_text",
-          text: config.credentials.clientSecret
-        }
-      }
-    })
-  }, fetcher);
-}
-async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
-  const title = config.title.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
-    throw new Error("Cloudflare KV namespace title is invalid");
+  const dnsAlreadyCorrect = existingRecord?.type === record.type && existingRecord.name?.toLowerCase() === record.name.toLowerCase() && existingRecord.content?.toLowerCase() === record.content.toLowerCase() && existingRecord.proxied === true && existingRecord.ttl === 1;
+  if (!dnsAlreadyCorrect) {
+    await cf(dnsAuth, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
+      method: existingRecord ? "PUT" : "POST",
+      body: JSON.stringify(record)
+    }, fetcher);
   }
-  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
-  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = namespaces.filter((namespace2) => namespace2.title === title);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
-  if (matches[0])
-    return { namespace: matches[0], created: false };
-  const namespace = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ title })
-  }, fetcher);
-  return { namespace, created: true };
 }
 async function ensureCloudflareTunnel(config, fetcher = fetch) {
   const name = config.name.trim();
@@ -406,11 +195,13 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
-import { dirname, join, resolve } from "path";
-import { tmpdir } from "os";
 import { randomUUID } from "crypto";
-import { isIP as isIP2 } from "net";
+import { chmod, lstat, mkdir, open, rename, stat, unlink } from "fs/promises";
+import { dirname, join, resolve } from "path";
+var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
+var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -419,8 +210,9 @@ async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   if (metadata.nlink !== 1)
     throw new Error(`${path} must not have multiple hard links`);
   const uid = ownerUid();
-  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`${path} must be owned by the current operator`);
+  }
   if ((metadata.mode & 63) !== 0)
     throw new Error(`${path} must not be accessible by group or other users`);
   if ((metadata.mode & 256) === 0)
@@ -445,25 +237,36 @@ async function readOwnerOnlyFile(path, maximumBytes) {
 }
 async function readOwnerApiToken(path) {
   const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+  if (!TOKEN.test(token))
     throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
-  }
   return token;
 }
 async function readCloudflareBootstrapTokens(files) {
   const entries = await Promise.all([
     ["apiToken", files.apiTokenFile],
+    ["managementApiToken", files.managementApiTokenFile],
+    ["runtimeApiToken", files.runtimeApiTokenFile],
     ["tunnelApiToken", files.tunnelApiTokenFile],
     ["dnsApiToken", files.dnsApiTokenFile],
-    ["kvApiToken", files.kvApiTokenFile],
-    ["accessApiToken", files.accessApiTokenFile],
-    ["workerApiToken", files.workerApiTokenFile]
+    ["kvApiToken", files.kvApiTokenFile]
   ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
-  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
-  const unified = tokens.apiToken;
-  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
-    if (!tokens[key] && !unified)
-      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  const supplied = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const tokens = {
+    ...supplied.apiToken ? { apiToken: supplied.apiToken } : {},
+    ...supplied.tunnelApiToken || supplied.managementApiToken ? {
+      tunnelApiToken: supplied.tunnelApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.dnsApiToken || supplied.managementApiToken ? {
+      dnsApiToken: supplied.dnsApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.kvApiToken || supplied.runtimeApiToken ? {
+      kvApiToken: supplied.kvApiToken ?? supplied.runtimeApiToken
+    } : {}
+  };
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken"]) {
+    if (!tokens[key] && !tokens.apiToken) {
+      throw new Error(`Cloudflare ${key} file is required when apiTokenFile is omitted`);
+    }
   }
   return tokens;
 }
@@ -473,36 +276,30 @@ var validateId = (value, label) => {
     throw new Error(`${label} must be a 32-character hexadecimal id`);
   return normalized;
 };
-var validateName = (value, label, maximum, allowSpaces = true) => {
+var validateName = (value, label) => {
   const normalized = value.trim();
-  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(normalized))
     throw new Error(`${label} is invalid`);
-  }
   return normalized;
 };
-var privateAddress = (value) => {
-  const address = value.trim().toLowerCase();
-  const family = isIP2(address);
-  if (family === 4) {
-    const [a, b] = address.split(".").map(Number);
-    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
-      return address;
+var normalizeService = (value) => {
+  let service;
+  try {
+    service = new URL(value);
+  } catch {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
   }
-  if (family === 6) {
-    const first = Number.parseInt(address.split(":", 1)[0], 16);
-    if (Number.isFinite(first) && (first & 65024) === 64512)
-      return address;
+  if (service.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(service.hostname) || !service.port || service.pathname !== "/" || service.username || service.password || service.search || service.hash) {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
   }
-  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+  return service.toString().replace(/\/$/, "");
 };
 function validateCloudflareBootstrapCoordinates(input) {
   const nodeInputs = input.nodes?.length ? input.nodes : [{
     nodeName: input.tunnelName,
     hostname: input.hostname,
     service: input.service,
-    tunnelName: input.tunnelName,
-    applicationName: input.applicationName
+    tunnelName: input.tunnelName
   }];
   if (nodeInputs.length < 1 || nodeInputs.length > 32) {
     throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
@@ -512,88 +309,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
       throw new Error("Cloudflare node name is invalid");
     const hostname = node.hostname.trim().toLowerCase();
-    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+    if (!HOSTNAME.test(hostname))
       throw new Error("Cloudflare public node hostname is invalid");
-    }
-    const serviceUrl = new URL(node.service);
-    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
-      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
-    }
     return {
       nodeName,
       hostname,
-      service: serviceUrl.toString().replace(/\/$/, ""),
-      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
-      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
-      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+      service: normalizeService(node.service),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name")
     };
   });
   for (const [label, values] of [
     ["node name", nodes.map(({ nodeName }) => nodeName)],
     ["hostname", nodes.map(({ hostname }) => hostname)],
-    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
-    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)]
   ]) {
     if (new Set(values).size !== values.length)
       throw new Error(`Cloudflare fleet ${label} must be unique`);
   }
   const first = nodes[0];
-  const workerScriptName = input.workerScriptName.trim();
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
-    throw new Error("Cloudflare Worker script name is invalid");
-  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
-  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
-    throw new Error("Cloudflare Worker compatibility date is invalid");
-  }
-  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
-  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
-    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
-  }
-  const workerDirectory = resolve(input.workerDirectory);
-  const workerMain = input.workerMain.trim();
-  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
-    throw new Error("Cloudflare Worker main must be a project-relative path");
-  }
-  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
-    throw new Error("Cloudflare runtime-token name prefix is invalid");
-  }
-  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
-    throw new Error("private-network runtime token requires runtime-token creation");
-  }
-  const privateNetwork = input.privateNetwork ? {
-    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
-    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
-    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
-    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
-    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
-  } : undefined;
-  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
-    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
-  }
-  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
-    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
-  }
   return {
     accountId: validateId(input.accountId, "Cloudflare account id"),
     zoneId: validateId(input.zoneId, "Cloudflare zone id"),
     hostname: first.hostname,
     service: first.service,
     tunnelName: first.tunnelName,
-    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
-    workerScriptName,
-    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
-    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
-    applicationName: first.applicationName,
-    workerDirectory,
-    workerMain,
-    workerCompatibilityDate,
-    publicDomains,
-    createRuntimeTokens: input.createRuntimeTokens,
-    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
-    runtimeTokenNamePrefix,
-    nodes,
-    ...privateNetwork ? { privateNetwork } : {}
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    nodes
   };
 }
 function planCloudflareBootstrap(input, outputPath) {
@@ -605,120 +346,18 @@ function planCloudflareBootstrap(input, outputPath) {
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
-      "create or reuse one Workers KV namespace",
       "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
-      ...coordinates.createRuntimeTokens ? [
-        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
-      ] : [],
-      "deploy the shared Worker once with the created NODES binding and stable custom domains",
-      "create or reuse one shared Access service token/policy and one self-hosted application per node",
-      ...coordinates.privateNetwork ? [
-        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
-      ] : [],
-      "write the Access client id and secret to the existing Worker as encrypted secrets",
-      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+      "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
+      "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
+      "write one node-specific handoff containing the connector token and owner-supplied KV-write token"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never written to output",
-      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
-      "the normal API process does not receive or import the management token files"
+      "API tokens are read only from owner-only files and are never placed in argv or stdout",
+      "the management token is never persisted; connector and KV runtime capabilities are atomically checkpointed with mode 0600",
+      "the normal API process receives only its KV-write token and never Tunnel or DNS management authority"
     ]
   };
 }
-var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
-  const child = Bun.spawn([...command], {
-    cwd,
-    env: { ...env },
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    child.exited,
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text()
-  ]);
-  return { exitCode, stdout, stderr };
-};
-var inheritedWorkerEnvironment = () => {
-  const allowed = [
-    "PATH",
-    "HOME",
-    "TMPDIR",
-    "XDG_CONFIG_HOME",
-    "XDG_CACHE_HOME",
-    "SSL_CERT_FILE",
-    "SSL_CERT_DIR",
-    "NODE_EXTRA_CA_CERTS",
-    "HTTPS_PROXY",
-    "HTTP_PROXY",
-    "NO_PROXY"
-  ];
-  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
-};
-var redact = (text, secrets) => {
-  let safe = text.slice(0, 4096);
-  for (const secret of secrets)
-    if (secret)
-      safe = safe.split(secret).join("[REDACTED]");
-  return safe.trim();
-};
-async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
-  const validated = validateCloudflareBootstrapCoordinates(coordinates);
-  const workerDirectoryMetadata = await stat(validated.workerDirectory);
-  if (!workerDirectoryMetadata.isDirectory())
-    throw new Error("Cloudflare Worker directory is not a directory");
-  const workerMain = resolve(validated.workerDirectory, validated.workerMain);
-  const workerMainMetadata = await stat(workerMain);
-  if (!workerMainMetadata.isFile())
-    throw new Error("Cloudflare Worker main is not a regular file");
-  const wrangler = resolve(validated.workerDirectory, "node_modules/.bin/wrangler");
-  const wranglerMetadata = await stat(wrangler);
-  if (!wranglerMetadata.isFile())
-    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
-  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
-    throw new Error("Cloudflare KV namespace id is invalid");
-  const temporaryDirectory = await mkdtemp(join(tmpdir(), "fz-wrangler-"));
-  await chmod(temporaryDirectory, 448);
-  const configurationPath = join(temporaryDirectory, "wrangler.json");
-  try {
-    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    try {
-      await handle.writeFile(`${JSON.stringify({
-        name: validated.workerScriptName,
-        main: workerMain,
-        compatibility_date: validated.workerCompatibilityDate,
-        workers_dev: false,
-        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
-        observability: { enabled: true },
-        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
-      }, null, 2)}
-`);
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    const result = await runner({
-      command: [wrangler, "deploy", "--config", configurationPath],
-      cwd: validated.workerDirectory,
-      env: {
-        ...inheritedWorkerEnvironment(),
-        XDG_CONFIG_HOME: temporaryDirectory,
-        XDG_CACHE_HOME: temporaryDirectory,
-        WRANGLER_LOG_PATH: join(temporaryDirectory, "wrangler.log"),
-        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
-        CLOUDFLARE_API_TOKEN: apiToken,
-        WRANGLER_SEND_METRICS: "false"
-      }
-    });
-    if (result.exitCode !== 0) {
-      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
-      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
-    }
-  } finally {
-    await rm(temporaryDirectory, { recursive: true, force: true });
-  }
-}
 async function readExistingOutput(path) {
   try {
     await lstat(path);
@@ -727,18 +366,26 @@ async function readExistingOutput(path) {
       return;
     throw cause;
   }
-  const text = await readOwnerOnlyFile(path, 1048576);
-  let output;
+  let parsed;
   try {
-    output = JSON.parse(text);
-  } catch {
-    throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+    parsed = JSON.parse(await readOwnerOnlyFile(path, 1048576));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+    throw cause;
   }
+  const output = parsed;
   if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
     throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
   return output;
 }
+function cloudflareHostHandoffPath(checkpointPath, nodeName) {
+  const normalized = nodeName.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalized))
+    throw new Error("Cloudflare host handoff node name is invalid");
+  return join(`${resolve(checkpointPath)}.hosts`, `${normalized}.json`);
+}
 async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
   const output = await readExistingOutput(resolve(checkpointPath));
   if (!output || output.phase !== "complete") {
@@ -755,7 +402,7 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
   }
   const resource = matches[0];
-  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !resource.applicationId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(resource.tunnelId) || !/^[A-Za-z0-9._-]{40,16384}$/.test(resource.connectorToken)) {
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId) || !CONNECTOR_TOKEN.test(resource.connectorToken)) {
     throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
   }
   return {
@@ -766,52 +413,63 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     connectorToken: resource.connectorToken
   };
 }
-async function readCloudflareHostHandoff(checkpointPath, nodeName) {
-  const connector = await readCloudflareConnectorHandoff(checkpointPath, nodeName);
-  const output = await readExistingOutput(resolve(checkpointPath));
-  const kv = output?.resources.runtimeTokens?.kv;
-  if (!output || output.phase !== "complete" || !/^[a-f0-9]{32}$/i.test(output.coordinates.accountId) || !/^[a-f0-9]{32}$/i.test(output.coordinates.zoneId) || !/^[a-f0-9]{32}$/i.test(output.resources.kvNamespaceId) || !kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv.value)) {
-    throw new Error("Cloudflare host handoff is missing the exact-account KV runtime capability");
+async function readCloudflareHostHandoff(handoffPath, nodeName) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readOwnerOnlyFile(handoffPath, 65536));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error("Cloudflare host handoff is not valid JSON");
+    throw cause;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+    throw new Error("Cloudflare host handoff is malformed");
+  const output = parsed;
+  const unknown = Object.keys(output).filter((key) => ![
+    "format",
+    "kind",
+    "nodeName",
+    "hostname",
+    "service",
+    "tunnelId",
+    "connectorToken",
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "kvRuntimeToken",
+    "privateNetworkRuntimeToken",
+    "warp"
+  ].includes(key));
+  if (unknown.length)
+    throw new Error(`Cloudflare host handoff contains unsupported field ${unknown[0]}`);
+  const normalizedNodeName = nodeName.trim().toLowerCase();
+  let service;
+  try {
+    service = normalizeService(output.service ?? "");
+  } catch {}
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.kvRuntimeToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+    throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
-  const network = output.resources.runtimeTokens?.privateNetwork?.value;
-  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+  if (output.privateNetworkRuntimeToken !== undefined && !TOKEN.test(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network capability is malformed");
   }
-  const privateNetwork = output.resources.privateNetwork;
-  const access = output.resources.access;
-  if (Boolean(privateNetwork) !== Boolean(network)) {
+  if (Boolean(output.warp) !== Boolean(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network resources and capability disagree");
   }
-  if (privateNetwork && (!access?.clientId || !access.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(privateNetwork.warpOrganization) || !/^[0-9a-f-]{36}$/i.test(privateNetwork.virtualNetworkId) || !privateNetwork.deviceProfileId)) {
-    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
-  }
-  return {
-    ...connector,
-    accountId: output.coordinates.accountId,
-    zoneId: output.coordinates.zoneId,
-    kvNamespaceId: output.resources.kvNamespaceId,
-    kvRuntimeToken: kv.value,
-    ...network ? { privateNetworkRuntimeToken: network } : {},
-    ...privateNetwork && access ? { warp: {
-      organization: privateNetwork.warpOrganization,
-      clientId: access.clientId,
-      clientSecret: access.clientSecret,
-      virtualNetworkId: privateNetwork.virtualNetworkId,
-      deviceProfileId: privateNetwork.deviceProfileId
-    } } : {}
-  };
+  const { format: _format, kind: _kind, ...handoff } = output;
+  return handoff;
 }
 async function prepareOwnerOutputDirectory(absolutePath) {
   const directory = dirname(absolutePath);
   await mkdir(directory, { recursive: true, mode: 448 });
-  const directoryMetadata = await stat(directory);
+  const metadata = await stat(directory);
   const uid = ownerUid();
-  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+  if (!metadata.isDirectory() || uid !== undefined && metadata.uid !== uid || (metadata.mode & 18) !== 0) {
     throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
   }
   return directory;
 }
-async function writeOwnerBootstrapOutput(path, output) {
+async function writeOwnerJson(path, output) {
   const absolute = resolve(path);
   const directory = await prepareOwnerOutputDirectory(absolute);
   const temporary = `${absolute}.${randomUUID()}.tmp`;
@@ -839,21 +497,35 @@ async function writeOwnerBootstrapOutput(path, output) {
     });
   }
 }
+async function writeOwnerBootstrapOutput(path, output) {
+  await writeOwnerJson(path, output);
+}
+async function writeCloudflareHostHandoffs(checkpointPath, output) {
+  for (const node of output.resources.nodes) {
+    const handoff = {
+      format: 1,
+      kind: "forgezero-cloudflare-host-handoff",
+      nodeName: node.nodeName,
+      hostname: node.hostname,
+      service: node.service,
+      tunnelId: node.tunnelId,
+      connectorToken: node.connectorToken,
+      accountId: output.coordinates.accountId,
+      zoneId: output.coordinates.zoneId,
+      kvNamespaceId: output.resources.kvNamespaceId,
+      kvRuntimeToken: output.resources.kvRuntimeToken
+    };
+    await writeOwnerJson(cloudflareHostHandoffPath(checkpointPath, node.nodeName), handoff);
+  }
+}
 var tokenFor = (tokens, key) => {
   const token = tokens[key]?.trim() || tokens.apiToken?.trim();
-  if (!token)
+  if (!token || !TOKEN.test(token))
     throw new Error(`Cloudflare ${key} is not configured`);
   return token;
 };
-var initialManagementToken = (tokens) => {
-  const token = tokens.apiToken?.trim();
-  if (!token) {
-    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
-  }
-  return token;
-};
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
   const existing = await readExistingOutput(absoluteOutput);
@@ -861,19 +533,18 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
   }
   await prepareOwnerOutputDirectory(absoluteOutput);
-  const namespace = await ensureCloudflareKvNamespace({
-    accountId: coordinates.accountId,
-    title: coordinates.kvNamespaceTitle,
-    apiToken: tokenFor(tokens, "kvApiToken")
-  }, fetcher);
+  const kvRuntimeToken = tokenFor(tokens, "kvApiToken");
   const nodeResources = [];
   const createdNodes = [];
-  let resources;
   for (const node of coordinates.nodes) {
     const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let resource;
     let created = false;
     if (checkpointed) {
-      nodeResources.push(checkpointed);
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+        throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
+      }
+      resource = checkpointed;
     } else {
       const tunnel = await ensureCloudflareTunnel({
         accountId: coordinates.accountId,
@@ -881,234 +552,29 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         apiToken: tokenFor(tokens, "tunnelApiToken")
       }, fetcher);
       created = tunnel.created;
-      nodeResources.push({
-        nodeName: node.nodeName,
-        hostname: node.hostname,
-        service: node.service,
-        tunnelName: node.tunnelName,
-        tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken
-      });
-    }
-    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
-    const firstNode = nodeResources[0];
-    resources = {
-      tunnelId: firstNode.tunnelId,
-      kvNamespaceId: namespace.namespace.id,
-      hostname: firstNode.hostname,
-      service: firstNode.service,
-      connectorToken: firstNode.connectorToken,
-      nodes: [...nodeResources],
-      ...existing?.resources.access ? { access: existing.resources.access } : {},
-      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
-      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
-      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources)
-    throw new Error("Cloudflare fleet has no nodes");
-  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
-    resources = {
-      ...resources,
-      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
-        accountId: coordinates.accountId,
-        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
-        permissionNames: ["Workers KV Storage Write"],
-        apiToken: initialManagementToken(tokens)
-      }, fetcher) }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
-    resources = {
-      ...resources,
-      runtimeTokens: {
-        ...resources.runtimeTokens,
-        privateNetwork: await createCloudflareAccountRuntimeToken({
-          accountId: coordinates.accountId,
-          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
-          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
-          apiToken: initialManagementToken(tokens)
-        }, fetcher)
-      }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources.worker) {
-    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
-    resources = {
-      ...resources,
-      worker: {
-        scriptName: coordinates.workerScriptName,
-        publicDomains: coordinates.publicDomains,
-        deployed: true
-      }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "worker-deployed",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  const serviceToken = await ensureCloudflareAccessServiceToken({
-    accountId: coordinates.accountId,
-    name: coordinates.serviceTokenName,
-    apiToken: tokenFor(tokens, "accessApiToken"),
-    existing: resources.access
-  }, fetcher);
-  resources = { ...resources, access: serviceToken.credentials };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  const policy = await ensureCloudflareAccessPolicy({
-    accountId: coordinates.accountId,
-    name: coordinates.policyName,
-    serviceTokenId: serviceToken.credentials.tokenId,
-    apiToken: tokenFor(tokens, "accessApiToken")
-  }, fetcher);
-  if (!policy.policy.id)
-    throw new Error("Cloudflare did not return the Access policy id");
-  resources = {
-    ...resources,
-    access: { ...serviceToken.credentials, policyId: policy.policy.id }
-  };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  let privateNetworkCreated = false;
-  if (coordinates.privateNetwork && !resources.privateNetwork) {
-    const managementToken = initialManagementToken(tokens);
-    const virtualNetwork = await ensureCloudflareVirtualNetwork({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.virtualNetworkName,
-      comment: "ForgeZero private database network",
-      apiToken: managementToken
-    }, fetcher);
-    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.enrollmentApplicationName,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.deviceProfileName,
-      serviceTokenId: serviceToken.credentials.tokenId,
-      virtualNetworkId: virtualNetwork.virtualNetwork.id,
-      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
-      apiToken: managementToken
-    }, fetcher);
-    const routes = [];
-    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
-      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
-      const route = await ensureCloudflarePrivateDatabaseRoute({
-        accountId: coordinates.accountId,
-        tunnelId: resource.tunnelId,
-        privateAddress: node.privateAddress,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        comment: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      await ensureCloudflareWarpDatabaseInclude({
-        accountId: coordinates.accountId,
-        policyId: deviceProfile.policy.id,
-        privateAddress: node.privateAddress,
-        description: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
+      resource = { ...node, tunnelId: tunnel.tunnel.id, connectorToken: tunnel.connectorToken };
     }
-    resources = {
-      ...resources,
-      privateNetwork: {
-        warpOrganization: coordinates.privateNetwork.warpOrganization,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        deviceProfileId: deviceProfile.policy.id,
-        enrollmentApplicationId: enrollment.application.id,
-        routes
-      }
-    };
-    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
+    nodeResources.push(resource);
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created });
+    const first2 = nodeResources[0];
     await writeOwnerBootstrapOutput(absoluteOutput, {
       format: 1,
       kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
+      phase: "edge-resources-provisioned",
       updatedAt: new Date().toISOString(),
       coordinates,
-      resources
-    });
-  }
-  for (const node of coordinates.nodes) {
-    const application = await ensureCloudflareAccessApplication({
-      accountId: coordinates.accountId,
-      name: node.applicationName,
-      hostname: node.hostname,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    if (!application.application.id)
-      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
-    resources = {
-      ...resources,
-      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
-      access: {
-        ...resources.access,
-        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
+      resources: {
+        tunnelId: first2.tunnelId,
+        kvNamespaceId: coordinates.kvNamespaceId,
+        hostname: first2.hostname,
+        service: first2.service,
+        connectorToken: first2.connectorToken,
+        kvRuntimeToken,
+        nodes: [...nodeResources]
       }
-    };
-    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
-    createdNode.application = application.created;
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
     });
   }
-  await configureCloudflareWorkerAccessSecrets({
-    accountId: coordinates.accountId,
-    scriptName: coordinates.workerScriptName,
-    credentials: serviceToken.credentials,
-    apiToken: tokenFor(tokens, "workerApiToken")
-  }, fetcher);
-  for (const node of resources.nodes) {
+  for (const node of nodeResources) {
     await configureCloudflareEdge({
       accountId: coordinates.accountId,
       zoneId: coordinates.zoneId,
@@ -1120,25 +586,29 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       dnsApiToken: tokenFor(tokens, "dnsApiToken")
     }, fetcher);
   }
+  const first = nodeResources[0];
   const output = {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap",
     phase: "complete",
     updatedAt: new Date().toISOString(),
     coordinates,
-    resources,
+    resources: {
+      tunnelId: first.tunnelId,
+      kvNamespaceId: coordinates.kvNamespaceId,
+      hostname: first.hostname,
+      service: first.service,
+      connectorToken: first.connectorToken,
+      kvRuntimeToken,
+      nodes: nodeResources
+    },
     created: {
       tunnel: createdNodes.some(({ tunnel }) => tunnel),
-      kvNamespace: namespace.created,
-      serviceToken: serviceToken.created,
-      policy: policy.created,
-      application: createdNodes.some(({ application }) => application),
-      privateNetwork: privateNetworkCreated,
-      workerDeployed: true,
       nodes: createdNodes
     }
   };
   await writeOwnerBootstrapOutput(absoluteOutput, output);
+  await writeCloudflareHostHandoffs(absoluteOutput, output);
   return output;
 }
 async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
@@ -1149,42 +619,70 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       kind: "forgezero-cloudflare-bootstrap-evidence",
       phase: "planned",
       checkpointFile: plan.outputFile,
-      workerScriptName: plan.coordinates.workerScriptName,
-      publicDomains: plan.coordinates.publicDomains,
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
   if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
     throw new Error("Cloudflare apply requires owner-only management token file paths");
   }
-  if (plan.coordinates.createRuntimeTokens && !request.tokenFiles.apiTokenFile) {
-    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
-  }
   const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
-  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-evidence",
     phase: "complete",
     checkpointFile: plan.outputFile,
     kvNamespaceId: output.resources.kvNamespaceId,
-    workerScriptName: output.coordinates.workerScriptName,
-    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
-    runtimeTokenIds: {
-      kv: output.resources.runtimeTokens?.kv.id,
-      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
-    },
-    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId }) => ({
       nodeName,
       hostname,
-      tunnelId,
-      applicationId
+      handoffFile: cloudflareHostHandoffPath(plan.outputFile, nodeName),
+      tunnelId
     }))
   };
 }
+var acceptanceFetch = async (url, label, fetcher) => {
+  let response;
+  try {
+    response = await fetcher(url, { method: "GET", redirect: "manual", signal: AbortSignal.timeout(5000) });
+  } catch {
+    throw new Error(`${label} is unreachable`);
+  }
+  if (!response.ok)
+    throw new Error(`${label} returned HTTP ${response.status}`);
+  return response.status;
+};
+async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fetch) {
+  const absolute = resolve(checkpointPath);
+  const output = await readExistingOutput(absolute);
+  if (!output || output.phase !== "complete")
+    throw new Error("Cloudflare acceptance requires a completed owner checkpoint");
+  const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
+  if (output.resources.nodes.length !== coordinates.nodes.length) {
+    throw new Error("Cloudflare acceptance checkpoint does not cover the declared node fleet");
+  }
+  for (const node of output.resources.nodes) {
+    const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
+    if (!expected || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(node.tunnelId)) {
+      throw new Error("Cloudflare acceptance checkpoint has an unbound node resource");
+    }
+  }
+  const nodes = await Promise.all(output.resources.nodes.map(async ({ nodeName, hostname }) => ({
+    nodeName,
+    hostname,
+    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare origin ${nodeName}`, fetcher)
+  })));
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-acceptance",
+    checkpointFile: absolute,
+    verifiedAt: new Date().toISOString(),
+    nodes
+  };
+}
 
 // src/bootstrap.ts
-import { createHmac, randomBytes } from "crypto";
+import { createHash, createHmac, randomBytes } from "crypto";
 import {
   chmodSync,
   existsSync,
@@ -1214,7 +712,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.38";
+var VERSION = "0.1.40";
 
 // src/software.ts
 var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
@@ -1233,8 +731,8 @@ var UBUNTU_2604_X64 = [
   },
   {
     requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
   },
   {
     requirement: { id: "cloudflared", version: "2026.7.3" },
@@ -1320,7 +818,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/provision.ts
-import { isIP as isIP3 } from "net";
+import { isIP as isIP2 } from "net";
 function atLeast(version, floor) {
   const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
   const got = parse(version);
@@ -1777,7 +1275,7 @@ function agentUnit(options) {
     } catch {
       throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
     }
-    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
+    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP2(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
       throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
   }
@@ -2458,6 +1956,8 @@ function renderPlatformApiUnits(input) {
     throw new Error("Blue and green ports must differ.");
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
+  const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
 After=network-online.target ${input.collectorUnit}
@@ -2470,7 +1970,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${credentials}
+${capacityEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2
@@ -2506,16 +2006,24 @@ Environment=PORT=${input.greenPort}
 function renderPlatformNginx(input) {
   boundedInteger("publicPort", input.publicPort, 1024, 65535);
   boundedInteger("initialSlotPort", input.initialSlotPort, 1024, 65535);
+  const concurrencyLimit = boundedInteger("concurrencyLimit", input.concurrencyLimit ?? 256, 1, 1e6);
+  boundedInteger("workerDrainSeconds", input.workerDrainSeconds ?? 35, 1, 300);
   if (input.publicPort === input.initialSlotPort)
     throw new Error("Edge and slot ports must differ.");
   return {
     upstream: `upstream forgezero { server 127.0.0.1:${input.initialSlotPort}; }
 `,
-    site: `server {
+    site: `limit_conn_zone $server_name zone=forgezero_admission:10m;
+map $http_upgrade $forgezero_connection { default upgrade; '' close; }
+map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED_DRY_RUN 1; }
+server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  limit_conn forgezero_admission ${concurrencyLimit};
+  limit_conn_status 503;
+  add_header Retry-After $forgezero_retry_after always;
+  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
+  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
   location / { return 404; }
 }
 `
@@ -2531,6 +2039,7 @@ function renderPlatformActivationFiles(input) {
   if (input.bluePort === input.greenPort)
     throw new Error("Activation slot ports must differ.");
   boundedInteger("keepReleases", input.keepReleases, 2, 100);
+  const drainDeadlineMs = boundedInteger("drainDeadlineMs", input.drainDeadlineMs ?? 35000, 1000, 300000);
   if (!/^\/[A-Za-z0-9/_-]{1,128}$/.test(input.healthPath) || input.healthPath.includes("..")) {
     throw new Error("Activation health path is malformed.");
   }
@@ -2540,7 +2049,8 @@ function renderPlatformActivationFiles(input) {
     `FZ_BLUE_PORT=${input.bluePort}`,
     `FZ_GREEN_PORT=${input.greenPort}`,
     `FZ_HEALTH_PATH=${input.healthPath}`,
-    `FZ_KEEP_RELEASES=${input.keepReleases}`
+    `FZ_KEEP_RELEASES=${input.keepReleases}`,
+    `FZ_DRAIN_DEADLINE_MS=${drainDeadlineMs}`
   ].join(`
 `) + `
 `;
@@ -2562,7 +2072,14 @@ if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true;
 upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
 printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
 if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
-rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"; [[ -n "$previous_slot" && "$previous_slot" != "$target" ]] && systemctl stop "forgezero@\${previous_slot}.service" || true
+rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"
+# New nginx workers select the new slot after reload. Keep the old slot alive
+# while old workers drain in-flight requests and upgraded connections.
+if [[ -n "$previous_slot" && "$previous_slot" != "$target" ]]; then
+  sleep_seconds="$(( (FZ_DRAIN_DEADLINE_MS + 999) / 1000 ))"
+  sleep "$sleep_seconds"
+  systemctl stop "forgezero@\${previous_slot}.service" || true
+fi
 mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
 for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
 printf 'promoted %s on %s\\n' "$release" "$target"
@@ -2617,7 +2134,15 @@ var PLATFORM_BOOTSTRAP_PROFILES = [
   "platform-db-api",
   "platform-api"
 ];
-var STATE_PATH = "/var/lib/forgezero/bootstrap.json";
+function resolveInstalledBootstrapKind(states) {
+  if (states.compute && states.metal) {
+    throw new Error("host has both metal and compute bootstrap state; refusing an ambiguous operation");
+  }
+  return states.metal ? "metal" : states.compute ? "compute" : undefined;
+}
+var BOOTSTRAP_STATE_PATH = "/var/lib/forgezero/bootstrap.json";
+var STATE_PATH = BOOTSTRAP_STATE_PATH;
+var INTENT_PATH = "/var/lib/forgezero/bootstrap.intent.json";
 var CREDS = "/etc/forgezero/creds";
 var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
@@ -2627,9 +2152,13 @@ var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
 var WARP_CLIENT_ID_CREDENTIAL = `${CREDS}/warp-auth-client-id.cred`;
 var WARP_CLIENT_SECRET_CREDENTIAL = `${CREDS}/warp-auth-client-secret.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
+var GIT_PUBLIC_KEY = "/etc/forgezero/git/deploy.pub";
 var PLATFORM_ENROL_SOURCE = "/run/forgezero-platform-enrol-token";
 var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
 var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
+var CONTROL_SOCKET = "/run/forgezero/control.sock";
+var CLOUDFLARED_METRICS_ADDRESS = "127.0.0.1:20241";
+var CLOUDFLARED_DIAGNOSTICS_URL = `http://${CLOUDFLARED_METRICS_ADDRESS}/diag/tunnel`;
 var PACKAGED_AGENT_BIN = fileURLToPath(new URL("./fz-agent.js", import.meta.url));
 var privateOrigin = (value) => {
   let url;
@@ -2681,6 +2210,18 @@ function validateBootstrapConfig(value) {
   if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
     throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
   }
+  const deploymentCredentials = value.deploymentCredentials ?? {};
+  if (!deploymentCredentials || typeof deploymentCredentials !== "object" || Array.isArray(deploymentCredentials) || Object.keys(deploymentCredentials).length > 64) {
+    throw new Error("deployment credentials must be a bounded name-to-path object");
+  }
+  for (const [name, path] of Object.entries(deploymentCredentials)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || typeof path !== "string" || !path.startsWith("/") || /[\r\n:]/.test(path) || !path.endsWith(".cred")) {
+      throw new Error(`deployment credential ${name} must map to an absolute encrypted .cred path`);
+    }
+  }
+  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
+    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  }
   if (value.kind === "tenant") {
     if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
       throw new Error("tenant realm is malformed");
@@ -2722,12 +2263,16 @@ function validateBootstrapConfig(value) {
   if (expected.role && value.database.role !== expected.role || value.database.serverMode !== expected.mode || value.profile === "platform-db-api" && !["master", "joiner"].includes(value.database.role)) {
     throw new Error("platform profile, database role and Coordinator mode disagree");
   }
+  if (!["member", "none"].includes(value.database.agency) || value.database.role === "master" && value.database.agency !== "member" || value.database.role === "none" && value.database.agency !== "none") {
+    throw new Error("database role and Agency participation disagree");
+  }
   if (value.database.role !== "none" && !value.database.address)
     throw new Error("database nodes require a private address");
   if (value.database.role === "joiner" && !value.database.master)
     throw new Error("database joiners require the master starter address");
-  if (!/^(?:dev-)?fz-n[1-9][0-9]{0,2}$/.test(value.computeReference))
+  if (!/^[a-z0-9](?:[a-z0-9:_-]{0,126}[a-z0-9])?$/.test(value.computeReference)) {
     throw new Error("platform compute reference is malformed");
+  }
   if (!value.database.bootstrapSecretFile)
     throw new Error("platform bootstrap requires the shared cluster bootstrap-code file");
   const write = value.database.coordinators.map(privateOrigin);
@@ -2753,11 +2298,8 @@ function validateBootstrapConfig(value) {
   if (value.firewall.enabled && (value.firewall.privateCidrs.length < 1 || new Set(value.firewall.privateCidrs).size !== value.firewall.privateCidrs.length)) {
     throw new Error("enabled firewall requires unique private cluster CIDRs");
   }
-  if (Number(value.computeReference.match(/n(\d+)$/)?.[1]) > 3 && !value.platformEnrolTokenFile) {
-    throw new Error("post-genesis platform computes require an API-issued enrolment token file");
-  }
-  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.checkpointFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
-    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  if (!["genesis-derived", "api-token"].includes(value.enrolment.source) || value.enrolment.source === "api-token" && !value.enrolment.tokenFile || value.enrolment.source === "genesis-derived" && value.enrolment.tokenFile) {
+    throw new Error("platform enrolment source and token file disagree");
   }
   value.runtime.environment = runtime;
   return value;
@@ -2812,8 +2354,9 @@ var unitEscape = (value) => {
 function databaseUnit(config) {
   const db = config.database;
   const join2 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
+  const agency = db.agency === "none" ? " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true" : "";
   return `[Unit]
-Description=ForgeZero ArangoDB Community 3.11.14 cluster (${db.role})
+Description=ForgeZero ArangoDB Community 3.11.14 cluster (${db.role}; agency=${db.agency})
 After=network-online.target
 Wants=network-online.target
 
@@ -2822,7 +2365,7 @@ Type=simple
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join2}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join2}${agency}
 Restart=always
 RestartSec=5
 UMask=0077
@@ -2878,7 +2421,7 @@ Wants=network-online.target
 Type=simple
 DynamicUser=yes
 LoadCredentialEncrypted=cloudflared-token:${TUNNEL_CREDENTIAL}
-ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate run --token-file %d/cloudflared-token
+ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate --metrics ${CLOUDFLARED_METRICS_ADDRESS} run --token-file %d/cloudflared-token
 Restart=always
 RestartSec=5
 NoNewPrivileges=true
@@ -2890,6 +2433,60 @@ ProtectHome=true
 WantedBy=multi-user.target
 `;
 }
+function parseCloudflaredTunnelDiagnostics(raw, expectedTunnelId) {
+  if (raw.length > 64 * 1024)
+    throw new Error("cloudflared tunnel diagnostics exceed 64 KiB");
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("cloudflared tunnel diagnostics are not JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("cloudflared tunnel diagnostics are malformed");
+  }
+  const diagnostics = value;
+  if (diagnostics.tunnelID !== expectedTunnelId)
+    throw new Error("cloudflared is connected to the wrong tunnel");
+  if (!/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(diagnostics.connectorID ?? "")) {
+    throw new Error("cloudflared connector identity is missing");
+  }
+  if (!Array.isArray(diagnostics.connections) || diagnostics.connections.length !== 4 || diagnostics.connections.some((connection) => !connection || typeof connection !== "object" || connection.isConnected !== true)) {
+    throw new Error("cloudflared does not have four connected edge sessions");
+  }
+  return diagnostics;
+}
+async function inspectCloudflaredTunnel(host, expectedTunnelId) {
+  const result = await host.exec([
+    "curl",
+    "--fail",
+    "--silent",
+    "--show-error",
+    "--max-time",
+    "5",
+    CLOUDFLARED_DIAGNOSTICS_URL
+  ]);
+  if (result.exitCode !== 0)
+    return { healthy: false, problem: "cloudflared diagnostics endpoint is unreachable" };
+  try {
+    parseCloudflaredTunnelDiagnostics(result.output, expectedTunnelId);
+    return { healthy: true };
+  } catch (cause) {
+    return { healthy: false, problem: cause.message };
+  }
+}
+async function waitForCloudflaredTunnel(host, expectedTunnelId) {
+  let lastProblem = "cloudflared tunnel is not ready";
+  for (let attempt = 0;attempt < 30; attempt += 1) {
+    const evidence = await inspectCloudflaredTunnel(host, expectedTunnelId);
+    if (evidence.healthy)
+      return;
+    lastProblem = evidence.problem;
+    if (attempt < 29)
+      await (host.sleep?.(1000) ?? Bun.sleep(1000));
+  }
+  throw new Error(`cloudflared connector readiness failed: ${lastProblem}`);
+}
 var derive = (root, label) => {
   if (!/^[a-f0-9]{64}$/i.test(root))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
@@ -2902,23 +2499,163 @@ async function seal(host, name, destination, value) {
   if (result.exitCode !== 0)
     throw new Error(`could not seal ${name}: ${result.output.trim()}`);
 }
-function stateFor(config) {
+function bootstrapIdentity(config) {
+  if (config.kind === "tenant")
+    return {
+      kind: config.kind,
+      apiUrl: config.apiUrl,
+      realm: config.realm,
+      nodeHostname: config.nodeHostname,
+      telemetryEndpoint: config.telemetryEndpoint,
+      repository: config.repository ?? null,
+      branch: config.branch ?? null,
+      profile: config.profile ?? "tenant-managed",
+      deployRoot: config.deployRoot ?? "/opt/forgezero",
+      software: (config.software ?? []).map(({ id, version }) => ({ id, version })),
+      installCloudflared: Boolean(config.installCloudflared),
+      bootstrapRunner: config.bootstrapRunner ? { targetTelemetryEndpoint: config.bootstrapRunner.targetTelemetryEndpoint } : null
+    };
+  const environment = config.runtime.environment;
+  return {
+    kind: config.kind,
+    environment: config.environment,
+    profile: config.profile,
+    computeReference: config.computeReference,
+    nodeHostname: config.nodeHostname,
+    apiUrl: config.apiUrl,
+    repository: config.repository,
+    branch: config.branch,
+    deployRoot: config.deployRoot ?? "/opt/forgezero",
+    telemetryEndpoint: config.telemetryEndpoint,
+    database: {
+      role: config.database.role,
+      serverMode: config.database.serverMode,
+      agency: config.database.agency,
+      address: config.database.address ?? null,
+      master: config.database.master ?? null,
+      coordinators: config.database.coordinators
+    },
+    enrolment: { source: config.enrolment.source },
+    runtime: {
+      serviceUser: config.runtime.serviceUser,
+      sharedDirectory: environment.sharedDirectory,
+      slotsDirectory: config.runtime.slotsDirectory,
+      bluePort: config.runtime.bluePort,
+      greenPort: config.runtime.greenPort,
+      publicApiPort: environment.publicApiPort,
+      healthPath: config.runtime.healthPath,
+      keepReleases: config.runtime.keepReleases,
+      environment
+    },
+    firewall: config.firewall,
+    installCloudflared: Boolean(config.installCloudflared)
+  };
+}
+function bootstrapIdentityDigest(config) {
+  return createHash("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
+}
+function parseStoredState(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("bootstrap state is malformed");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap state is malformed");
+  const state = value;
+  if (state.format !== 2 || !["platform", "tenant"].includes(state.kind ?? "") || !/^[a-f0-9]{64}$/.test(state.identityDigest ?? "") || typeof state.profile !== "string" || typeof state.nodeHostname !== "string" || typeof state.apiUrl !== "string" || state.kind === "platform" && !["member", "none"].includes(state.databaseAgency ?? "")) {
+    throw new Error("bootstrap state is legacy or incomplete; refusing an unbound repair");
+  }
+  return state;
+}
+function parseStoredIntent(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("bootstrap intent is malformed");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap intent is malformed");
+  const intent = value;
+  if (intent.format !== 1 || !["platform", "tenant"].includes(intent.kind ?? "") || !/^[a-f0-9]{64}$/.test(intent.identityDigest ?? "") || Number.isNaN(Date.parse(intent.createdAt ?? ""))) {
+    throw new Error("bootstrap intent is incomplete; refusing an unbound resume");
+  }
+  return intent;
+}
+function bindBootstrapIntent(host, config) {
+  const identityDigest = bootstrapIdentityDigest(config);
+  if (host.exists(INTENT_PATH)) {
+    const intent = parseStoredIntent(host.read(INTENT_PATH));
+    if (intent.kind !== config.kind || intent.identityDigest !== identityDigest) {
+      throw new Error("bootstrap resume coordinates do not match the interrupted host intent");
+    }
+  } else if (!host.exists(STATE_PATH)) {
+    host.write(INTENT_PATH, `${JSON.stringify({
+      format: 1,
+      kind: config.kind,
+      identityDigest,
+      createdAt: new Date().toISOString()
+    }, null, 2)}
+`, 384);
+  }
+  return identityDigest;
+}
+async function preparePlatformBootstrap(input, host = localBootstrapHost()) {
+  const config = validateBootstrapConfig(structuredClone(input));
+  if (config.kind !== "platform")
+    throw new Error("platform preparation requires a platform bootstrap config");
+  if (host.uid() !== 0)
+    throw new Error("fz bootstrap platform prepare --apply must run as root");
+  if (host.exists(STATE_PATH)) {
+    const installed = parseStoredState(host.read(STATE_PATH));
+    if (installed.kind !== "platform" || installed.identityDigest !== bootstrapIdentityDigest(config)) {
+      throw new Error("platform preparation coordinates do not match the installed host identity");
+    }
+  }
+  const identityDigest = bindBootstrapIntent(host, config);
+  await host.installAgent(config);
+  if (!host.exists(GIT_PUBLIC_KEY))
+    throw new Error("Agent installation did not produce its public Git deploy key");
+  const gitPublicKey = host.read(GIT_PUBLIC_KEY).trim();
+  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(gitPublicKey)) {
+    throw new Error("Agent public Git deploy key is malformed");
+  }
+  return {
+    kind: "platform",
+    prepared: true,
+    identityDigest,
+    gitPublicKey,
+    next: "register this read-only deploy key, then run --apply concurrently on all three genesis Agency members"
+  };
+}
+function stateFor(config, cloudflare, previousCloudflareTunnelId) {
   return `${JSON.stringify({
-    format: 1,
+    format: 2,
     kind: config.kind,
     profile: config.kind === "platform" ? config.profile : config.profile ?? "tenant-managed",
     nodeHostname: config.nodeHostname,
     apiUrl: config.apiUrl,
+    identityDigest: bootstrapIdentityDigest(config),
     ...config.kind === "platform" ? {
       environment: config.environment,
       databaseRole: config.database.role,
+      databaseAgency: config.database.agency,
       databaseServerMode: config.database.serverMode,
       databaseAddress: config.database.address,
       databaseCoordinators: config.database.coordinators,
       databaseModeEvidence: config.database.role === "none" ? undefined : DB_MODE_EVIDENCE,
       collectorUnit: config.runtime.environment.otlpCollectorUnit,
+      publicApiPort: config.runtime.environment.publicApiPort,
+      healthPath: config.runtime.healthPath,
+      cloudflare: config.runtime.environment.cloudflare,
       cloudflared: Boolean(config.cloudflareHandoff)
-    } : { realm: config.realm }
+    } : {
+      realm: config.realm,
+      cloudflared: Boolean(config.cloudflareHandoff),
+      cloudflareTunnelId: cloudflare?.tunnelId ?? previousCloudflareTunnelId
+    }
   }, null, 2)}
 `;
 }
@@ -2927,16 +2664,16 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     return { initialized: false, services: {}, problems: ["bootstrap state is missing"] };
   let state;
   try {
-    state = JSON.parse(host.read(STATE_PATH));
-  } catch {
-    return { initialized: false, services: {}, problems: ["bootstrap state is malformed"] };
+    state = parseStoredState(host.read(STATE_PATH));
+  } catch (cause) {
+    return { initialized: false, services: {}, problems: [cause.message] };
   }
   const units = ["forgezero-agent.service", "forgezero-agent.socket"];
   if (state.kind === "platform")
     units.push("nginx.service");
   if (state.kind === "platform" && state.collectorUnit)
     units.push(state.collectorUnit);
-  if (state.kind === "platform" && state.cloudflared)
+  if (state.cloudflared)
     units.push("cloudflared.service");
   if (state.kind === "platform" && state.databaseRole !== "none")
     units.push("forgezero-db.service", "forgezero-db-verify.service");
@@ -2948,7 +2685,42 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (result.exitCode !== 0)
       problems.push(`${unit} is not active`);
   }
+  for (const socket of [DEFAULT_SOCKET2, CONTROL_SOCKET]) {
+    services[socket] = host.exists(socket);
+    if (!services[socket])
+      problems.push(`${socket} is missing`);
+  }
+  if (state.cloudflared) {
+    for (const credential of [TUNNEL_CREDENTIAL, `${CREDS}/cloudflare-kv-token.cred`]) {
+      services[credential] = host.exists(credential);
+      if (!services[credential])
+        problems.push(`${credential} is missing`);
+    }
+    const tunnelId = state.cloudflare?.tunnelId ?? state.cloudflareTunnelId;
+    if (!tunnelId) {
+      services["cloudflared-tunnel"] = false;
+      problems.push("Cloudflare tunnel identity is missing from bootstrap state");
+    } else {
+      const evidence = await inspectCloudflaredTunnel(host, tunnelId);
+      services["cloudflared-tunnel"] = evidence.healthy;
+      if (!evidence.healthy)
+        problems.push(evidence.problem);
+    }
+  }
   if (state.kind === "platform") {
+    if (state.cloudflared) {
+      if (state.cloudflare?.warp) {
+        for (const credential of [
+          `${CREDS}/cloudflare-network-token.cred`,
+          WARP_CLIENT_ID_CREDENTIAL,
+          WARP_CLIENT_SECRET_CREDENTIAL
+        ]) {
+          services[credential] = host.exists(credential);
+          if (!services[credential])
+            problems.push(`${credential} is missing`);
+        }
+      }
+    }
     const [blue, green] = await Promise.all([
       host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
       host.exec(["systemctl", "is-active", "--quiet", "forgezero@green.service"])
@@ -2956,6 +2728,48 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     services["forgezero@active.service"] = blue.exitCode === 0 || green.exitCode === 0;
     if (!services["forgezero@active.service"])
       problems.push("neither API slot is active");
+    if (!Number.isSafeInteger(state.publicApiPort) || !state.healthPath) {
+      problems.push("platform health coordinates are missing from bootstrap state");
+    } else {
+      const health = await host.exec([
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "5",
+        `http://127.0.0.1:${state.publicApiPort}${state.healthPath}`
+      ]);
+      services["platform-api-health"] = health.exitCode === 0;
+      if (health.exitCode !== 0)
+        problems.push("platform API health check failed");
+    }
+    const nginx = await host.exec(["nginx", "-t"]);
+    services["nginx-config"] = nginx.exitCode === 0;
+    if (nginx.exitCode !== 0)
+      problems.push("nginx configuration is invalid");
+    if (state.databaseRole !== "none") {
+      const unitPath = "/etc/systemd/system/forgezero-db.service";
+      const expectsNoAgency = state.databaseAgency === "none";
+      const unitHasNoAgency = host.exists(unitPath) && host.read(unitPath).includes("--cluster.start-agent=false");
+      services["database-agency-profile"] = expectsNoAgency === unitHasNoAgency;
+      if (!services["database-agency-profile"])
+        problems.push("database Agency participation disagrees with the installed unit");
+      if (!state.databaseModeEvidence || !host.exists(state.databaseModeEvidence)) {
+        problems.push("database Coordinator-mode evidence is missing");
+      } else {
+        try {
+          const evidence = JSON.parse(host.read(state.databaseModeEvidence));
+          if (evidence.expectedMode !== "default" || evidence.role !== "COORDINATOR" || evidence.agency !== state.databaseAgency || evidence.unit !== "forgezero-db-verify.service" || Number.isNaN(Date.parse(String(evidence.verifiedAt)))) {
+            throw new Error("invalid evidence");
+          }
+          services["database-mode-evidence"] = true;
+        } catch {
+          services["database-mode-evidence"] = false;
+          problems.push("database Coordinator-mode evidence is malformed");
+        }
+      }
+    }
   }
   if (!host.exists("/var/lib/forgezero/enrolment.json"))
     problems.push("durable Agent enrolment state is missing");
@@ -2970,14 +2784,27 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(token))
       throw new Error("tenant enrolment token is malformed");
   }
+  let installed;
+  if (host.exists(STATE_PATH))
+    installed = parseStoredState(host.read(STATE_PATH));
   let cloudflare;
-  if (config.kind === "platform" && config.cloudflareHandoff) {
-    cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.checkpointFile, config.cloudflareHandoff.nodeName);
+  if (config.cloudflareHandoff) {
+    if (host.exists(config.cloudflareHandoff.handoffFile)) {
+      cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.handoffFile, config.cloudflareHandoff.nodeName);
+    } else if (config.kind === "platform" && installed?.cloudflare) {
+      config.runtime.environment.cloudflare = installed.cloudflare;
+      config.runtime.environment = validatePlatformSharedEnvironment(config.runtime.environment);
+    } else if (!(config.kind === "tenant" && installed?.cloudflareTunnelId)) {
+      throw new Error("node-specific Cloudflare host handoff is missing before credential sealing");
+    }
+  }
+  if (cloudflare && cloudflare.hostname !== config.nodeHostname) {
+    throw new Error("Cloudflare handoff hostname disagrees with node hostname");
+  }
+  if (cloudflare && config.kind === "platform") {
     const expected = config.runtime.environment.cloudflare;
-    if (cloudflare.hostname !== config.nodeHostname)
-      throw new Error("Cloudflare checkpoint hostname disagrees with platform node hostname");
     if (expected && (cloudflare.service !== expected.tunnelService || cloudflare.accountId !== expected.accountId || cloudflare.zoneId !== expected.zoneId || cloudflare.kvNamespaceId !== expected.kvNamespaceId || cloudflare.tunnelId !== expected.tunnelId)) {
-      throw new Error("Cloudflare checkpoint disagrees with immutable platform runtime coordinates");
+      throw new Error("Cloudflare handoff disagrees with immutable platform runtime coordinates");
     }
     const discovered = {
       accountId: cloudflare.accountId,
@@ -2992,13 +2819,19 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       } } : {}
     };
     if (expected && JSON.stringify(expected) !== JSON.stringify(discovered)) {
-      throw new Error("Cloudflare checkpoint disagrees with immutable WARP/runtime coordinates");
+      throw new Error("Cloudflare handoff disagrees with immutable WARP/runtime coordinates");
     }
     config.runtime.environment.cloudflare = expected ?? discovered;
     if (config.runtime.environment.databaseNetworkMode === "cloudflare-warp" !== Boolean(cloudflare.warp)) {
-      throw new Error("Cloudflare checkpoint private-network mode disagrees with the platform database network mode");
+      throw new Error("Cloudflare handoff private-network mode disagrees with the platform database network mode");
     }
   }
+  if (installed) {
+    if (installed.kind !== config.kind || installed.identityDigest !== bootstrapIdentityDigest(config)) {
+      throw new Error("bootstrap repair coordinates do not match the installed host identity");
+    }
+  }
+  bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
@@ -3011,7 +2844,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     await seal(host, "warp-auth-client-id", WARP_CLIENT_ID_CREDENTIAL, cloudflare.warp.clientId);
     await seal(host, "warp-auth-client-secret", WARP_CLIENT_SECRET_CREDENTIAL, cloudflare.warp.clientSecret);
   }
-  await host.installAgent(config, alreadyEnrolled && config.kind === "platform" ? PLATFORM_ENROL_SOURCE : undefined);
+  if (cloudflare && !host.exists(`${CREDS}/cloudflare-kv-token.cred`)) {
+    await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
+  }
+  await host.installAgent(config);
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id }) => id === "ufw"));
   } else
@@ -3050,16 +2886,17 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       }
     }
     if (cloudflare) {
-      await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
       if (cloudflare.privateNetworkRuntimeToken)
         await seal(host, "cloudflare-network-token", `${CREDS}/cloudflare-network-token.cred`, cloudflare.privateNetworkRuntimeToken);
     }
     const runtime = config.runtime;
+    const cloudflareConfigured = Boolean(runtime.environment.cloudflare);
+    const cloudflareNetworkConfigured = Boolean(runtime.environment.cloudflare?.warp);
     const envPath = `${runtime.environment.sharedDirectory}/.env`;
     const credentials = platformApiCredentialSpecs({
       smtp: Boolean(credentialFiles.smtpPassword),
-      cloudflareKv: Boolean(cloudflare),
-      cloudflareNetwork: Boolean(cloudflare?.privateNetworkRuntimeToken)
+      cloudflareKv: cloudflareConfigured,
+      cloudflareNetwork: cloudflareNetworkConfigured
     });
     const units = renderPlatformApiUnits({
       serviceUser: runtime.serviceUser,
@@ -3069,16 +2906,23 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       bluePort: runtime.bluePort,
       greenPort: runtime.greenPort,
       collectorUnit: runtime.environment.otlpCollectorUnit,
-      credentials
+      credentials,
+      capacityEnvironmentFile: "/etc/forgezero/capacity.env"
+    });
+    const edge = renderPlatformNginx({
+      publicPort: runtime.environment.publicApiPort,
+      initialSlotPort: runtime.bluePort,
+      concurrencyLimit: runtime.environment.concurrencyLimit,
+      workerDrainSeconds: Math.ceil(runtime.environment.drainDeadlineMs / 1000)
     });
-    const edge = renderPlatformNginx({ publicPort: runtime.environment.publicApiPort, initialSlotPort: runtime.bluePort });
     const activation = renderPlatformActivationFiles({
       root: config.deployRoot ?? "/opt/forgezero",
       serviceUser: runtime.serviceUser,
       bluePort: runtime.bluePort,
       greenPort: runtime.greenPort,
       healthPath: runtime.healthPath,
-      keepReleases: runtime.keepReleases
+      keepReleases: runtime.keepReleases,
+      drainDeadlineMs: runtime.environment.drainDeadlineMs
     });
     await checked(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
       await checked(host, ["id", runtime.serviceUser], "existing API service account");
@@ -3086,6 +2930,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
     host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
+    if (!host.exists("/etc/forgezero/capacity.env")) {
+      host.write("/etc/forgezero/capacity.env", `FZ_CONCURRENCY_LIMIT=${runtime.environment.concurrencyLimit}
+`, 420);
+    }
     await checked(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
     host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
     host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
@@ -3122,6 +2970,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       const evidence = {
         expectedMode: "default",
         role: "COORDINATOR",
+        agency: config.database.agency,
         unit: "forgezero-db-verify.service",
         verifiedAt: new Date().toISOString()
       };
@@ -3129,7 +2978,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
 `, 384);
     }
     if (!alreadyEnrolled) {
-      const enrolToken = config.platformEnrolTokenFile ? privateFile(host, config.platformEnrolTokenFile, "platform enrolment token") : `fze_${derive(derive(root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}`;
+      const enrolToken = config.enrolment.source === "api-token" ? privateFile(host, config.enrolment.tokenFile, "platform enrolment token") : `fze_${derive(derive(root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}`;
       if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolToken))
         throw new Error("platform enrolment token is malformed");
       host.write(PLATFORM_ENROL_SOURCE, `${enrolToken}
@@ -3146,22 +2995,32 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     ], "initial Agent deployment");
     if (!alreadyEnrolled) {
       await host.installAgent(config, PLATFORM_ENROL_SOURCE);
-      if (config.platformEnrolTokenFile)
-        host.remove(config.platformEnrolTokenFile);
+      if (config.enrolment.source === "api-token")
+        host.remove(config.enrolment.tokenFile);
     }
   }
-  if (config.kind === "platform" && cloudflare) {
-    if (!host.exists(TUNNEL_CREDENTIAL)) {
+  if (config.cloudflareHandoff) {
+    if (!host.exists(TUNNEL_CREDENTIAL) && cloudflare) {
       await seal(host, "cloudflared-token", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
     }
+    if (!host.exists(TUNNEL_CREDENTIAL))
+      throw new Error("sealed cloudflared connector credential is missing");
     host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
     await checked(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
     await checked(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
+    const tunnelId = cloudflare?.tunnelId ?? installed?.cloudflareTunnelId ?? (config.kind === "platform" ? config.runtime.environment.cloudflare?.tunnelId : undefined);
+    if (!tunnelId)
+      throw new Error("Cloudflare tunnel identity is missing after handoff validation");
+    await waitForCloudflaredTunnel(host, tunnelId);
   }
-  host.write(STATE_PATH, stateFor(config), 384);
+  host.write(STATE_PATH, stateFor(config, cloudflare, installed?.cloudflareTunnelId), 384);
   const status = await bootstrapStatus(host);
   if (!status.initialized)
     throw new Error(`bootstrap verification failed: ${status.problems.join("; ")}`);
+  host.remove(INTENT_PATH);
+  if (cloudflare && config.cloudflareHandoff) {
+    host.remove(config.cloudflareHandoff.handoffFile);
+  }
   let launch;
   if (config.kind === "platform" && config.database.role === "master") {
     const invitePath = `${config.runtime.environment.sharedDirectory}/platform-invite.token`;
@@ -3199,7 +3058,7 @@ function strictBootstrapDocument(value) {
     "deployRoot",
     "telemetryEndpoint",
     "database",
-    "platformEnrolTokenFile",
+    "enrolment",
     "runtime",
     "firewall",
     "installCloudflared",
@@ -3207,13 +3066,15 @@ function strictBootstrapDocument(value) {
     "realm",
     "enrolTokenFile",
     "software",
+    "deploymentCredentials",
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
     exactKeys(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
-      exactKeys(root.cloudflareHandoff, ["checkpointFile", "nodeName"], "Cloudflare handoff");
-    exactKeys(root.database, ["role", "serverMode", "address", "master", "coordinators", "bootstrapSecretFile"], "database config");
+      exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
+    exactKeys(root.database, ["role", "agency", "serverMode", "address", "master", "coordinators", "bootstrapSecretFile"], "database config");
+    exactKeys(root.enrolment, ["source", "tokenFile"], "platform enrolment config");
     const runtime = exactKeys(root.runtime, [
       "environment",
       "serviceUser",
@@ -3272,9 +3133,11 @@ function strictBootstrapDocument(value) {
       exactKeys(environment.cloudflare.warp, ["organization", "virtualNetworkId", "deviceProfileId"], "Cloudflare WARP runtime config");
     }
   } else if (root.kind === "tenant") {
+    if (root.cloudflareHandoff !== undefined)
+      exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
     if (root.bootstrapRunner !== undefined)
       exactKeys(root.bootstrapRunner, ["sshPrivateKeyFile", "targetTelemetryEndpoint"], "bootstrap runner config");
-    for (const key of ["environment", "profile", "computeReference", "database", "platformEnrolTokenFile", "runtime", "cloudflareHandoff"]) {
+    for (const key of ["environment", "profile", "computeReference", "database", "enrolment", "runtime"]) {
       if (root[key] !== undefined && key !== "profile")
         throw new Error(`tenant bootstrap cannot contain ${key}`);
     }
@@ -3321,6 +3184,7 @@ function localBootstrapHost() {
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
     },
     exec: execute,
+    sleep: (milliseconds) => Bun.sleep(milliseconds),
     async ensureSoftware(requirements) {
       const result = await execute([
         "runuser",
@@ -3362,6 +3226,7 @@ function localBootstrapHost() {
         branch: config.branch,
         profile: config.kind === "platform" ? config.profile : config.profile,
         deployRoot,
+        deploymentCredentials: config.deploymentCredentials,
         publicApiUrl: config.apiUrl,
         gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
         gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
@@ -3407,10 +3272,14 @@ function localBootstrapHost() {
 }
 export {
   validateBootstrapConfig,
+  resolveInstalledBootstrapKind,
   readBootstrapConfig,
+  preparePlatformBootstrap,
   planBootstrap,
   localBootstrapHost,
   bootstrapStatus,
+  bootstrapIdentityDigest,
   applyBootstrap,
-  PLATFORM_BOOTSTRAP_PROFILES
+  PLATFORM_BOOTSTRAP_PROFILES,
+  BOOTSTRAP_STATE_PATH
 };