@forgezero/agent 0.1.39 → 0.1.40

package/dist/fz.js

@@ -1766,7 +1766,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     const msg = concatBytes2(...msgs);
     return modN_LE(hash(domain(msg, abytes2(context, undefined, "context"), !!prehash)));
   }
-  function sign2(msg, secretKey, options = {}) {
+  function sign(msg, secretKey, options = {}) {
     validateObject(options, {}, {}, "options");
     msg = abytes2(msg, undefined, "message");
     if (prehash)
@@ -1855,7 +1855,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   return Object.freeze({
     keygen: createKeygen(randomSecretKey, getPublicKey),
     getPublicKey,
-    sign: sign2,
+    sign,
     verify,
     utils,
     Point,
@@ -1875,168 +1875,14 @@ var init_edwards = __esm(() => {
   _8n2 = /* @__PURE__ */ BigInt(8);
 });
 
-// ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/abstract/montgomery.js
-function cmask(P, swap) {
-  return P + swap - (swap >> _1n5 << _1n5);
-}
-function cswap(P) {
-  const offset = BigInt(6) * P;
-  return (mask, x_2, x_3) => {
-    const sum = x_2 + x_3;
-    const d = offset + x_3 - x_2;
-    const a = (d * mask + x_2) % P;
-    return { x_2: a, x_3: sum - a };
-  };
-}
-function validateOpts(curve) {
-  validateObject(curve, {
-    P: "bigint",
-    type: "string",
-    adjustScalarBytes: "function",
-    powPminus2: "function"
-  }, {
-    randomBytes: "function",
-    scalarMultBase: "function"
-  });
-  return Object.freeze({ ...curve });
-}
-function montgomery(curveDef) {
-  const CURVE = validateOpts(curveDef);
-  const { P, type, adjustScalarBytes, powPminus2, randomBytes: rand } = CURVE;
-  const mulBaseHook = CURVE.scalarMultBase;
-  const is25519 = type === "x25519";
-  if (!is25519 && type !== "x448")
-    throw new Error("invalid type");
-  const randomBytes_ = rand === undefined ? randomBytes2 : rand;
-  const montgomeryBits = is25519 ? 255 : 448;
-  const swap = cswap(P);
-  const fieldLen = is25519 ? 32 : 56;
-  const Gu = is25519 ? BigInt(9) : BigInt(5);
-  const a24 = is25519 ? BigInt(121665) : BigInt(39081);
-  const minScalar = is25519 ? _2n3 ** BigInt(254) : _2n3 ** BigInt(447);
-  const maxAdded = is25519 ? BigInt(8) * (_2n3 ** BigInt(251) - _1n5) : BigInt(4) * (_2n3 ** BigInt(445) - _1n5);
-  const maxScalar = minScalar + maxAdded + _1n5;
-  const modP = (n) => mod(n, P);
-  const GuBytes = encodeU(Gu);
-  function encodeU(u) {
-    return numberToBytesLE(modP(u), fieldLen);
-  }
-  function decodeU(u) {
-    const _u = copyBytes(abytes2(u, fieldLen, "uCoordinate"));
-    if (is25519)
-      _u[31] &= 127;
-    return modP(bytesToNumberLE(_u));
-  }
-  function decodeScalar(scalar) {
-    return bytesToNumberLE(adjustScalarBytes(copyBytes(abytes2(scalar, fieldLen, "scalar"))));
-  }
-  const lowOrderU = new Set(is25519 ? [
-    _0n5,
-    _1n5,
-    P - _1n5,
-    BigInt("325606250916557431795983626356110631294008115727848805560023387167927233504"),
-    BigInt("39382357235489614581723060781553021112529911719440698176882885853963445705823")
-  ] : [_0n5, _1n5, P - _1n5]);
-  function scalarMult(scalar, u) {
-    const pointU = decodeU(u);
-    if (lowOrderU.has(pointU))
-      throw new Error("invalid private or public key received");
-    const pu = montgomeryLadder(pointU, decodeScalar(scalar));
-    if (pu === _0n5)
-      throw new Error("invalid private or public key received");
-    return encodeU(pu);
-  }
-  function scalarMultBase(scalar) {
-    if (mulBaseHook === undefined)
-      return scalarMult(scalar, GuBytes);
-    const k = decodeScalar(scalar);
-    aInRange("scalar", k, minScalar, maxScalar);
-    const pu = modP(mulBaseHook(k));
-    if (pu === _0n5)
-      throw new Error("invalid private or public key received");
-    return encodeU(pu);
-  }
-  const getPublicKey = scalarMultBase;
-  const getSharedSecret = scalarMult;
-  function montgomeryLadder(u, scalar) {
-    aInRange("u", u, _0n5, P);
-    aInRange("scalar", scalar, minScalar, maxScalar);
-    const k = scalar;
-    const x_1 = u;
-    let x_2 = _1n5;
-    let z_2 = _0n5;
-    let x_3 = u;
-    let z_3 = _1n5;
-    const kx = k ^ k >> _1n5;
-    for (let t = BigInt(montgomeryBits - 1);t >= _0n5; t--) {
-      const mask2 = cmask(P, kx >> t);
-      ({ x_2, x_3 } = swap(mask2, x_2, x_3));
-      ({ x_2: z_2, x_3: z_3 } = swap(mask2, z_2, z_3));
-      const A = x_2 + z_2;
-      const AA = modP(A * A);
-      const B = x_2 - z_2;
-      const BB = modP(B * B);
-      const E = AA - BB;
-      const C = x_3 + z_3;
-      const D = x_3 - z_3;
-      const DA = modP(D * A);
-      const CB = modP(C * B);
-      const dacb = DA + CB;
-      const da_cb = DA - CB;
-      x_3 = modP(dacb * dacb);
-      z_3 = modP(x_1 * modP(da_cb * da_cb));
-      x_2 = modP(AA * BB);
-      z_2 = modP(E * (AA + modP(a24 * E)));
-    }
-    const mask = cmask(P, k);
-    ({ x_2, x_3 } = swap(mask, x_2, x_3));
-    ({ x_2: z_2, x_3: z_3 } = swap(mask, z_2, z_3));
-    const z2 = powPminus2(z_2);
-    return modP(x_2 * z2);
-  }
-  const lengths = {
-    secretKey: fieldLen,
-    publicKey: fieldLen,
-    seed: fieldLen
-  };
-  const randomSecretKey = (seed) => {
-    seed = seed === undefined ? randomBytes_(fieldLen) : seed;
-    abytes2(seed, lengths.seed, "seed");
-    return seed;
-  };
-  const utils = { randomSecretKey };
-  Object.freeze(lengths);
-  Object.freeze(utils);
-  return Object.freeze({
-    keygen: createKeygen(randomSecretKey, getPublicKey),
-    getSharedSecret,
-    getPublicKey,
-    scalarMult,
-    scalarMultBase,
-    utils,
-    GuBytes: GuBytes.slice(),
-    lengths
-  });
-}
-var _0n5, _1n5, _2n3;
-var init_montgomery = __esm(() => {
-  init_utils2();
-  init_curve();
-  init_modular();
-  /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n5 = /* @__PURE__ */ BigInt(0);
-  _1n5 = /* @__PURE__ */ BigInt(1);
-  _2n3 = /* @__PURE__ */ BigInt(2);
-});
-
 // ../node_modules/.bun/@noble+curves@2.3.0/node_modules/@noble/curves/ed25519.js
 function ed25519_pow_2_252_3(x) {
   const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
   const P = ed25519_CURVE_p;
   const x2 = x * x % P;
   const b2 = x2 * x % P;
-  const b4 = pow2(b2, _2n4, P) * b2 % P;
-  const b5 = pow2(b4, _1n6, P) * x % P;
+  const b4 = pow2(b2, _2n3, P) * b2 % P;
+  const b5 = pow2(b4, _1n5, P) * x % P;
   const b10 = pow2(b5, _5n2, P) * b5 % P;
   const b20 = pow2(b10, _10n, P) * b10 % P;
   const b40 = pow2(b20, _20n, P) * b20 % P;
@@ -2044,7 +1890,7 @@ function ed25519_pow_2_252_3(x) {
   const b160 = pow2(b80, _80n, P) * b80 % P;
   const b240 = pow2(b160, _80n, P) * b80 % P;
   const b250 = pow2(b240, _10n, P) * b10 % P;
-  const pow_p_5_8 = pow2(b250, _2n4, P) * x % P;
+  const pow_p_5_8 = pow2(b250, _2n3, P) * x % P;
   return { pow_p_5_8, b2 };
 }
 function adjustScalarBytes(bytes) {
@@ -2075,7 +1921,7 @@ function uvRatio(u, v) {
 }
 function toMontgomery(point) {
   const { y } = point;
-  return Fp.toBytes(Fp.div(_1n6 + y, _1n6 - y));
+  return Fp.toBytes(Fp.div(_1n5 + y, _1n5 - y));
 }
 function toMontgomerySecret(secretKey) {
   const size = ed25519_Point.Fp.BYTES;
@@ -2085,18 +1931,15 @@ function toMontgomerySecret(secretKey) {
 function ed(opts) {
   return eddsa(ed25519_Point, sha512, Object.assign({ adjustScalarBytes, toMontgomery, toMontgomerySecret, zip215: true }, opts));
 }
-var _0n6, _1n6, _2n4, _3n2, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, ed25519_Point, Fp, ed25519, x25519;
+var _1n5, _2n3, _5n2, _8n3, ed25519_CURVE_p, ed25519_CURVE, ED25519_SQRT_M1, ed25519_Point, Fp, ed25519;
 var init_ed25519 = __esm(() => {
   init_sha2();
   init_utils();
   init_edwards();
   init_modular();
-  init_montgomery();
   /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n6 = /* @__PURE__ */ BigInt(0);
-  _1n6 = /* @__PURE__ */ BigInt(1);
-  _2n4 = /* @__PURE__ */ BigInt(2);
-  _3n2 = /* @__PURE__ */ BigInt(3);
+  _1n5 = /* @__PURE__ */ BigInt(1);
+  _2n3 = /* @__PURE__ */ BigInt(2);
   _5n2 = /* @__PURE__ */ BigInt(5);
   _8n3 = /* @__PURE__ */ BigInt(8);
   ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
@@ -2113,26 +1956,6 @@ var init_ed25519 = __esm(() => {
   ed25519_Point = /* @__PURE__ */ edwards(ed25519_CURVE, { uvRatio });
   Fp = /* @__PURE__ */ (() => ed25519_Point.Fp)();
   ed25519 = /* @__PURE__ */ ed({});
-  x25519 = /* @__PURE__ */ (() => {
-    const P = ed25519_CURVE_p;
-    const powPminus2 = (x) => {
-      const { pow_p_5_8, b2 } = ed25519_pow_2_252_3(x);
-      return mod(pow2(pow_p_5_8, _3n2, P) * b2, P);
-    };
-    return montgomery({
-      P,
-      type: "x25519",
-      powPminus2,
-      adjustScalarBytes,
-      scalarMultBase: (k) => {
-        const kn = mod(k, ed25519_Point.Fn.ORDER);
-        if (kn === _0n6)
-          return _0n6;
-        const p = ed25519_Point.BASE.multiply(kn);
-        return mod((p.Z + p.Y) * powPminus2(mod(p.Z - p.Y, P)), P);
-      }
-    });
-  })();
 });
 
 // ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
@@ -2347,7 +2170,7 @@ function asafenumber2(value, title = "") {
 function hexToNumber2(hex) {
   if (typeof hex !== "string")
     throw new TypeError("hex string expected, got " + typeof hex);
-  return hex === "" ? _0n7 : BigInt("0x" + hex);
+  return hex === "" ? _0n5 : BigInt("0x" + hex);
 }
 function bytesToNumberBE2(bytes) {
   return hexToNumber2(bytesToHex3(bytes));
@@ -2400,10 +2223,10 @@ function aInRange2(title, n, min, max) {
     throw new RangeError("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
 }
 function bitLen2(n) {
-  if (n < _0n7)
+  if (n < _0n5)
     throw new Error("expected non-negative bigint, got " + n);
   let len;
-  for (len = 0;n > _0n7; n >>= _1n7, len += 1)
+  for (len = 0;n > _0n5; n >>= _1n6, len += 1)
     ;
   return len;
 }
@@ -2424,7 +2247,7 @@ function validateObject2(object, fields = {}, optFields = {}) {
   iter(fields, false);
   iter(optFields, true);
 }
-var abytes4 = (value, length, title) => abytes3(value, length, title), anumber4, bytesToHex4, concatBytes4 = (...arrays) => concatBytes3(...arrays), hexToBytes4 = (hex) => hexToBytes3(hex), isBytes4, randomBytes4 = (bytesLength) => randomBytes3(bytesLength), _0n7, _1n7, isPosBig2 = (n) => typeof n === "bigint" && _0n7 <= n, bitMask2 = (n) => (_1n7 << BigInt(n)) - _1n7, notImplemented2 = () => {
+var abytes4 = (value, length, title) => abytes3(value, length, title), anumber4, bytesToHex4, concatBytes4 = (...arrays) => concatBytes3(...arrays), hexToBytes4 = (hex) => hexToBytes3(hex), isBytes4, randomBytes4 = (bytesLength) => randomBytes3(bytesLength), _0n5, _1n6, isPosBig2 = (n) => typeof n === "bigint" && _0n5 <= n, bitMask2 = (n) => (_1n6 << BigInt(n)) - _1n6, notImplemented2 = () => {
   throw new Error("not implemented");
 };
 var init_utils4 = __esm(() => {
@@ -2433,8 +2256,8 @@ var init_utils4 = __esm(() => {
   anumber4 = anumber3;
   bytesToHex4 = bytesToHex3;
   isBytes4 = isBytes3;
-  _0n7 = /* @__PURE__ */ BigInt(0);
-  _1n7 = /* @__PURE__ */ BigInt(1);
+  _0n5 = /* @__PURE__ */ BigInt(0);
+  _1n6 = /* @__PURE__ */ BigInt(1);
 });
 
 // ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/_u64.js
@@ -2634,28 +2457,28 @@ class Keccak {
     return to;
   }
 }
-var _0n8, _1n8, _2n5, _7n2, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s), rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s), genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher2(() => new Keccak(blockLen, suffix, outputLen), info), sha3_256, sha3_512, genShake = (suffix, blockLen, outputLen, info = {}) => createHasher2((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === undefined ? outputLen : opts.dkLen, true), info), shake128, shake256;
+var _0n6, _1n7, _2n4, _7n2, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s), rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s), genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher2(() => new Keccak(blockLen, suffix, outputLen), info), sha3_256, sha3_512, genShake = (suffix, blockLen, outputLen, info = {}) => createHasher2((opts = {}) => new Keccak(blockLen, suffix, opts.dkLen === undefined ? outputLen : opts.dkLen, true), info), shake128, shake256;
 var init_sha3 = __esm(() => {
   init__u642();
   init_utils3();
-  _0n8 = BigInt(0);
-  _1n8 = BigInt(1);
-  _2n5 = BigInt(2);
+  _0n6 = BigInt(0);
+  _1n7 = BigInt(1);
+  _2n4 = BigInt(2);
   _7n2 = BigInt(7);
   _256n = BigInt(256);
   _0x71n = BigInt(113);
   SHA3_PI = [];
   SHA3_ROTL = [];
   _SHA3_IOTA = [];
-  for (let round = 0, R = _1n8, x = 1, y = 0;round < 24; round++) {
+  for (let round = 0, R = _1n7, x = 1, y = 0;round < 24; round++) {
     [x, y] = [y, (2 * x + 3 * y) % 5];
     SHA3_PI.push(2 * (5 * y + x));
     SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
-    let t = _0n8;
+    let t = _0n6;
     for (let j = 0;j < 7; j++) {
-      R = (R << _1n8 ^ (R >> _7n2) * _0x71n) % _256n;
-      if (R & _2n5)
-        t ^= _1n8 << (_1n8 << BigInt(j)) - _1n8;
+      R = (R << _1n7 ^ (R >> _7n2) * _0x71n) % _256n;
+      if (R & _2n4)
+        t ^= _1n7 << (_1n7 << BigInt(j)) - _1n7;
     }
     _SHA3_IOTA.push(t);
   }
@@ -2765,12 +2588,12 @@ function equalBytes2(a, b) {
 function copyBytes3(bytes) {
   return Uint8Array.from(abytes3(bytes));
 }
-function validateOpts2(opts) {
+function validateOpts(opts) {
   if (Object.prototype.toString.call(opts) !== "[object Object]")
     throw new TypeError("expected valid options object");
 }
 function validateVerOpts(opts) {
-  validateOpts2(opts);
+  validateOpts(opts);
   if (opts.context !== undefined)
     abytes3(opts.context, undefined, "opts.context");
 }
@@ -3011,7 +2834,7 @@ var init__crystals = __esm(() => {
 
 // ../node_modules/.bun/@noble+post-quantum@0.6.1/node_modules/@noble/post-quantum/ml-dsa.js
 function validateInternalOpts(opts) {
-  validateOpts2(opts);
+  validateOpts(opts);
   if (opts.externalMu !== undefined)
     abool2(opts.externalMu, "opts.externalMu");
 }
@@ -3520,30 +3343,30 @@ var init_ml_dsa = __esm(() => {
 
 // ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/modular.js
 function mod2(a, b) {
-  if (b <= _0n9)
+  if (b <= _0n7)
     throw new Error("mod: expected positive modulus, got " + b);
   const result = a % b;
-  return result >= _0n9 ? result : b + result;
+  return result >= _0n7 ? result : b + result;
 }
 function pow22(x, power, modulo) {
-  if (power < _0n9)
+  if (power < _0n7)
     throw new Error("pow2: expected non-negative exponent, got " + power);
   let res = x;
-  while (power-- > _0n9) {
+  while (power-- > _0n7) {
     res *= res;
     res %= modulo;
   }
   return res;
 }
 function invert2(number, modulo) {
-  if (number === _0n9)
+  if (number === _0n7)
     throw new Error("invert: expected non-zero number");
-  if (modulo <= _0n9)
+  if (modulo <= _0n7)
     throw new Error("invert: expected positive modulus, got " + modulo);
   let a = mod2(number, modulo);
   let b = modulo;
-  let x = _0n9, y = _1n9, u = _1n9, v = _0n9;
-  while (a !== _0n9) {
+  let x = _0n7, y = _1n8, u = _1n8, v = _0n7;
+  while (a !== _0n7) {
     const q = b / a;
     const r = b - a * q;
     const m = x - u * q;
@@ -3551,7 +3374,7 @@ function invert2(number, modulo) {
     b = a, a = r, x = u, y = v, u = m, v = n;
   }
   const gcd = b;
-  if (gcd !== _1n9)
+  if (gcd !== _1n8)
     throw new Error("invert: does not exist");
   return mod2(x, modulo);
 }
@@ -3562,7 +3385,7 @@ function assertIsSquare2(Fp2, root, n) {
 }
 function sqrt3mod42(Fp2, n) {
   const F2 = Fp2;
-  const p1div4 = (F2.ORDER + _1n9) / _4n4;
+  const p1div4 = (F2.ORDER + _1n8) / _4n4;
   const root = F2.pow(n, p1div4);
   assertIsSquare2(F2, root, n);
   return root;
@@ -3570,10 +3393,10 @@ function sqrt3mod42(Fp2, n) {
 function sqrt5mod82(Fp2, n) {
   const F2 = Fp2;
   const p5div8 = (F2.ORDER - _5n3) / _8n4;
-  const n2 = F2.mul(n, _2n6);
+  const n2 = F2.mul(n, _2n5);
   const v = F2.pow(n2, p5div8);
   const nv = F2.mul(n, v);
-  const i = F2.mul(F2.mul(nv, _2n6), v);
+  const i = F2.mul(F2.mul(nv, _2n5), v);
   const root = F2.mul(nv, F2.sub(i, F2.ONE));
   assertIsSquare2(F2, root, n);
   return root;
@@ -3602,15 +3425,15 @@ function sqrt9mod162(P) {
   };
 }
 function tonelliShanks2(P) {
-  if (P < _3n3)
+  if (P < _3n2)
     throw new Error("sqrt is not defined for small field");
-  let Q2 = P - _1n9;
+  let Q2 = P - _1n8;
   let S = 0;
-  while (Q2 % _2n6 === _0n9) {
-    Q2 /= _2n6;
+  while (Q2 % _2n5 === _0n7) {
+    Q2 /= _2n5;
     S++;
   }
-  let Z = _2n6;
+  let Z = _2n5;
   const _Fp = Field2(P);
   while (FpLegendre2(_Fp, Z) === 1) {
     if (Z++ > 1000)
@@ -3619,7 +3442,7 @@ function tonelliShanks2(P) {
   if (S === 1)
     return sqrt3mod42;
   let cc = _Fp.pow(Z, Q2);
-  const Q1div2 = (Q2 + _1n9) / _2n6;
+  const Q1div2 = (Q2 + _1n8) / _2n5;
   return function tonelliSlow(Fp2, n) {
     const F2 = Fp2;
     if (F2.is0(n))
@@ -3641,7 +3464,7 @@ function tonelliShanks2(P) {
         if (i === M)
           throw new Error("Cannot find square root");
       }
-      const exponent = _1n9 << BigInt(M - i - 1);
+      const exponent = _1n8 << BigInt(M - i - 1);
       const b = F2.pow(c, exponent);
       M = i;
       c = F2.sqr(b);
@@ -3652,7 +3475,7 @@ function tonelliShanks2(P) {
   };
 }
 function FpSqrt2(P) {
-  if (P % _4n4 === _3n3)
+  if (P % _4n4 === _3n2)
     return sqrt3mod42;
   if (P % _8n4 === _5n3)
     return sqrt5mod82;
@@ -3675,25 +3498,25 @@ function validateField2(field) {
   asafenumber2(field.BITS, "BITS");
   if (field.BYTES < 1 || field.BITS < 1)
     throw new Error("invalid field: expected BYTES/BITS > 0");
-  if (field.ORDER <= _1n9)
+  if (field.ORDER <= _1n8)
     throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
   return field;
 }
 function FpPow(Fp2, num, power) {
   const F2 = Fp2;
-  if (power < _0n9)
+  if (power < _0n7)
     throw new Error("invalid exponent, negatives unsupported");
-  if (power === _0n9)
+  if (power === _0n7)
     return F2.ONE;
-  if (power === _1n9)
+  if (power === _1n8)
     return num;
   let p = F2.ONE;
   let d = num;
-  while (power > _0n9) {
-    if (power & _1n9)
+  while (power > _0n7) {
+    if (power & _1n8)
       p = F2.mul(p, d);
     d = F2.sqr(d);
-    power >>= _1n9;
+    power >>= _1n8;
   }
   return p;
 }
@@ -3717,7 +3540,7 @@ function FpInvertBatch2(Fp2, nums, passZero = false) {
 }
 function FpLegendre2(Fp2, n) {
   const F2 = Fp2;
-  const p1mod2 = (F2.ORDER - _1n9) / _2n6;
+  const p1mod2 = (F2.ORDER - _1n8) / _2n5;
   const powered = F2.pow(n, p1mod2);
   const yes = F2.eql(powered, F2.ONE);
   const zero = F2.eql(powered, F2.ZERO);
@@ -3729,7 +3552,7 @@ function FpLegendre2(Fp2, n) {
 function nLength2(n, nBitLength) {
   if (nBitLength !== undefined)
     anumber4(nBitLength);
-  if (n <= _0n9)
+  if (n <= _0n7)
     throw new Error("invalid n length: expected positive n, got " + n);
   if (nBitLength !== undefined && nBitLength < 1)
     throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
@@ -3746,12 +3569,12 @@ class _Field2 {
   BITS;
   BYTES;
   isLE;
-  ZERO = _0n9;
-  ONE = _1n9;
+  ZERO = _0n7;
+  ONE = _1n8;
   _lengths;
   _mod;
   constructor(ORDER, opts = {}) {
-    if (ORDER <= _1n9)
+    if (ORDER <= _1n8)
       throw new Error("invalid field: expected ORDER > 1, got " + ORDER);
     let _nbitLength = undefined;
     this.isLE = false;
@@ -3781,16 +3604,16 @@ class _Field2 {
   isValid(num) {
     if (typeof num !== "bigint")
       throw new TypeError("invalid field element: expected bigint, got " + typeof num);
-    return _0n9 <= num && num < this.ORDER;
+    return _0n7 <= num && num < this.ORDER;
   }
   is0(num) {
-    return num === _0n9;
+    return num === _0n7;
   }
   isValidNot0(num) {
     return !this.is0(num) && this.isValid(num);
   }
   isOdd(num) {
-    return (num & _1n9) === _1n9;
+    return (num & _1n8) === _1n8;
   }
   neg(num) {
     return mod2(-num, this.ORDER);
@@ -3873,14 +3696,14 @@ class _Field2 {
 function Field2(ORDER, opts = {}) {
   return new _Field2(ORDER, opts);
 }
-var _0n9, _1n9, _2n6, _3n3, _4n4, _5n3, _7n3, _8n4, _9n2, _16n2, isNegativeLE2 = (num, modulo) => (mod2(num, modulo) & _1n9) === _1n9, FIELD_FIELDS2, FIELD_SQRT2;
+var _0n7, _1n8, _2n5, _3n2, _4n4, _5n3, _7n3, _8n4, _9n2, _16n2, isNegativeLE2 = (num, modulo) => (mod2(num, modulo) & _1n8) === _1n8, FIELD_FIELDS2, FIELD_SQRT2;
 var init_modular2 = __esm(() => {
   init_utils4();
   /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n9 = /* @__PURE__ */ BigInt(0);
-  _1n9 = /* @__PURE__ */ BigInt(1);
-  _2n6 = /* @__PURE__ */ BigInt(2);
-  _3n3 = /* @__PURE__ */ BigInt(3);
+  _0n7 = /* @__PURE__ */ BigInt(0);
+  _1n8 = /* @__PURE__ */ BigInt(1);
+  _2n5 = /* @__PURE__ */ BigInt(2);
+  _3n2 = /* @__PURE__ */ BigInt(3);
   _4n4 = /* @__PURE__ */ BigInt(4);
   _5n3 = /* @__PURE__ */ BigInt(5);
   _7n3 = /* @__PURE__ */ BigInt(7);
@@ -3938,7 +3761,7 @@ function calcOffsets(n, window, wOpts) {
   let nextN = n >> shiftBy;
   if (wbits > windowSize) {
     wbits -= maxNumber;
-    nextN += _1n10;
+    nextN += _1n9;
   }
   const offsetStart = window * windowSize;
   const offset = offsetStart + Math.abs(wbits) - 1;
@@ -3952,7 +3775,7 @@ function getW(P) {
   return pointWindowSizes2.get(P) || 1;
 }
 function assert0(n) {
-  if (n !== _0n10)
+  if (n !== _0n8)
     throw new Error("invalid wNAF");
 }
 
@@ -3969,11 +3792,11 @@ class wNAF {
   }
   _unsafeLadder(elm, n, p = this.ZERO) {
     let d = elm;
-    while (n > _0n10) {
-      if (n & _1n10)
+    while (n > _0n8) {
+      if (n & _1n9)
         p = p.add(d);
       d = d.double();
-      n >>= _1n10;
+      n >>= _1n9;
     }
     return p;
   }
@@ -4014,7 +3837,7 @@ class wNAF {
   wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
     const wo = calcWOpts(W, this.bits);
     for (let window = 0;window < wo.windows; window++) {
-      if (n === _0n10)
+      if (n === _0n8)
         break;
       const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
       n = nextN;
@@ -4076,7 +3899,7 @@ function createCurveFields2(type, CURVE, curveOpts = {}, FpFnLE) {
     throw new Error(`expected valid ${type} CURVE object`);
   for (const p of ["p", "n", "h"]) {
     const val = CURVE[p];
-    if (!(typeof val === "bigint" && val > _0n10))
+    if (!(typeof val === "bigint" && val > _0n8))
       throw new Error(`CURVE.${p} must be positive bigint`);
   }
   const Fp2 = createField2(CURVE.p, curveOpts.Fp, FpFnLE);
@@ -4096,13 +3919,13 @@ function createKeygen2(randomSecretKey, getPublicKey) {
     return { secretKey, publicKey: getPublicKey(secretKey) };
   };
 }
-var _0n10, _1n10, pointPrecomputes, pointWindowSizes2;
+var _0n8, _1n9, pointPrecomputes, pointWindowSizes2;
 var init_curve2 = __esm(() => {
   init_utils4();
   init_modular2();
   /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n10 = /* @__PURE__ */ BigInt(0);
-  _1n10 = /* @__PURE__ */ BigInt(1);
+  _0n8 = /* @__PURE__ */ BigInt(0);
+  _1n9 = /* @__PURE__ */ BigInt(1);
   pointPrecomputes = new WeakMap;
   pointWindowSizes2 = new WeakMap;
 });
@@ -4122,19 +3945,19 @@ function edwards2(params, extraOpts = {}) {
   let CURVE = validated.CURVE;
   const { h: cofactor } = CURVE;
   validateObject2(opts, {}, { uvRatio: "function" });
-  const MASK = _2n7 << BigInt(Fn.BYTES * 8) - _1n11;
+  const MASK = _2n6 << BigInt(Fn.BYTES * 8) - _1n10;
   const modP = (n) => Fp2.create(n);
   const uvRatio2 = opts.uvRatio === undefined ? (u, v) => {
     try {
       return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
     } catch (e) {
-      return { isValid: false, value: _0n11 };
+      return { isValid: false, value: _0n9 };
     }
   } : opts.uvRatio;
   if (!isEdValidXY2(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
   function acoord(title, n, banZero = false) {
-    const min = banZero ? _1n11 : _0n11;
+    const min = banZero ? _1n10 : _0n9;
     aInRange2("coordinate " + title, n, min, MASK);
     return n;
   }
@@ -4144,8 +3967,8 @@ function edwards2(params, extraOpts = {}) {
   }
 
   class Point {
-    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n11, modP(CURVE.Gx * CURVE.Gy));
-    static ZERO = new Point(_0n11, _1n11, _1n11, _0n11);
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n10, modP(CURVE.Gx * CURVE.Gy));
+    static ZERO = new Point(_0n9, _1n10, _1n10, _0n9);
     static Fp = Fp2;
     static Fn = Fn;
     X;
@@ -4168,7 +3991,7 @@ function edwards2(params, extraOpts = {}) {
       const { x, y } = p || {};
       acoord("x", x);
       acoord("y", y);
-      return new Point(x, y, _1n11, modP(x * y));
+      return new Point(x, y, _1n10, modP(x * y));
     }
     static fromBytes(bytes, zip215 = false) {
       const len = Fp2.BYTES;
@@ -4180,16 +4003,16 @@ function edwards2(params, extraOpts = {}) {
       normed[len - 1] = lastByte & ~128;
       const y = bytesToNumberLE2(normed);
       const max = zip215 ? MASK : Fp2.ORDER;
-      aInRange2("point.y", y, _0n11, max);
+      aInRange2("point.y", y, _0n9, max);
       const y2 = modP(y * y);
-      const u = modP(y2 - _1n11);
+      const u = modP(y2 - _1n10);
       const v = modP(d * y2 - a);
       let { isValid, value: x } = uvRatio2(u, v);
       if (!isValid)
         throw new Error("bad point: invalid y coordinate");
-      const isXOdd = (x & _1n11) === _1n11;
+      const isXOdd = (x & _1n10) === _1n10;
       const isLastByteOdd = (lastByte & 128) !== 0;
-      if (!zip215 && x === _0n11 && isLastByteOdd)
+      if (!zip215 && x === _0n9 && isLastByteOdd)
         throw new Error("bad point: x=0 and x_0=1");
       if (isLastByteOdd !== isXOdd)
         x = modP(-x);
@@ -4207,7 +4030,7 @@ function edwards2(params, extraOpts = {}) {
     precompute(windowSize = 8, isLazy = true) {
       wnaf.createCache(this, windowSize);
       if (!isLazy)
-        this.multiply(_2n7);
+        this.multiply(_2n6);
       return this;
     }
     assertValidity() {
@@ -4251,7 +4074,7 @@ function edwards2(params, extraOpts = {}) {
       const { X: X1, Y: Y1, Z: Z1 } = this;
       const A = modP(X1 * X1);
       const B = modP(Y1 * Y1);
-      const C = modP(_2n7 * modP(Z1 * Z1));
+      const C = modP(_2n6 * modP(Z1 * Z1));
       const D2 = modP(a * A);
       const x1y1 = X1 + Y1;
       const E = modP(modP(x1y1 * x1y1) - A - B);
@@ -4296,9 +4119,9 @@ function edwards2(params, extraOpts = {}) {
     multiplyUnsafe(scalar) {
       if (!Fn.isValid(scalar))
         throw new RangeError("invalid scalar: expected 0 <= sc < curve.n");
-      if (scalar === _0n11)
+      if (scalar === _0n9)
         return Point.ZERO;
-      if (this.is0() || scalar === _1n11)
+      if (this.is0() || scalar === _1n10)
         return this;
       return wnaf.unsafe(this, scalar, (p) => normalizeZ2(Point, p));
     }
@@ -4319,20 +4142,20 @@ function edwards2(params, extraOpts = {}) {
       const y = modP(Y * iz);
       const zz = Fp2.mul(Z, iz);
       if (is0)
-        return { x: _0n11, y: _1n11 };
-      if (zz !== _1n11)
+        return { x: _0n9, y: _1n10 };
+      if (zz !== _1n10)
         throw new Error("invZ was invalid");
       return { x, y };
     }
     clearCofactor() {
-      if (cofactor === _1n11)
+      if (cofactor === _1n10)
         return this;
       return this.multiplyUnsafe(cofactor);
     }
     toBytes() {
       const { x, y } = this.toAffine();
       const bytes = Fp2.toBytes(y);
-      bytes[bytes.length - 1] |= x & _1n11 ? 128 : 0;
+      bytes[bytes.length - 1] |= x & _1n10 ? 128 : 0;
       return bytes;
     }
     toHex() {
@@ -4417,19 +4240,19 @@ class PrimeEdwardsPoint2 {
     return this;
   }
 }
-var _0n11, _1n11, _2n7, _8n5;
+var _0n9, _1n10, _2n6, _8n5;
 var init_edwards2 = __esm(() => {
   init_utils4();
   init_curve2();
   /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n11 = /* @__PURE__ */ BigInt(0);
-  _1n11 = /* @__PURE__ */ BigInt(1);
-  _2n7 = /* @__PURE__ */ BigInt(2);
+  _0n9 = /* @__PURE__ */ BigInt(0);
+  _1n10 = /* @__PURE__ */ BigInt(1);
+  _2n6 = /* @__PURE__ */ BigInt(2);
   _8n5 = /* @__PURE__ */ BigInt(8);
 });
 
 // ../node_modules/.bun/@noble+curves@2.2.0/node_modules/@noble/curves/abstract/montgomery.js
-function validateOpts3(curve) {
+function validateOpts2(curve) {
   validateObject2(curve, {
     P: "bigint",
     type: "string",
@@ -4440,8 +4263,8 @@ function validateOpts3(curve) {
   });
   return Object.freeze({ ...curve });
 }
-function montgomery2(curveDef) {
-  const CURVE = validateOpts3(curveDef);
+function montgomery(curveDef) {
+  const CURVE = validateOpts2(curveDef);
   const { P, type, adjustScalarBytes: adjustScalarBytes2, powPminus2, randomBytes: rand } = CURVE;
   const is25519 = type === "x25519";
   if (!is25519 && type !== "x448")
@@ -4451,9 +4274,9 @@ function montgomery2(curveDef) {
   const fieldLen = is25519 ? 32 : 56;
   const Gu = is25519 ? BigInt(9) : BigInt(5);
   const a24 = is25519 ? BigInt(121665) : BigInt(39081);
-  const minScalar = is25519 ? _2n8 ** BigInt(254) : _2n8 ** BigInt(447);
-  const maxAdded = is25519 ? BigInt(8) * _2n8 ** BigInt(251) - _1n12 : BigInt(4) * _2n8 ** BigInt(445) - _1n12;
-  const maxScalar = minScalar + maxAdded + _1n12;
+  const minScalar = is25519 ? _2n7 ** BigInt(254) : _2n7 ** BigInt(447);
+  const maxAdded = is25519 ? BigInt(8) * _2n7 ** BigInt(251) - _1n11 : BigInt(4) * _2n7 ** BigInt(445) - _1n11;
+  const maxScalar = minScalar + maxAdded + _1n11;
   const modP = (n) => mod2(n, P);
   const GuBytes = encodeU(Gu);
   function encodeU(u) {
@@ -4470,7 +4293,7 @@ function montgomery2(curveDef) {
   }
   function scalarMult(scalar, u) {
     const pu = montgomeryLadder(decodeU(u), decodeScalar(scalar));
-    if (pu === _0n12)
+    if (pu === _0n10)
       throw new Error("invalid private or public key received");
     return encodeU(pu);
   }
@@ -4479,27 +4302,27 @@ function montgomery2(curveDef) {
   }
   const getPublicKey = scalarMultBase;
   const getSharedSecret = scalarMult;
-  function cswap2(swap, x_2, x_3) {
+  function cswap(swap, x_2, x_3) {
     const dummy = modP(swap * (x_2 - x_3));
     x_2 = modP(x_2 - dummy);
     x_3 = modP(x_3 + dummy);
     return { x_2, x_3 };
   }
   function montgomeryLadder(u, scalar) {
-    aInRange2("u", u, _0n12, P);
+    aInRange2("u", u, _0n10, P);
     aInRange2("scalar", scalar, minScalar, maxScalar);
     const k = scalar;
     const x_1 = u;
-    let x_2 = _1n12;
-    let z_2 = _0n12;
+    let x_2 = _1n11;
+    let z_2 = _0n10;
     let x_3 = u;
-    let z_3 = _1n12;
-    let swap = _0n12;
-    for (let t = BigInt(montgomeryBits - 1);t >= _0n12; t--) {
-      const k_t = k >> t & _1n12;
+    let z_3 = _1n11;
+    let swap = _0n10;
+    for (let t = BigInt(montgomeryBits - 1);t >= _0n10; t--) {
+      const k_t = k >> t & _1n11;
       swap ^= k_t;
-      ({ x_2, x_3 } = cswap2(swap, x_2, x_3));
-      ({ x_2: z_2, x_3: z_3 } = cswap2(swap, z_2, z_3));
+      ({ x_2, x_3 } = cswap(swap, x_2, x_3));
+      ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
       swap = k_t;
       const A = x_2 + z_2;
       const AA = modP(A * A);
@@ -4517,8 +4340,8 @@ function montgomery2(curveDef) {
       x_2 = modP(AA * BB);
       z_2 = modP(E * (AA + modP(a24 * E)));
     }
-    ({ x_2, x_3 } = cswap2(swap, x_2, x_3));
-    ({ x_2: z_2, x_3: z_3 } = cswap2(swap, z_2, z_3));
+    ({ x_2, x_3 } = cswap(swap, x_2, x_3));
+    ({ x_2: z_2, x_3: z_3 } = cswap(swap, z_2, z_3));
     const z2 = powPminus2(z_2);
     return modP(x_2 * z2);
   }
@@ -4546,15 +4369,15 @@ function montgomery2(curveDef) {
     lengths
   });
 }
-var _0n12, _1n12, _2n8;
-var init_montgomery2 = __esm(() => {
+var _0n10, _1n11, _2n7;
+var init_montgomery = __esm(() => {
   init_utils4();
   init_curve2();
   init_modular2();
   /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n12 = BigInt(0);
-  _1n12 = BigInt(1);
-  _2n8 = BigInt(2);
+  _0n10 = BigInt(0);
+  _1n11 = BigInt(1);
+  _2n7 = BigInt(2);
 });
 
 // ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/hmac.js
@@ -5330,8 +5153,8 @@ function ed25519_pow_2_252_32(x) {
   const P = ed25519_CURVE_p2;
   const x2 = x * x % P;
   const b2 = x2 * x % P;
-  const b4 = pow22(b2, _2n9, P) * b2 % P;
-  const b5 = pow22(b4, _1n13, P) * x % P;
+  const b4 = pow22(b2, _2n8, P) * b2 % P;
+  const b5 = pow22(b4, _1n12, P) * x % P;
   const b10 = pow22(b5, _5n4, P) * b5 % P;
   const b20 = pow22(b10, _10n, P) * b10 % P;
   const b40 = pow22(b20, _20n, P) * b20 % P;
@@ -5339,7 +5162,7 @@ function ed25519_pow_2_252_32(x) {
   const b160 = pow22(b80, _80n, P) * b80 % P;
   const b240 = pow22(b160, _80n, P) * b80 % P;
   const b250 = pow22(b240, _10n, P) * b10 % P;
-  const pow_p_5_8 = pow22(b250, _2n9, P) * x % P;
+  const pow_p_5_8 = pow22(b250, _2n8, P) * x % P;
   return { pow_p_5_8, b2 };
 }
 function adjustScalarBytes2(bytes) {
@@ -5373,7 +5196,7 @@ function calcElligatorRistrettoMap(r0) {
   const P = ed25519_CURVE_p2;
   const mod3 = (n) => Fp2.create(n);
   const r = mod3(SQRT_M1 * r0 * r0);
-  const Ns = mod3((r + _1n13) * ONE_MINUS_D_SQ);
+  const Ns = mod3((r + _1n12) * ONE_MINUS_D_SQ);
   let c = BigInt(-1);
   const D2 = mod3((c - d * r) * mod3(r + d));
   let { isValid: Ns_D_is_sq, value: s } = uvRatio2(Ns, D2);
@@ -5384,28 +5207,28 @@ function calcElligatorRistrettoMap(r0) {
     s = s_;
   if (!Ns_D_is_sq)
     c = r;
-  const Nt = mod3(c * (r - _1n13) * D_MINUS_ONE_SQ - D2);
+  const Nt = mod3(c * (r - _1n12) * D_MINUS_ONE_SQ - D2);
   const s2 = s * s;
   const W0 = mod3((s + s) * D2);
   const W1 = mod3(Nt * SQRT_AD_MINUS_ONE);
-  const W2 = mod3(_1n13 - s2);
-  const W3 = mod3(_1n13 + s2);
+  const W2 = mod3(_1n12 - s2);
+  const W3 = mod3(_1n12 + s2);
   return new ed25519_Point2(mod3(W0 * W3), mod3(W2 * W1), mod3(W1 * W3), mod3(W0 * W2));
 }
-var _0n13, _1n13, _2n9, _3n4, _5n4, _8n6, ed25519_CURVE_p2, ed25519_CURVE2, ED25519_SQRT_M12, ed25519_Point2, Fp2, Fn, x255192, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt = (number) => uvRatio2(_1n13, number), MAX_255B, bytes255ToNumberLE = (bytes) => Fp2.create(bytesToNumberLE2(bytes) & MAX_255B), _RistrettoPoint, ristretto255_hasher;
+var _0n11, _1n12, _2n8, _3n3, _5n4, _8n6, ed25519_CURVE_p2, ed25519_CURVE2, ED25519_SQRT_M12, ed25519_Point2, Fp2, Fn, x25519, SQRT_M1, SQRT_AD_MINUS_ONE, INVSQRT_A_MINUS_D, ONE_MINUS_D_SQ, D_MINUS_ONE_SQ, invertSqrt = (number) => uvRatio2(_1n12, number), MAX_255B, bytes255ToNumberLE = (bytes) => Fp2.create(bytesToNumberLE2(bytes) & MAX_255B), _RistrettoPoint, ristretto255_hasher;
 var init_ed255192 = __esm(() => {
   init_sha22();
   init_utils3();
   init_edwards2();
   init_hash_to_curve();
   init_modular2();
-  init_montgomery2();
+  init_montgomery();
   init_utils4();
   /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-  _0n13 = /* @__PURE__ */ BigInt(0);
-  _1n13 = /* @__PURE__ */ BigInt(1);
-  _2n9 = /* @__PURE__ */ BigInt(2);
-  _3n4 = /* @__PURE__ */ BigInt(3);
+  _0n11 = /* @__PURE__ */ BigInt(0);
+  _1n12 = /* @__PURE__ */ BigInt(1);
+  _2n8 = /* @__PURE__ */ BigInt(2);
+  _3n3 = /* @__PURE__ */ BigInt(3);
   _5n4 = /* @__PURE__ */ BigInt(5);
   _8n6 = /* @__PURE__ */ BigInt(8);
   ed25519_CURVE_p2 = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
@@ -5422,14 +5245,14 @@ var init_ed255192 = __esm(() => {
   ed25519_Point2 = /* @__PURE__ */ edwards2(ed25519_CURVE2, { uvRatio: uvRatio2 });
   Fp2 = /* @__PURE__ */ (() => ed25519_Point2.Fp)();
   Fn = /* @__PURE__ */ (() => ed25519_Point2.Fn)();
-  x255192 = /* @__PURE__ */ (() => {
+  x25519 = /* @__PURE__ */ (() => {
     const P = ed25519_CURVE_p2;
-    return montgomery2({
+    return montgomery({
       P,
       type: "x25519",
       powPminus2: (x) => {
         const { pow_p_5_8, b2 } = ed25519_pow_2_252_32(x);
-        return mod2(pow22(pow_p_5_8, _3n4, P) * b2, P);
+        return mod2(pow22(pow_p_5_8, _3n3, P) * b2, P);
       },
       adjustScalarBytes: adjustScalarBytes2
     });
@@ -5467,8 +5290,8 @@ var init_ed255192 = __esm(() => {
       if (!equalBytes(Fp2.toBytes(s), bytes) || isNegativeLE2(s, P))
         throw new Error("invalid ristretto255 encoding 1");
       const s2 = mod3(s * s);
-      const u1 = mod3(_1n13 + a * s2);
-      const u2 = mod3(_1n13 - a * s2);
+      const u1 = mod3(_1n12 + a * s2);
+      const u2 = mod3(_1n12 - a * s2);
       const u1_2 = mod3(u1 * u1);
       const u2_2 = mod3(u2 * u2);
       const v = mod3(a * d * u1_2 - u2_2);
@@ -5480,9 +5303,9 @@ var init_ed255192 = __esm(() => {
         x = mod3(-x);
       const y = mod3(u1 * Dy);
       const t = mod3(x * y);
-      if (!isValid || isNegativeLE2(t, P) || y === _0n13)
+      if (!isValid || isNegativeLE2(t, P) || y === _0n11)
         throw new Error("invalid ristretto255 encoding 2");
-      return new _RistrettoPoint(new ed25519_Point2(x, y, _1n13, t));
+      return new _RistrettoPoint(new ed25519_Point2(x, y, _1n12, t));
     }
     static fromHex(hex) {
       return _RistrettoPoint.fromBytes(hexToBytes3(hex));
@@ -6052,7 +5875,7 @@ var init_hybrid = __esm(() => {
   init_ml_kem();
   init_utils5();
   /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
-  x25519kem = /* @__PURE__ */ ecdhKem(x255192);
+  x25519kem = /* @__PURE__ */ ecdhKem(x25519);
   ml_kem768_x25519 = /* @__PURE__ */ (() => combineKEMS(32, 32, expandSeedXof(shake256), (pk, ct, ss) => sha3_256(concatBytes4(ss[0], ss[1], ct[1], pk[1], asciiToBytes("\\.//^\\"))), ml_kem768, x25519kem))();
 });
 
@@ -6066,29 +5889,68 @@ function deriveKeysFromSeed(seed) {
   const edPublic = ed25519.getPublicKey(edSecret);
   const mlKeys = ml_dsa65.keygen(mlSeed);
   mlSeed.fill(0);
-  return {
+  const result = {
     ed25519: { publicKey: b64(edPublic), secretKey: b64(edSecret) },
     mlDsa: { publicKey: b64(mlKeys.publicKey), secretKey: b64(mlKeys.secretKey) }
   };
+  edSecret.fill(0);
+  mlKeys.secretKey.fill(0);
+  return result;
+}
+function exactBytes(value, bytes) {
+  if (typeof value !== "string" || value.length !== encodedLength(bytes) || !BASE64URL.test(value))
+    return null;
+  try {
+    const decoded = un64(value);
+    return decoded.length === bytes && b64(decoded) === value ? decoded : null;
+  } catch {
+    return null;
+  }
+}
+function validIdentity(value) {
+  return typeof value === "string" && value.length >= 1 && value.length <= 128 && !/[^A-Za-z0-9_.:@/-]/.test(value) && !/[\0\r\n]/.test(value);
+}
+function validResponsePublicKey(value) {
+  return exactBytes(value, RESPONSE_PUBLIC_BYTES) !== null;
 }
 function generateResponseRecipient() {
   const pair = ml_kem768_x25519.keygen();
   return { publicKey: b64(pair.publicKey), secretKey: b64(pair.secretKey) };
 }
 async function openResponse(recipientSecretKey, requestBinding, envelope) {
-  if (envelope?.version !== 1)
+  if (!requestBinding || requestBinding.length > 16384 || /[\0\r\n]/.test(requestBinding)) {
+    throw new Error("response: malformed request binding");
+  }
+  if (envelope?.version !== 1 || envelope.suite !== RESPONSE_SEALING_SUITE) {
     throw new Error("response: unsupported sealed response");
-  const sharedSecret = ml_kem768_x25519.decapsulate(un64(envelope.kemCiphertext), un64(recipientSecretKey));
+  }
+  const kemCiphertext = exactBytes(envelope.kemCiphertext, RESPONSE_CIPHERTEXT_BYTES);
+  const nonce = exactBytes(envelope.nonce, 12);
+  if (!kemCiphertext || !nonce || typeof envelope.ciphertext !== "string" || envelope.ciphertext.length < encodedLength(16) || envelope.ciphertext.length > encodedLength(16 * 1024 * 1024) || !BASE64URL.test(envelope.ciphertext)) {
+    throw new Error("response: malformed sealed response");
+  }
+  let encodedCiphertext;
+  try {
+    encodedCiphertext = un64(envelope.ciphertext);
+  } catch {
+    throw new Error("response: malformed sealed response");
+  }
+  if (encodedCiphertext.length < 16 || encodedCiphertext.length > 16 * 1024 * 1024 || b64(encodedCiphertext) !== envelope.ciphertext) {
+    throw new Error("response: malformed sealed response");
+  }
+  const sharedSecret = ml_kem768_x25519.decapsulate(kemCiphertext, exactBytes(recipientSecretKey, RESPONSE_SECRET_BYTES) ?? (() => {
+    throw new Error("response: malformed recipient secret key");
+  })());
   const rawKey = responseKey(sharedSecret);
   sharedSecret.fill(0);
   const key = await crypto.subtle.importKey("raw", new Uint8Array(rawKey), "AES-GCM", false, ["decrypt"]);
   rawKey.fill(0);
   const decrypted = new Uint8Array(await crypto.subtle.decrypt({
     name: "AES-GCM",
-    iv: new Uint8Array(un64(envelope.nonce)),
+    iv: new Uint8Array(nonce),
     additionalData: new Uint8Array(ENCODER.encode(requestBinding)),
     tagLength: 128
-  }, key, new Uint8Array(un64(envelope.ciphertext))));
+  }, key, new Uint8Array(encodedCiphertext)));
   try {
     return JSON.parse(new TextDecoder().decode(decrypted));
   } finally {
@@ -6099,9 +5961,15 @@ function encodeSignatureHeader(envelope) {
   return b64(ENCODER.encode(JSON.stringify(SIGNATURE_FIELDS(envelope))));
 }
 function canonicalString(args) {
+  if (!validIdentity(args.identity) || !/^[A-Za-z][A-Za-z0-9-]{0,31}$/.test(args.method) || /[\0\r\n]/.test(args.path) || /[\0\r\n]/.test(args.query) || !exactBytes(args.nonce, 16) || args.responseKey !== undefined && !validResponsePublicKey(args.responseKey)) {
+    throw new Error("identity: malformed canonical request");
+  }
   const body = typeof args.body === "string" ? ENCODER.encode(args.body) : args.body;
   const digest = Array.from(sha256(body), (byte) => byte.toString(16).padStart(2, "0")).join("");
   const fields = [
+    "forgezero/request-signature/v1",
+    REQUEST_SIGNATURE_SUITE,
+    args.identity,
     args.method.toUpperCase(),
     args.path,
     args.query ?? "",
@@ -6109,16 +5977,17 @@ function canonicalString(args) {
     args.nonce,
     digest
   ];
-  if (args.responseKey)
-    fields.push(args.responseKey);
+  fields.push(args.responseKey ?? "-");
   return fields.join(`
 `);
 }
 function signRequest(keys, nodeKey, args) {
   const timestamp = Math.floor(Date.now() / 1000);
   const nonce = b64(randomBytes6(16));
-  const message = ENCODER.encode(canonicalString({ ...args, query: args.query ?? "", timestamp, nonce }));
+  const message = ENCODER.encode(canonicalString({ ...args, identity: nodeKey, query: args.query ?? "", timestamp, nonce }));
   return {
+    version: 1,
+    suite: REQUEST_SIGNATURE_SUITE,
     nodeKey,
     timestamp,
     nonce,
@@ -6126,7 +5995,13 @@ function signRequest(keys, nodeKey, args) {
     mlDsaSignature: b64(ml_dsa65.sign(message, un64(keys.mlDsa.secretKey)))
   };
 }
-var ENCODER, b64, un64, randomBytes6 = (length) => crypto.getRandomValues(new Uint8Array(length)), RESPONSE_KEY_HEADER = "x-fz-response-key", responseKey = (sharedSecret) => hkdf(sha256, sharedSecret, undefined, ENCODER.encode("forgezero/response/ml-kem-768+x25519/v1"), 32), SIGNATURE_FIELDS = (envelope) => ({
+var ENCODER, b64, un64, randomBytes6 = (length) => crypto.getRandomValues(new Uint8Array(length)), RESPONSE_KEY_HEADER = "x-fz-response-key", REQUEST_SIGNATURE_SUITE = "ed25519+ml-dsa-65", RESPONSE_SEALING_SUITE = "ml-kem-768+x25519/aes-256-gcm", BASE64URL, encodedLength = (bytes) => Math.ceil(bytes * 4 / 3), length = (value, name) => {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error(`identity: ${name} length unavailable`);
+  return value;
+}, ED_PUBLIC_BYTES, ED_SIGNATURE_BYTES, ML_PUBLIC_BYTES, ML_SIGNATURE_BYTES, RESPONSE_PUBLIC_BYTES, RESPONSE_SECRET_BYTES, RESPONSE_CIPHERTEXT_BYTES, responseKey = (sharedSecret) => hkdf(sha256, sharedSecret, undefined, ENCODER.encode("forgezero/response/ml-kem-768+x25519/v1"), 32), SIGNATURE_FIELDS = (envelope) => ({
+  version: envelope.version,
+  suite: envelope.suite,
   timestamp: envelope.timestamp,
   nonce: envelope.nonce,
   edSignature: envelope.edSignature,
@@ -6142,6 +6017,14 @@ var init_identity = __esm(() => {
   ENCODER = new TextEncoder;
   b64 = toBase64Url;
   un64 = fromBase64Url;
+  BASE64URL = /^[A-Za-z0-9_-]+$/;
+  ED_PUBLIC_BYTES = length(ed25519.lengths.publicKey, "Ed25519 public key");
+  ED_SIGNATURE_BYTES = length(ed25519.lengths.signature, "Ed25519 signature");
+  ML_PUBLIC_BYTES = length(ml_dsa65.lengths.publicKey, "ML-DSA-65 public key");
+  ML_SIGNATURE_BYTES = length(ml_dsa65.lengths.signature, "ML-DSA-65 signature");
+  RESPONSE_PUBLIC_BYTES = length(ml_kem768_x25519.lengths.publicKey, "hybrid response public key");
+  RESPONSE_SECRET_BYTES = length(ml_kem768_x25519.lengths.secretKey, "hybrid response secret key");
+  RESPONSE_CIPHERTEXT_BYTES = length(ml_kem768_x25519.lengths.cipherText, "hybrid response ciphertext");
 });
 
 // ../vault/dist/index.js
@@ -6189,8 +6072,8 @@ function signerFromApiKey(secret) {
   seed.fill(0);
   return {
     keyId,
-    async sign(request2) {
-      return encodeSignatureHeader(signRequest(keys, keyId, request2));
+    async sign(request) {
+      return encodeSignatureHeader(signRequest(keys, keyId, request));
     }
   };
 }
@@ -6459,13 +6342,13 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
     throw new VaultError("API_KEY_MALFORMED", "FORGEZERO_API_KEY is malformed.");
   }
   return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-}, requestAgentOnce = (socketPath, request2) => new Promise((resolveRequest, reject) => {
+}, requestAgentOnce = (socketPath, request) => new Promise((resolveRequest, reject) => {
   if (typeof process === "undefined" || typeof process.getBuiltinModule !== "function") {
     reject(new VaultError("MANAGED_RUNTIME_UNAVAILABLE", "The managed agent socket needs a Node or Bun server runtime."));
     return;
   }
   const net = process.getBuiltinModule("node:net");
-  const socket = net.connect(socketPath, () => socket.write(`${JSON.stringify(request2)}
+  const socket = net.connect(socketPath, () => socket.write(`${JSON.stringify(request)}
 `));
   let buffer = "";
   socket.setTimeout(15000, () => {
@@ -6492,11 +6375,11 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   });
   socket.on("end", () => reject(new VaultError("AGENT_UNAVAILABLE", "The local ForgeZero agent closed during a supervised handover.")));
   socket.on("error", (cause) => reject(new VaultError("AGENT_UNAVAILABLE", cause.message)));
-}), managedAgentTransport = async (socketPath, request2) => {
+}), managedAgentTransport = async (socketPath, request) => {
   let last;
   for (let attempt = 0;attempt < 5; attempt += 1) {
     try {
-      return await requestAgentOnce(socketPath, request2);
+      return await requestAgentOnce(socketPath, request);
     } catch (cause) {
       last = cause;
       if (cause?.code !== "AGENT_UNAVAILABLE" || attempt === 4)
@@ -6582,128 +6465,6 @@ function thresholdMode(id) {
   return THRESHOLD_MODES.find((mode) => mode.id === id);
 }
 
-// ../runtime/dist/ssh-agent.js
-import { Socket } from "net";
-import { createHash, hkdfSync } from "crypto";
-class SshAgentError extends Error {
-}
-var SSH_AGENTC_REQUEST_IDENTITIES = 11;
-var SSH_AGENT_IDENTITIES_ANSWER = 12;
-var SSH_AGENTC_SIGN_REQUEST = 13;
-var SSH_AGENT_SIGN_RESPONSE = 14;
-var CUSTODY_CHALLENGE = Buffer.from("forgezero/custody/ssh-agent/v1", "utf8");
-function readString(buffer, offset) {
-  const length = buffer.readUInt32BE(offset);
-  const start = offset + 4;
-  return [buffer.subarray(start, start + length), start + length];
-}
-function writeString(value) {
-  const length = Buffer.alloc(4);
-  length.writeUInt32BE(value.length);
-  return Buffer.concat([length, value]);
-}
-function frame(payload) {
-  const length = Buffer.alloc(4);
-  length.writeUInt32BE(payload.length);
-  return Buffer.concat([length, payload]);
-}
-var AGENT_TIMEOUT_MS = 3000;
-async function request(socketPath, payload) {
-  return new Promise((resolve, reject) => {
-    const socket = new Socket;
-    const chunks = [];
-    let expected = null;
-    let settled = false;
-    const fail = (message) => {
-      if (settled)
-        return;
-      settled = true;
-      socket.destroy();
-      reject(new SshAgentError(message));
-    };
-    socket.setTimeout(AGENT_TIMEOUT_MS, () => fail("SSH_AGENT_TIMEOUT"));
-    socket.on("error", () => fail("SSH_AGENT_UNREACHABLE"));
-    socket.on("connect", () => socket.write(frame(payload)));
-    socket.on("data", (chunk) => {
-      chunks.push(chunk);
-      const all = Buffer.concat(chunks);
-      if (expected === null && all.length >= 4)
-        expected = all.readUInt32BE(0);
-      if (expected !== null && all.length >= expected + 4) {
-        if (settled)
-          return;
-        settled = true;
-        socket.end();
-        resolve(all.subarray(4, expected + 4));
-      }
-    });
-    socket.on("close", () => {
-      if (expected === null)
-        fail("SSH_AGENT_CLOSED_EARLY");
-    });
-    socket.connect(socketPath);
-  });
-}
-function agentSocket(explicit) {
-  const path = explicit ?? process.env.SSH_AUTH_SOCK;
-  if (!path)
-    throw new SshAgentError("SSH_AUTH_SOCK_NOT_SET");
-  return path;
-}
-async function listIdentities(socketPath) {
-  const response = await request(agentSocket(socketPath), Buffer.from([SSH_AGENTC_REQUEST_IDENTITIES]));
-  if (response[0] !== SSH_AGENT_IDENTITIES_ANSWER) {
-    throw new SshAgentError("SSH_AGENT_BAD_RESPONSE");
-  }
-  const count = response.readUInt32BE(1);
-  const identities = [];
-  let offset = 5;
-  for (let index = 0;index < count; index += 1) {
-    const [blob, afterBlob] = readString(response, offset);
-    const [comment, afterComment] = readString(response, afterBlob);
-    offset = afterComment;
-    const [type] = readString(blob, 0);
-    identities.push({
-      blob,
-      comment: comment.toString("utf8"),
-      type: type.toString("utf8"),
-      fingerprint: `SHA256:${createHash("sha256").update(blob).digest("base64").replace(/=+$/, "")}`
-    });
-  }
-  return identities;
-}
-async function listCustodyIdentities(socketPath) {
-  return (await listIdentities(socketPath)).filter((id) => id.type === "ssh-ed25519");
-}
-async function signWithIdentity(identity, data, socketPath) {
-  const wrapped = await sign(identity.blob, Buffer.from(data), socketPath);
-  const [raw] = readString(wrapped, readString(wrapped, 0)[1]);
-  return new Uint8Array(raw);
-}
-async function sign(blob, data, socketPath) {
-  const payload = Buffer.concat([
-    Buffer.from([SSH_AGENTC_SIGN_REQUEST]),
-    writeString(blob),
-    writeString(data),
-    Buffer.alloc(4)
-  ]);
-  const response = await request(agentSocket(socketPath), payload);
-  if (response[0] !== SSH_AGENT_SIGN_RESPONSE) {
-    throw new SshAgentError("SSH_AGENT_SIGN_REFUSED");
-  }
-  const [signature] = readString(response, 1);
-  return signature;
-}
-async function deriveCustodyKey(identity, socketPath) {
-  if (identity.type !== "ssh-ed25519") {
-    throw new SshAgentError("SSH_KEY_TYPE_UNSUPPORTED");
-  }
-  const signature = await sign(identity.blob, CUSTODY_CHALLENGE, socketPath);
-  if (signature.length < 32)
-    throw new SshAgentError("SSH_AGENT_SIGNATURE_TOO_SHORT");
-  return new Uint8Array(hkdfSync("sha256", signature, identity.blob, Buffer.from("forgezero/custody/ssh-key/v1", "utf8"), 32));
-}
-
 // src/cli/run.ts
 class RunError extends Error {
   code;
@@ -6818,7 +6579,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.39";
+var VERSION2 = "0.1.40";
 
 // src/software.ts
 var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
@@ -6848,8 +6609,8 @@ var UBUNTU_2604_X64 = [
   },
   {
     requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
   },
   {
     requirement: { id: "cloudflared", version: "2026.7.3" },
@@ -7931,27 +7692,6 @@ function renderPlan(plan) {
 `);
 }
 
-// src/cli/custody.ts
-var PROBE_TIMEOUT_MS = 2000;
-function withTimeout(work, ms, label) {
-  return Promise.race([
-    work,
-    new Promise((_, reject) => setTimeout(() => reject(new SshAgentError(`SSH_AGENT_TIMEOUT:${label}`)), ms))
-  ]);
-}
-async function usableIdentities(socketPath) {
-  const candidates = await listCustodyIdentities(socketPath);
-  const usable = [];
-  for (const identity of candidates) {
-    const started = Date.now();
-    try {
-      await withTimeout(deriveCustodyKey(identity, socketPath), PROBE_TIMEOUT_MS, identity.fingerprint);
-      usable.push({ ...identity, responseMs: Date.now() - started });
-    } catch {}
-  }
-  return usable;
-}
-
 // ../node_modules/.bun/@noble+ciphers@2.2.0/node_modules/@noble/ciphers/utils.js
 /*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) */
 function isBytes5(a) {
@@ -7967,13 +7707,13 @@ function anumber5(n) {
   if (!Number.isSafeInteger(n) || n < 0)
     throw new RangeError("positive integer expected, got " + n);
 }
-function abytes5(value, length, title = "") {
+function abytes5(value, length2, title = "") {
   const bytes = isBytes5(value);
   const len = value?.length;
-  const needsLen = length !== undefined;
-  if (!bytes || needsLen && len !== length) {
+  const needsLen = length2 !== undefined;
+  if (!bytes || needsLen && len !== length2) {
     const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length}` : "";
+    const ofLen = needsLen ? ` of length ${length2}` : "";
     const got = bytes ? `length=${len}` : `type=${typeof value}`;
     const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
     if (!bytes)
@@ -8463,9 +8203,9 @@ var gcm = /* @__PURE__ */ wrapCipher({ blockSize: 16, nonceLength: 12, tagLength
 });
 
 // ../runtime/dist/custody-share.js
-init_ed25519();
 init_hkdf();
 init_sha22();
+init_hybrid();
 
 // ../node_modules/.bun/@noble+hashes@2.2.0/node_modules/@noble/hashes/pbkdf2.js
 init_hmac();
@@ -11090,8 +10830,8 @@ var fromBase64 = (value) => {
   return bytes;
 };
 var utf8 = (value) => new TextEncoder().encode(value);
-function deriveKey(secret, salt, info, length = KEY_BYTES) {
-  return hkdf(sha256, secret, salt, utf8(info), length);
+function deriveKey(secret, salt, info, length2 = KEY_BYTES) {
+  return hkdf(sha256, secret, salt, utf8(info), length2);
 }
 function openWithKey(key, box, aad) {
   if (key.length !== KEY_BYTES)
@@ -11100,28 +10840,43 @@ function openWithKey(key, box, aad) {
     throw new Error(`custody: unknown algorithm ${box.alg}`);
   return gcm(key, fromBase64(box.nonce), utf8(aad)).decrypt(fromBase64(box.ciphertext));
 }
-var WRAP_INFO = "forgezero:custody:wrap:v1";
-var wrapKey = (shared, ephemeral, recipient) => hkdf(sha256, shared, concatBytes6(ephemeral, recipient), utf8(WRAP_INFO), 32);
-function concatBytes6(left, right) {
-  const out = new Uint8Array(left.length + right.length);
-  out.set(left, 0);
-  out.set(right, left.length);
-  return out;
-}
+var WRAP_INFO = "forgezero:custody:wrap:ml-kem-768+x25519:v2";
+var WRAP_SEED_SALT = utf8("forgezero:custody:wrapkey:ml-kem-768+x25519:v2");
+var wrapKey = (shared) => hkdf(sha256, shared, undefined, utf8(WRAP_INFO), 32);
 function openFromKey(recipientSecretKey, box, aad) {
-  const ephemeralPublic = fromBase64(box.ephemeral);
-  const recipientPublic = x25519.getPublicKey(recipientSecretKey);
-  const shared = x25519.getSharedSecret(recipientSecretKey, ephemeralPublic);
-  const key = wrapKey(shared, ephemeralPublic, recipientPublic);
+  if (box?.version !== 2 || typeof box.kemCiphertext !== "string") {
+    throw new Error("custody: unsupported sealed-to-key envelope");
+  }
+  if (recipientSecretKey.length !== ml_kem768_x25519.lengths.secretKey) {
+    throw new Error("custody: invalid hybrid recipient secret key");
+  }
+  const ciphertext = fromBase64(box.kemCiphertext);
+  if (ciphertext.length !== ml_kem768_x25519.lengths.cipherText) {
+    throw new Error("custody: invalid hybrid KEM ciphertext");
+  }
+  const shared = Uint8Array.from(ml_kem768_x25519.decapsulate(ciphertext, recipientSecretKey));
+  const key = wrapKey(shared);
   try {
     return openWithKey(key, box, aad);
   } finally {
     key.fill(0);
+    shared.fill(0);
   }
 }
 function wrappingKeyPair(factorMaterial, info) {
-  const secretKey = hkdf(sha256, factorMaterial, utf8("forgezero:custody:wrapkey:v1"), utf8(info), 32);
-  return { secretKey, publicKey: x25519.getPublicKey(secretKey) };
+  if (factorMaterial.length < 32) {
+    throw new Error("custody: wrapping factor material must be at least 32 bytes");
+  }
+  const seed = hkdf(sha256, factorMaterial, WRAP_SEED_SALT, utf8(info), 32);
+  try {
+    const pair = ml_kem768_x25519.keygen(seed);
+    return {
+      secretKey: Uint8Array.from(pair.secretKey),
+      publicKey: Uint8Array.from(pair.publicKey)
+    };
+  } finally {
+    seed.fill(0);
+  }
 }
 var ENCODER2 = new TextEncoder;
 var PHRASE_WORDS = 24;
@@ -11366,7 +11121,7 @@ function defaultProjectContext(root = process.cwd()) {
       "Update a truth source instead of copying architecture or progress into another document.",
       "Never report a feature as complete without running its declared verification."
     ],
-    nonAuthoritative: ["audit/"]
+    nonAuthoritative: ["docs/audit/"]
   };
 }
 function renderProjectContext(manifest) {
@@ -11516,7 +11271,7 @@ function checkProjectContext(rootInput) {
 }
 
 // src/deploy-file.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { basename, join as join3 } from "path";
 
@@ -11766,7 +11521,7 @@ var stable = (value) => {
   return JSON.stringify(value);
 };
 function deployDefinitionDigest(definition) {
-  return `sha256:${createHash2("sha256").update(stable(definition)).digest("hex")}`;
+  return `sha256:${createHash("sha256").update(stable(definition)).digest("hex")}`;
 }
 var safeName = (value) => {
   const normalized = value.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
@@ -12061,7 +11816,7 @@ function removeSession(api, realm, path = defaultSessionPath()) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash3, createHmac, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash2, createHmac, randomBytes as randomBytes7 } from "crypto";
 import {
   chmodSync as chmodSync2,
   existsSync as existsSync4,
@@ -12295,6 +12050,8 @@ function renderPlatformApiUnits(input) {
     throw new Error("Blue and green ports must differ.");
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
+  const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
 After=network-online.target ${input.collectorUnit}
@@ -12307,7 +12064,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${credentials}
+${capacityEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2
@@ -12343,16 +12100,24 @@ Environment=PORT=${input.greenPort}
 function renderPlatformNginx(input) {
   boundedInteger("publicPort", input.publicPort, 1024, 65535);
   boundedInteger("initialSlotPort", input.initialSlotPort, 1024, 65535);
+  const concurrencyLimit = boundedInteger("concurrencyLimit", input.concurrencyLimit ?? 256, 1, 1e6);
+  boundedInteger("workerDrainSeconds", input.workerDrainSeconds ?? 35, 1, 300);
   if (input.publicPort === input.initialSlotPort)
     throw new Error("Edge and slot ports must differ.");
   return {
     upstream: `upstream forgezero { server 127.0.0.1:${input.initialSlotPort}; }
 `,
-    site: `server {
+    site: `limit_conn_zone $server_name zone=forgezero_admission:10m;
+map $http_upgrade $forgezero_connection { default upgrade; '' close; }
+map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED_DRY_RUN 1; }
+server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  limit_conn forgezero_admission ${concurrencyLimit};
+  limit_conn_status 503;
+  add_header Retry-After $forgezero_retry_after always;
+  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
+  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
   location / { return 404; }
 }
 `
@@ -12368,6 +12133,7 @@ function renderPlatformActivationFiles(input) {
   if (input.bluePort === input.greenPort)
     throw new Error("Activation slot ports must differ.");
   boundedInteger("keepReleases", input.keepReleases, 2, 100);
+  const drainDeadlineMs = boundedInteger("drainDeadlineMs", input.drainDeadlineMs ?? 35000, 1000, 300000);
   if (!/^\/[A-Za-z0-9/_-]{1,128}$/.test(input.healthPath) || input.healthPath.includes("..")) {
     throw new Error("Activation health path is malformed.");
   }
@@ -12377,7 +12143,8 @@ function renderPlatformActivationFiles(input) {
     `FZ_BLUE_PORT=${input.bluePort}`,
     `FZ_GREEN_PORT=${input.greenPort}`,
     `FZ_HEALTH_PATH=${input.healthPath}`,
-    `FZ_KEEP_RELEASES=${input.keepReleases}`
+    `FZ_KEEP_RELEASES=${input.keepReleases}`,
+    `FZ_DRAIN_DEADLINE_MS=${drainDeadlineMs}`
   ].join(`
 `) + `
 `;
@@ -12399,7 +12166,14 @@ if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true;
 upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
 printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
 if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
-rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"; [[ -n "$previous_slot" && "$previous_slot" != "$target" ]] && systemctl stop "forgezero@\${previous_slot}.service" || true
+rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"
+# New nginx workers select the new slot after reload. Keep the old slot alive
+# while old workers drain in-flight requests and upgraded connections.
+if [[ -n "$previous_slot" && "$previous_slot" != "$target" ]]; then
+  sleep_seconds="$(( (FZ_DRAIN_DEADLINE_MS + 999) / 1000 ))"
+  sleep "$sleep_seconds"
+  systemctl stop "forgezero@\${previous_slot}.service" || true
+fi
 mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
 for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
 printf 'promoted %s on %s\\n' "$release" "$target"
@@ -12450,34 +12224,11 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
-import { dirname as dirname3, join as join5, resolve as resolve2 } from "path";
-import { tmpdir } from "os";
 import { randomUUID } from "crypto";
-import { isIP as isIP3 } from "net";
+import { chmod, lstat, mkdir, open, rename, stat, unlink } from "fs/promises";
+import { dirname as dirname3, join as join5, resolve as resolve2 } from "path";
 
 // src/cloudflare-edge.ts
-import { isIP as isIP2 } from "net";
-function isPrivateDatabaseAddress(value) {
-  const address = value.trim().toLowerCase();
-  const family = isIP2(address);
-  if (family === 4) {
-    const [a, b] = address.split(".").map(Number);
-    return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
-  }
-  if (family === 6) {
-    const first = Number.parseInt(address.split(":", 1)[0], 16);
-    return Number.isFinite(first) && (first & 65024) === 64512;
-  }
-  return false;
-}
-function privateDatabaseHostRoute(value) {
-  const address = value.trim().toLowerCase();
-  if (!isPrivateDatabaseAddress(address)) {
-    throw new Error("database address must be an RFC 1918 IPv4 or unique-local IPv6 address");
-  }
-  return `${address}/${isIP2(address) === 4 ? 32 : 128}`;
-}
 var endpoint = "https://api.cloudflare.com/client/v4";
 async function cf(config, path, init = {}, fetcher = fetch) {
   const response = await fetcher(`${endpoint}${path}`, {
@@ -12494,76 +12245,36 @@ async function cf(config, path, init = {}, fetcher = fetch) {
   }
   return body.result;
 }
-async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
-  const [address, prefixText, ...extra] = config.network.split("/");
-  const family = isIP2(address ?? "");
-  const prefix = Number(prefixText);
-  if (extra.length > 0 || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
-    throw new Error("Cloudflare private route must be an explicit IPv4 or IPv6 CIDR");
-  }
-  const path = `/accounts/${config.accountId}/teamnet/routes`;
-  const routes = await cf(config, path, {}, fetcher);
-  const current = routes.find((route2) => !route2.deleted_at && route2.network === config.network && (route2.virtual_network_id ?? "") === (config.virtualNetworkId ?? ""));
-  if (current) {
-    if (current.tunnel_id !== config.tunnelId) {
-      throw new Error(`private route ${config.network} already belongs to another Tunnel`);
-    }
-    return { route: current, created: false };
-  }
-  const route = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({
-      network: config.network,
-      tunnel_id: config.tunnelId,
-      comment: config.comment.slice(0, 100),
-      ...config.virtualNetworkId ? { virtual_network_id: config.virtualNetworkId } : {}
-    })
-  }, fetcher);
-  return { route, created: true };
-}
-async function ensureCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
-  return ensureCloudflarePrivateRoute({
-    ...config,
-    network: privateDatabaseHostRoute(config.privateAddress)
-  }, fetcher);
-}
-async function ensureCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
-  if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
-    throw new Error("Cloudflare WARP policy id is invalid");
-  const route = privateDatabaseHostRoute(config.privateAddress);
-  const policy = config.policyId ? `/${config.policyId}` : "";
-  const path = `/accounts/${config.accountId}/devices/policy${policy}/include`;
-  const entries = await cf(config, path, {}, fetcher);
-  if (entries.some((entry) => entry.address === route))
-    return { entries, created: false };
-  const next = [...entries, { address: route, description: config.description.slice(0, 100) }];
-  const updated = await cf(config, path, {
-    method: "PUT",
-    body: JSON.stringify(next)
-  }, fetcher);
-  return { entries: updated, created: true };
-}
 async function configureCloudflareEdge(config, fetcher = fetch) {
   const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
   const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
-  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
-  const existing = current.config?.ingress ?? [];
-  const catchAll = existing.filter((rule) => !("hostname" in rule));
-  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
-  await cf(tunnelAuth, tunnelPath, {
-    method: "PUT",
-    body: JSON.stringify({ config: { ingress: [
-      { hostname: config.hostname, service: config.service },
-      ...otherHosts,
-      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
-    ] } })
-  }, fetcher);
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
-  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  const [current, records] = await Promise.all([
+    cf(tunnelAuth, tunnelPath, {}, fetcher),
+    cf(dnsAuth, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
+  ]);
   if (records.length > 1) {
     throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
   }
+  const existingRecord = records[0];
+  if (existingRecord && (existingRecord.type !== "CNAME" || existingRecord.name && existingRecord.name.toLowerCase() !== config.hostname.toLowerCase())) {
+    throw new Error(`Cloudflare DNS hostname ${config.hostname} is already owned by an incompatible ${existingRecord.type ?? "unknown"} record`);
+  }
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  const desiredIngress = [
+    { hostname: config.hostname, service: config.service },
+    ...otherHosts,
+    ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+  ];
+  if (JSON.stringify(existing) !== JSON.stringify(desiredIngress)) {
+    await cf(tunnelAuth, tunnelPath, {
+      method: "PUT",
+      body: JSON.stringify({ config: { ingress: desiredIngress } })
+    }, fetcher);
+  }
   const record2 = {
     type: "CNAME",
     name: config.hostname,
@@ -12571,233 +12282,13 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
     proxied: true,
     ttl: 1
   };
-  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
-    method: records[0] ? "PUT" : "POST",
-    body: JSON.stringify(record2)
-  }, fetcher);
-}
-var exactAccountPermissionGroup = async (config, name, fetcher) => {
-  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
-  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
-  if (matches.length !== 1) {
-    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
-  }
-  return { id: matches[0].id, name };
-};
-async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
-  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
-    throw new Error("Cloudflare account id is invalid");
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
-    throw new Error("Cloudflare account runtime-token name is invalid");
-  }
-  const permissionNames = [...new Set(config.permissionNames)];
-  if (permissionNames.length === 0)
-    throw new Error("Cloudflare account runtime token needs a permission group");
-  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
-  const body = {
-    name,
-    policies: [{
-      effect: "allow",
-      permission_groups: permissionGroups.map(({ id: id2 }) => ({ id: id2 })),
-      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
-    }]
-  };
-  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
-  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
-    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
-  }
-  return { id: created.id, value: created.value, name, permissionNames };
-}
-async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare Access service-token name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/service_tokens`;
-  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = tokens.filter((token) => token.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
-  if (matches[0]) {
-    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
-      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
-    }
-    return { credentials: config.existing, created: false };
-  }
-  const created = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
-  }, fetcher);
-  if (!created.id || !created.client_id || !created.client_secret) {
-    throw new Error("Cloudflare did not return the new Access service-token secret");
-  }
-  return {
-    credentials: {
-      tokenId: created.id,
-      clientId: created.client_id,
-      clientSecret: created.client_secret
-    },
-    created: true
-  };
-}
-async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/policies`;
-  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === config.name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
-  const desired = {
-    name: config.name,
-    decision: "non_identity",
-    include: [{ service_token: { token_id: config.serviceTokenId } }]
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
-    method: matches[0] ? "PUT" : "POST",
-    body: JSON.stringify(desired)
-  }, fetcher);
-  return { policy, created: !matches[0] };
-}
-async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
-  const desired = {
-    name: config.name,
-    type: "self_hosted",
-    domain: config.hostname,
-    session_duration: "24h",
-    service_auth_401_redirect: true,
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare WARP enrollment application name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
-  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
-    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
-  }
-  const desired = {
-    name,
-    type: "warp",
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!application.id || application.type && application.type !== "warp") {
-    throw new Error("Cloudflare did not return the WARP enrollment application");
-  }
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare VNET name is invalid");
-  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
-  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
-  if (matches[0])
-    return { virtualNetwork: matches[0], created: false };
-  const virtualNetwork = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
-  }, fetcher);
-  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
-    throw new Error("Cloudflare did not return the VNET id");
-  }
-  return { virtualNetwork, created: true };
-}
-async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare WARP device profile name is invalid");
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
-    throw new Error("Cloudflare service-token id is invalid");
-  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
-    throw new Error("Cloudflare VNET id is invalid");
-  const precedence = config.precedence ?? 100;
-  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
-    throw new Error("Cloudflare WARP device profile precedence is invalid");
-  }
-  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
-  const listPath = `/accounts/${config.accountId}/devices/policies`;
-  const path = `/accounts/${config.accountId}/devices/policy`;
-  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
-  if (matches[0]?.match && matches[0].match !== match) {
-    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
-  }
-  const desired = {
-    name,
-    match,
-    precedence,
-    description: "ForgeZero non-interactive compute enrollment",
-    enabled: true,
-    allow_mode_switch: false,
-    allowed_to_leave: false,
-    auto_connect: 0,
-    switch_locked: true,
-    service_mode_v2: { mode: "warp" },
-    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!policy.id)
-    throw new Error("Cloudflare did not return the WARP device profile id");
-  return { policy, created: !matches[0] };
-}
-async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
-    throw new Error("Cloudflare Worker script name is invalid");
-  }
-  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
-    method: "PATCH",
-    body: JSON.stringify({
-      secrets: {
-        CF_ACCESS_CLIENT_ID: {
-          name: "CF_ACCESS_CLIENT_ID",
-          type: "secret_text",
-          text: config.credentials.clientId
-        },
-        CF_ACCESS_CLIENT_SECRET: {
-          name: "CF_ACCESS_CLIENT_SECRET",
-          type: "secret_text",
-          text: config.credentials.clientSecret
-        }
-      }
-    })
-  }, fetcher);
-}
-async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
-  const title = config.title.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
-    throw new Error("Cloudflare KV namespace title is invalid");
+  const dnsAlreadyCorrect = existingRecord?.type === record2.type && existingRecord.name?.toLowerCase() === record2.name.toLowerCase() && existingRecord.content?.toLowerCase() === record2.content.toLowerCase() && existingRecord.proxied === true && existingRecord.ttl === 1;
+  if (!dnsAlreadyCorrect) {
+    await cf(dnsAuth, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
+      method: existingRecord ? "PUT" : "POST",
+      body: JSON.stringify(record2)
+    }, fetcher);
   }
-  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
-  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = namespaces.filter((namespace2) => namespace2.title === title);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
-  if (matches[0])
-    return { namespace: matches[0], created: false };
-  const namespace = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ title })
-  }, fetcher);
-  return { namespace, created: true };
 }
 async function ensureCloudflareTunnel(config, fetcher = fetch) {
   const name = config.name.trim();
@@ -12822,22 +12313,10 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
 }
 
 // src/cloudflare-bootstrap.ts
-var acceptanceFetch = async (url, label, fetcher, headers) => {
-  let response;
-  try {
-    response = await fetcher(url, {
-      method: "GET",
-      headers,
-      redirect: "manual",
-      signal: AbortSignal.timeout(5000)
-    });
-  } catch {
-    throw new Error(`${label} is unreachable`);
-  }
-  if (!response.ok)
-    throw new Error(`${label} returned HTTP ${response.status}`);
-  return response.status;
-};
+var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
+var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -12846,8 +12325,9 @@ async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   if (metadata.nlink !== 1)
     throw new Error(`${path} must not have multiple hard links`);
   const uid = ownerUid();
-  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`${path} must be owned by the current operator`);
+  }
   if ((metadata.mode & 63) !== 0)
     throw new Error(`${path} must not be accessible by group or other users`);
   if ((metadata.mode & 256) === 0)
@@ -12872,25 +12352,36 @@ async function readOwnerOnlyFile(path, maximumBytes) {
 }
 async function readOwnerApiToken(path) {
   const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+  if (!TOKEN.test(token))
     throw new Error(`${resolve2(path)} must contain exactly one Cloudflare API token`);
-  }
   return token;
 }
 async function readCloudflareBootstrapTokens(files) {
   const entries = await Promise.all([
     ["apiToken", files.apiTokenFile],
+    ["managementApiToken", files.managementApiTokenFile],
+    ["runtimeApiToken", files.runtimeApiTokenFile],
     ["tunnelApiToken", files.tunnelApiTokenFile],
     ["dnsApiToken", files.dnsApiTokenFile],
-    ["kvApiToken", files.kvApiTokenFile],
-    ["accessApiToken", files.accessApiTokenFile],
-    ["workerApiToken", files.workerApiTokenFile]
+    ["kvApiToken", files.kvApiTokenFile]
   ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
-  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
-  const unified = tokens.apiToken;
-  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
-    if (!tokens[key] && !unified)
-      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  const supplied = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const tokens = {
+    ...supplied.apiToken ? { apiToken: supplied.apiToken } : {},
+    ...supplied.tunnelApiToken || supplied.managementApiToken ? {
+      tunnelApiToken: supplied.tunnelApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.dnsApiToken || supplied.managementApiToken ? {
+      dnsApiToken: supplied.dnsApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.kvApiToken || supplied.runtimeApiToken ? {
+      kvApiToken: supplied.kvApiToken ?? supplied.runtimeApiToken
+    } : {}
+  };
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken"]) {
+    if (!tokens[key] && !tokens.apiToken) {
+      throw new Error(`Cloudflare ${key} file is required when apiTokenFile is omitted`);
+    }
   }
   return tokens;
 }
@@ -12900,36 +12391,30 @@ var validateId = (value, label) => {
     throw new Error(`${label} must be a 32-character hexadecimal id`);
   return normalized;
 };
-var validateName = (value, label, maximum, allowSpaces = true) => {
+var validateName = (value, label) => {
   const normalized = value.trim();
-  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(normalized))
     throw new Error(`${label} is invalid`);
-  }
   return normalized;
 };
-var privateAddress = (value) => {
-  const address = value.trim().toLowerCase();
-  const family = isIP3(address);
-  if (family === 4) {
-    const [a, b] = address.split(".").map(Number);
-    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
-      return address;
-  }
-  if (family === 6) {
-    const first = Number.parseInt(address.split(":", 1)[0], 16);
-    if (Number.isFinite(first) && (first & 65024) === 64512)
-      return address;
-  }
-  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+var normalizeService = (value) => {
+  let service;
+  try {
+    service = new URL(value);
+  } catch {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
+  }
+  if (service.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(service.hostname) || !service.port || service.pathname !== "/" || service.username || service.password || service.search || service.hash) {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
+  }
+  return service.toString().replace(/\/$/, "");
 };
 function validateCloudflareBootstrapCoordinates(input) {
   const nodeInputs = input.nodes?.length ? input.nodes : [{
     nodeName: input.tunnelName,
     hostname: input.hostname,
     service: input.service,
-    tunnelName: input.tunnelName,
-    applicationName: input.applicationName
+    tunnelName: input.tunnelName
   }];
   if (nodeInputs.length < 1 || nodeInputs.length > 32) {
     throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
@@ -12939,88 +12424,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
       throw new Error("Cloudflare node name is invalid");
     const hostname = node.hostname.trim().toLowerCase();
-    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+    if (!HOSTNAME.test(hostname))
       throw new Error("Cloudflare public node hostname is invalid");
-    }
-    const serviceUrl = new URL(node.service);
-    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
-      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
-    }
     return {
       nodeName,
       hostname,
-      service: serviceUrl.toString().replace(/\/$/, ""),
-      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
-      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
-      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+      service: normalizeService(node.service),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name")
     };
   });
   for (const [label, values] of [
     ["node name", nodes.map(({ nodeName }) => nodeName)],
     ["hostname", nodes.map(({ hostname }) => hostname)],
-    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
-    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)]
   ]) {
     if (new Set(values).size !== values.length)
       throw new Error(`Cloudflare fleet ${label} must be unique`);
   }
   const first = nodes[0];
-  const workerScriptName = input.workerScriptName.trim();
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
-    throw new Error("Cloudflare Worker script name is invalid");
-  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
-  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
-    throw new Error("Cloudflare Worker compatibility date is invalid");
-  }
-  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
-  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
-    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
-  }
-  const workerDirectory = resolve2(input.workerDirectory);
-  const workerMain = input.workerMain.trim();
-  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
-    throw new Error("Cloudflare Worker main must be a project-relative path");
-  }
-  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
-    throw new Error("Cloudflare runtime-token name prefix is invalid");
-  }
-  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
-    throw new Error("private-network runtime token requires runtime-token creation");
-  }
-  const privateNetwork = input.privateNetwork ? {
-    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
-    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
-    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
-    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
-    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
-  } : undefined;
-  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
-    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
-  }
-  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
-    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
-  }
   return {
     accountId: validateId(input.accountId, "Cloudflare account id"),
     zoneId: validateId(input.zoneId, "Cloudflare zone id"),
     hostname: first.hostname,
     service: first.service,
     tunnelName: first.tunnelName,
-    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
-    workerScriptName,
-    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
-    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
-    applicationName: first.applicationName,
-    workerDirectory,
-    workerMain,
-    workerCompatibilityDate,
-    publicDomains,
-    createRuntimeTokens: input.createRuntimeTokens,
-    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
-    runtimeTokenNamePrefix,
-    nodes,
-    ...privateNetwork ? { privateNetwork } : {}
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    nodes
   };
 }
 function planCloudflareBootstrap(input, outputPath) {
@@ -13032,120 +12461,18 @@ function planCloudflareBootstrap(input, outputPath) {
     outputFile: resolve2(outputPath),
     coordinates,
     operations: [
-      "create or reuse one Workers KV namespace",
       "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
-      ...coordinates.createRuntimeTokens ? [
-        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
-      ] : [],
-      "deploy the shared Worker once with the created NODES binding and stable custom domains",
-      "create or reuse one shared Access service token/policy and one self-hosted application per node",
-      ...coordinates.privateNetwork ? [
-        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
-      ] : [],
-      "write the Access client id and secret to the existing Worker as encrypted secrets",
-      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+      "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
+      "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
+      "write one node-specific handoff containing the connector token and owner-supplied KV-write token"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never written to output",
-      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
-      "the normal API process does not receive or import the management token files"
+      "API tokens are read only from owner-only files and are never placed in argv or stdout",
+      "the management token is never persisted; connector and KV runtime capabilities are atomically checkpointed with mode 0600",
+      "the normal API process receives only its KV-write token and never Tunnel or DNS management authority"
     ]
   };
 }
-var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
-  const child = Bun.spawn([...command], {
-    cwd,
-    env: { ...env },
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    child.exited,
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text()
-  ]);
-  return { exitCode, stdout, stderr };
-};
-var inheritedWorkerEnvironment = () => {
-  const allowed = [
-    "PATH",
-    "HOME",
-    "TMPDIR",
-    "XDG_CONFIG_HOME",
-    "XDG_CACHE_HOME",
-    "SSL_CERT_FILE",
-    "SSL_CERT_DIR",
-    "NODE_EXTRA_CA_CERTS",
-    "HTTPS_PROXY",
-    "HTTP_PROXY",
-    "NO_PROXY"
-  ];
-  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
-};
-var redact = (text3, secrets) => {
-  let safe = text3.slice(0, 4096);
-  for (const secret of secrets)
-    if (secret)
-      safe = safe.split(secret).join("[REDACTED]");
-  return safe.trim();
-};
-async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
-  const validated = validateCloudflareBootstrapCoordinates(coordinates);
-  const workerDirectoryMetadata = await stat(validated.workerDirectory);
-  if (!workerDirectoryMetadata.isDirectory())
-    throw new Error("Cloudflare Worker directory is not a directory");
-  const workerMain = resolve2(validated.workerDirectory, validated.workerMain);
-  const workerMainMetadata = await stat(workerMain);
-  if (!workerMainMetadata.isFile())
-    throw new Error("Cloudflare Worker main is not a regular file");
-  const wrangler = resolve2(validated.workerDirectory, "node_modules/.bin/wrangler");
-  const wranglerMetadata = await stat(wrangler);
-  if (!wranglerMetadata.isFile())
-    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
-  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
-    throw new Error("Cloudflare KV namespace id is invalid");
-  const temporaryDirectory = await mkdtemp(join5(tmpdir(), "fz-wrangler-"));
-  await chmod(temporaryDirectory, 448);
-  const configurationPath = join5(temporaryDirectory, "wrangler.json");
-  try {
-    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    try {
-      await handle.writeFile(`${JSON.stringify({
-        name: validated.workerScriptName,
-        main: workerMain,
-        compatibility_date: validated.workerCompatibilityDate,
-        workers_dev: false,
-        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
-        observability: { enabled: true },
-        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
-      }, null, 2)}
-`);
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    const result = await runner({
-      command: [wrangler, "deploy", "--config", configurationPath],
-      cwd: validated.workerDirectory,
-      env: {
-        ...inheritedWorkerEnvironment(),
-        XDG_CONFIG_HOME: temporaryDirectory,
-        XDG_CACHE_HOME: temporaryDirectory,
-        WRANGLER_LOG_PATH: join5(temporaryDirectory, "wrangler.log"),
-        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
-        CLOUDFLARE_API_TOKEN: apiToken,
-        WRANGLER_SEND_METRICS: "false"
-      }
-    });
-    if (result.exitCode !== 0) {
-      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
-      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
-    }
-  } finally {
-    await rm(temporaryDirectory, { recursive: true, force: true });
-  }
-}
 async function readExistingOutput(path) {
   try {
     await lstat(path);
@@ -13154,13 +12481,15 @@ async function readExistingOutput(path) {
       return;
     throw cause;
   }
-  const text3 = await readOwnerOnlyFile(path, 1048576);
-  let output;
+  let parsed;
   try {
-    output = JSON.parse(text3);
-  } catch {
-    throw new Error(`${resolve2(path)} is not valid bootstrap JSON`);
+    parsed = JSON.parse(await readOwnerOnlyFile(path, 1048576));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error(`${resolve2(path)} is not valid bootstrap JSON`);
+    throw cause;
   }
+  const output = parsed;
   if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
     throw new Error(`${resolve2(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
@@ -13201,44 +12530,29 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   ].includes(key));
   if (unknown.length)
     throw new Error(`Cloudflare host handoff contains unsupported field ${unknown[0]}`);
-  if (output.warp) {
-    const unknownWarp = Object.keys(output.warp).filter((key) => ![
-      "organization",
-      "clientId",
-      "clientSecret",
-      "virtualNetworkId",
-      "deviceProfileId"
-    ].includes(key));
-    if (unknownWarp.length)
-      throw new Error(`Cloudflare host handoff WARP contains unsupported field ${unknownWarp[0]}`);
-  }
   const normalizedNodeName = nodeName.trim().toLowerCase();
   let service;
   try {
-    service = new URL(output.service ?? "");
+    service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "") || !/^[A-Za-z0-9._-]{40,80}$/.test(output.kvRuntimeToken ?? "") || !output.hostname || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(output.hostname) || !service || service.protocol !== "http:" || service.hostname !== "127.0.0.1" || !service.port || service.pathname !== "/" || service.username || service.password || service.search || service.hash || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(output.tunnelId ?? "") || !/^[A-Za-z0-9._-]{40,16384}$/.test(output.connectorToken ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.kvRuntimeToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
-  const network = output.privateNetworkRuntimeToken;
-  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+  if (output.privateNetworkRuntimeToken !== undefined && !TOKEN.test(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network capability is malformed");
   }
-  if (Boolean(output.warp) !== Boolean(network)) {
+  if (Boolean(output.warp) !== Boolean(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network resources and capability disagree");
   }
-  if (output.warp && (!output.warp.clientId || !output.warp.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(output.warp.organization) || !/^[0-9a-f-]{36}$/i.test(output.warp.virtualNetworkId) || !output.warp.deviceProfileId)) {
-    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
-  }
   const { format: _format, kind: _kind, ...handoff } = output;
   return handoff;
 }
 async function prepareOwnerOutputDirectory(absolutePath) {
   const directory = dirname3(absolutePath);
   await mkdir(directory, { recursive: true, mode: 448 });
-  const directoryMetadata = await stat(directory);
+  const metadata = await stat(directory);
   const uid = ownerUid();
-  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+  if (!metadata.isDirectory() || uid !== undefined && metadata.uid !== uid || (metadata.mode & 18) !== 0) {
     throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
   }
   return directory;
@@ -13275,13 +12589,6 @@ async function writeOwnerBootstrapOutput(path, output) {
   await writeOwnerJson(path, output);
 }
 async function writeCloudflareHostHandoffs(checkpointPath, output) {
-  const kv = output.resources.runtimeTokens?.kv?.value;
-  if (!kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv)) {
-    return;
-  }
-  const network = output.resources.runtimeTokens?.privateNetwork?.value;
-  const privateNetwork = output.resources.privateNetwork;
-  const access = output.resources.access;
   for (const node of output.resources.nodes) {
     const handoff = {
       format: 1,
@@ -13294,34 +12601,19 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      kvRuntimeToken: kv,
-      ...network ? { privateNetworkRuntimeToken: network } : {},
-      ...privateNetwork && access ? { warp: {
-        organization: privateNetwork.warpOrganization,
-        clientId: access.clientId,
-        clientSecret: access.clientSecret,
-        virtualNetworkId: privateNetwork.virtualNetworkId,
-        deviceProfileId: privateNetwork.deviceProfileId
-      } } : {}
+      kvRuntimeToken: output.resources.kvRuntimeToken
     };
     await writeOwnerJson(cloudflareHostHandoffPath(checkpointPath, node.nodeName), handoff);
   }
 }
 var tokenFor = (tokens, key) => {
   const token = tokens[key]?.trim() || tokens.apiToken?.trim();
-  if (!token)
+  if (!token || !TOKEN.test(token))
     throw new Error(`Cloudflare ${key} is not configured`);
   return token;
 };
-var initialManagementToken = (tokens) => {
-  const token = tokens.apiToken?.trim();
-  if (!token) {
-    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
-  }
-  return token;
-};
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve2(outputPath);
   const existing = await readExistingOutput(absoluteOutput);
@@ -13329,19 +12621,18 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
   }
   await prepareOwnerOutputDirectory(absoluteOutput);
-  const namespace = await ensureCloudflareKvNamespace({
-    accountId: coordinates.accountId,
-    title: coordinates.kvNamespaceTitle,
-    apiToken: tokenFor(tokens, "kvApiToken")
-  }, fetcher);
+  const kvRuntimeToken = tokenFor(tokens, "kvApiToken");
   const nodeResources = [];
   const createdNodes = [];
-  let resources;
   for (const node of coordinates.nodes) {
     const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let resource;
     let created = false;
     if (checkpointed) {
-      nodeResources.push(checkpointed);
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+        throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
+      }
+      resource = checkpointed;
     } else {
       const tunnel = await ensureCloudflareTunnel({
         accountId: coordinates.accountId,
@@ -13349,234 +12640,29 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         apiToken: tokenFor(tokens, "tunnelApiToken")
       }, fetcher);
       created = tunnel.created;
-      nodeResources.push({
-        nodeName: node.nodeName,
-        hostname: node.hostname,
-        service: node.service,
-        tunnelName: node.tunnelName,
-        tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken
-      });
+      resource = { ...node, tunnelId: tunnel.tunnel.id, connectorToken: tunnel.connectorToken };
     }
-    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
-    const firstNode = nodeResources[0];
-    resources = {
-      tunnelId: firstNode.tunnelId,
-      kvNamespaceId: namespace.namespace.id,
-      hostname: firstNode.hostname,
-      service: firstNode.service,
-      connectorToken: firstNode.connectorToken,
-      nodes: [...nodeResources],
-      ...existing?.resources.access ? { access: existing.resources.access } : {},
-      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
-      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
-      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources)
-    throw new Error("Cloudflare fleet has no nodes");
-  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
-    resources = {
-      ...resources,
-      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
-        accountId: coordinates.accountId,
-        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
-        permissionNames: ["Workers KV Storage Write"],
-        apiToken: initialManagementToken(tokens)
-      }, fetcher) }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
-    resources = {
-      ...resources,
-      runtimeTokens: {
-        ...resources.runtimeTokens,
-        privateNetwork: await createCloudflareAccountRuntimeToken({
-          accountId: coordinates.accountId,
-          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
-          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
-          apiToken: initialManagementToken(tokens)
-        }, fetcher)
-      }
-    };
+    nodeResources.push(resource);
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created });
+    const first2 = nodeResources[0];
     await writeOwnerBootstrapOutput(absoluteOutput, {
       format: 1,
       kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
+      phase: "edge-resources-provisioned",
       updatedAt: new Date().toISOString(),
       coordinates,
-      resources
-    });
-  }
-  if (!resources.worker) {
-    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
-    resources = {
-      ...resources,
-      worker: {
-        scriptName: coordinates.workerScriptName,
-        publicDomains: coordinates.publicDomains,
-        deployed: true
+      resources: {
+        tunnelId: first2.tunnelId,
+        kvNamespaceId: coordinates.kvNamespaceId,
+        hostname: first2.hostname,
+        service: first2.service,
+        connectorToken: first2.connectorToken,
+        kvRuntimeToken,
+        nodes: [...nodeResources]
       }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "worker-deployed",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
     });
   }
-  const serviceToken = await ensureCloudflareAccessServiceToken({
-    accountId: coordinates.accountId,
-    name: coordinates.serviceTokenName,
-    apiToken: tokenFor(tokens, "accessApiToken"),
-    existing: resources.access
-  }, fetcher);
-  resources = { ...resources, access: serviceToken.credentials };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  const policy = await ensureCloudflareAccessPolicy({
-    accountId: coordinates.accountId,
-    name: coordinates.policyName,
-    serviceTokenId: serviceToken.credentials.tokenId,
-    apiToken: tokenFor(tokens, "accessApiToken")
-  }, fetcher);
-  if (!policy.policy.id)
-    throw new Error("Cloudflare did not return the Access policy id");
-  resources = {
-    ...resources,
-    access: { ...serviceToken.credentials, policyId: policy.policy.id }
-  };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  let privateNetworkCreated = false;
-  if (coordinates.privateNetwork && !resources.privateNetwork) {
-    const managementToken = initialManagementToken(tokens);
-    const virtualNetwork = await ensureCloudflareVirtualNetwork({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.virtualNetworkName,
-      comment: "ForgeZero private database network",
-      apiToken: managementToken
-    }, fetcher);
-    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.enrollmentApplicationName,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.deviceProfileName,
-      serviceTokenId: serviceToken.credentials.tokenId,
-      virtualNetworkId: virtualNetwork.virtualNetwork.id,
-      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
-      apiToken: managementToken
-    }, fetcher);
-    const routes = [];
-    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
-      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
-      const route = await ensureCloudflarePrivateDatabaseRoute({
-        accountId: coordinates.accountId,
-        tunnelId: resource.tunnelId,
-        privateAddress: node.privateAddress,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        comment: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      await ensureCloudflareWarpDatabaseInclude({
-        accountId: coordinates.accountId,
-        policyId: deviceProfile.policy.id,
-        privateAddress: node.privateAddress,
-        description: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
-    }
-    resources = {
-      ...resources,
-      privateNetwork: {
-        warpOrganization: coordinates.privateNetwork.warpOrganization,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        deviceProfileId: deviceProfile.policy.id,
-        enrollmentApplicationId: enrollment.application.id,
-        routes
-      }
-    };
-    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  for (const node of coordinates.nodes) {
-    const application = await ensureCloudflareAccessApplication({
-      accountId: coordinates.accountId,
-      name: node.applicationName,
-      hostname: node.hostname,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    if (!application.application.id)
-      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
-    resources = {
-      ...resources,
-      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
-      access: {
-        ...resources.access,
-        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
-      }
-    };
-    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
-    createdNode.application = application.created;
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  await configureCloudflareWorkerAccessSecrets({
-    accountId: coordinates.accountId,
-    scriptName: coordinates.workerScriptName,
-    credentials: serviceToken.credentials,
-    apiToken: tokenFor(tokens, "workerApiToken")
-  }, fetcher);
-  for (const node of resources.nodes) {
+  for (const node of nodeResources) {
     await configureCloudflareEdge({
       accountId: coordinates.accountId,
       zoneId: coordinates.zoneId,
@@ -13588,21 +12674,24 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       dnsApiToken: tokenFor(tokens, "dnsApiToken")
     }, fetcher);
   }
+  const first = nodeResources[0];
   const output = {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap",
     phase: "complete",
     updatedAt: new Date().toISOString(),
     coordinates,
-    resources,
+    resources: {
+      tunnelId: first.tunnelId,
+      kvNamespaceId: coordinates.kvNamespaceId,
+      hostname: first.hostname,
+      service: first.service,
+      connectorToken: first.connectorToken,
+      kvRuntimeToken,
+      nodes: nodeResources
+    },
     created: {
       tunnel: createdNodes.some(({ tunnel }) => tunnel),
-      kvNamespace: namespace.created,
-      serviceToken: serviceToken.created,
-      policy: policy.created,
-      application: createdNodes.some(({ application }) => application),
-      privateNetwork: privateNetworkCreated,
-      workerDeployed: true,
       nodes: createdNodes
     }
   };
@@ -13610,99 +12699,73 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
   await writeCloudflareHostHandoffs(absoluteOutput, output);
   return output;
 }
-async function runAttendedCloudflareBootstrap(request2, dependencies = {}) {
-  const plan = planCloudflareBootstrap(request2.coordinates, request2.checkpointPath);
-  if (request2.mode === "plan") {
+async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
+  const plan = planCloudflareBootstrap(request.coordinates, request.checkpointPath);
+  if (request.mode === "plan") {
     return {
       format: 1,
       kind: "forgezero-cloudflare-bootstrap-evidence",
       phase: "planned",
       checkpointFile: plan.outputFile,
-      workerScriptName: plan.coordinates.workerScriptName,
-      publicDomains: plan.coordinates.publicDomains,
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
-  if (!request2.tokenFiles || !Object.values(request2.tokenFiles).some(Boolean)) {
+  if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
     throw new Error("Cloudflare apply requires owner-only management token file paths");
   }
-  if (plan.coordinates.createRuntimeTokens && !request2.tokenFiles.apiTokenFile) {
-    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
-  }
-  const tokens = await readCloudflareBootstrapTokens(request2.tokenFiles);
-  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-evidence",
     phase: "complete",
     checkpointFile: plan.outputFile,
     kvNamespaceId: output.resources.kvNamespaceId,
-    workerScriptName: output.coordinates.workerScriptName,
-    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
-    runtimeTokenIds: {
-      kv: output.resources.runtimeTokens?.kv.id,
-      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
-    },
-    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId }) => ({
       nodeName,
       hostname,
-      ...output.resources.runtimeTokens?.kv ? {
-        handoffFile: cloudflareHostHandoffPath(plan.outputFile, nodeName)
-      } : {},
-      tunnelId,
-      applicationId
+      handoffFile: cloudflareHostHandoffPath(plan.outputFile, nodeName),
+      tunnelId
     }))
   };
 }
+var acceptanceFetch = async (url, label, fetcher) => {
+  let response;
+  try {
+    response = await fetcher(url, { method: "GET", redirect: "manual", signal: AbortSignal.timeout(5000) });
+  } catch {
+    throw new Error(`${label} is unreachable`);
+  }
+  if (!response.ok)
+    throw new Error(`${label} returned HTTP ${response.status}`);
+  return response.status;
+};
 async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fetch) {
   const absolute = resolve2(checkpointPath);
   const output = await readExistingOutput(absolute);
   if (!output || output.phase !== "complete")
     throw new Error("Cloudflare acceptance requires a completed owner checkpoint");
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
-  const access = output.resources.access;
-  if (!access?.clientId?.trim() || !access.clientSecret?.trim()) {
-    throw new Error("Cloudflare acceptance checkpoint is missing the Access service credential");
-  }
-  if (!output.resources.worker?.deployed || output.resources.worker.scriptName !== coordinates.workerScriptName || JSON.stringify(output.resources.worker.publicDomains) !== JSON.stringify(coordinates.publicDomains)) {
-    throw new Error("Cloudflare acceptance checkpoint does not prove the expected Worker deployment");
-  }
   if (output.resources.nodes.length !== coordinates.nodes.length) {
     throw new Error("Cloudflare acceptance checkpoint does not cover the declared node fleet");
   }
-  const nodeNames = new Set;
-  const hostnames = new Set;
   for (const node of output.resources.nodes) {
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
-    if (!expected || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(node.tunnelId)) {
+    if (!expected || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(node.tunnelId)) {
       throw new Error("Cloudflare acceptance checkpoint has an unbound node resource");
     }
-    if (nodeNames.has(node.nodeName) || hostnames.has(node.hostname)) {
-      throw new Error("Cloudflare acceptance checkpoint has duplicate node coordinates");
-    }
-    nodeNames.add(node.nodeName);
-    hostnames.add(node.hostname);
   }
-  const accessHeaders = {
-    "CF-Access-Client-Id": access.clientId,
-    "CF-Access-Client-Secret": access.clientSecret
-  };
   const nodes = await Promise.all(output.resources.nodes.map(async ({ nodeName, hostname }) => ({
     nodeName,
     hostname,
-    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare origin ${nodeName}`, fetcher, accessHeaders)
-  })));
-  const publicDomains = await Promise.all(output.resources.worker.publicDomains.map(async (hostname) => ({
-    hostname,
-    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare public domain ${hostname}`, fetcher)
+    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare origin ${nodeName}`, fetcher)
   })));
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-acceptance",
     checkpointFile: absolute,
     verifiedAt: new Date().toISOString(),
-    nodes,
-    publicDomains
+    nodes
   };
 }
 
@@ -13788,6 +12851,18 @@ function validateBootstrapConfig(value) {
   if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
     throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
   }
+  const deploymentCredentials = value.deploymentCredentials ?? {};
+  if (!deploymentCredentials || typeof deploymentCredentials !== "object" || Array.isArray(deploymentCredentials) || Object.keys(deploymentCredentials).length > 64) {
+    throw new Error("deployment credentials must be a bounded name-to-path object");
+  }
+  for (const [name, path] of Object.entries(deploymentCredentials)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || typeof path !== "string" || !path.startsWith("/") || /[\r\n:]/.test(path) || !path.endsWith(".cred")) {
+      throw new Error(`deployment credential ${name} must map to an absolute encrypted .cred path`);
+    }
+  }
+  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
+    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  }
   if (value.kind === "tenant") {
     if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
       throw new Error("tenant realm is malformed");
@@ -13867,9 +12942,6 @@ function validateBootstrapConfig(value) {
   if (!["genesis-derived", "api-token"].includes(value.enrolment.source) || value.enrolment.source === "api-token" && !value.enrolment.tokenFile || value.enrolment.source === "genesis-derived" && value.enrolment.tokenFile) {
     throw new Error("platform enrolment source and token file disagree");
   }
-  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
-    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
-  }
   value.runtime.environment = runtime;
   return value;
 }
@@ -14121,7 +13193,7 @@ function bootstrapIdentity(config) {
   };
 }
 function bootstrapIdentityDigest(config) {
-  return createHash3("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 function parseStoredState(raw) {
   let value;
@@ -14199,7 +13271,7 @@ async function preparePlatformBootstrap(input, host = localBootstrapHost()) {
     next: "register this read-only deploy key, then run --apply concurrently on all three genesis Agency members"
   };
 }
-function stateFor(config) {
+function stateFor(config, cloudflare, previousCloudflareTunnelId) {
   return `${JSON.stringify({
     format: 2,
     kind: config.kind,
@@ -14220,7 +13292,11 @@ function stateFor(config) {
       healthPath: config.runtime.healthPath,
       cloudflare: config.runtime.environment.cloudflare,
       cloudflared: Boolean(config.cloudflareHandoff)
-    } : { realm: config.realm }
+    } : {
+      realm: config.realm,
+      cloudflared: Boolean(config.cloudflareHandoff),
+      cloudflareTunnelId: cloudflare?.tunnelId ?? previousCloudflareTunnelId
+    }
   }, null, 2)}
 `;
 }
@@ -14238,7 +13314,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     units.push("nginx.service");
   if (state.kind === "platform" && state.collectorUnit)
     units.push(state.collectorUnit);
-  if (state.kind === "platform" && state.cloudflared)
+  if (state.cloudflared)
     units.push("cloudflared.service");
   if (state.kind === "platform" && state.databaseRole !== "none")
     units.push("forgezero-db.service", "forgezero-db-verify.service");
@@ -14255,13 +13331,25 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (!services[socket])
       problems.push(`${socket} is missing`);
   }
+  if (state.cloudflared) {
+    for (const credential of [TUNNEL_CREDENTIAL, `${CREDS}/cloudflare-kv-token.cred`]) {
+      services[credential] = host.exists(credential);
+      if (!services[credential])
+        problems.push(`${credential} is missing`);
+    }
+    const tunnelId = state.cloudflare?.tunnelId ?? state.cloudflareTunnelId;
+    if (!tunnelId) {
+      services["cloudflared-tunnel"] = false;
+      problems.push("Cloudflare tunnel identity is missing from bootstrap state");
+    } else {
+      const evidence = await inspectCloudflaredTunnel(host, tunnelId);
+      services["cloudflared-tunnel"] = evidence.healthy;
+      if (!evidence.healthy)
+        problems.push(evidence.problem);
+    }
+  }
   if (state.kind === "platform") {
     if (state.cloudflared) {
-      for (const credential of [TUNNEL_CREDENTIAL, `${CREDS}/cloudflare-kv-token.cred`]) {
-        services[credential] = host.exists(credential);
-        if (!services[credential])
-          problems.push(`${credential} is missing`);
-      }
       if (state.cloudflare?.warp) {
         for (const credential of [
           `${CREDS}/cloudflare-network-token.cred`,
@@ -14273,15 +13361,6 @@ async function bootstrapStatus(host = localBootstrapHost()) {
             problems.push(`${credential} is missing`);
         }
       }
-      if (!state.cloudflare?.tunnelId) {
-        services["cloudflared-tunnel"] = false;
-        problems.push("Cloudflare tunnel identity is missing from bootstrap state");
-      } else {
-        const evidence = await inspectCloudflaredTunnel(host, state.cloudflare.tunnelId);
-        services["cloudflared-tunnel"] = evidence.healthy;
-        if (!evidence.healthy)
-          problems.push(evidence.problem);
-      }
     }
     const [blue, green] = await Promise.all([
       host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
@@ -14350,20 +13429,21 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
   let cloudflare;
-  if (config.kind === "platform" && config.cloudflareHandoff) {
+  if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
       cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.handoffFile, config.cloudflareHandoff.nodeName);
-    } else if (installed?.cloudflare) {
+    } else if (config.kind === "platform" && installed?.cloudflare) {
       config.runtime.environment.cloudflare = installed.cloudflare;
       config.runtime.environment = validatePlatformSharedEnvironment(config.runtime.environment);
-    } else {
+    } else if (!(config.kind === "tenant" && installed?.cloudflareTunnelId)) {
       throw new Error("node-specific Cloudflare host handoff is missing before credential sealing");
     }
   }
+  if (cloudflare && cloudflare.hostname !== config.nodeHostname) {
+    throw new Error("Cloudflare handoff hostname disagrees with node hostname");
+  }
   if (cloudflare && config.kind === "platform") {
     const expected = config.runtime.environment.cloudflare;
-    if (cloudflare.hostname !== config.nodeHostname)
-      throw new Error("Cloudflare handoff hostname disagrees with platform node hostname");
     if (expected && (cloudflare.service !== expected.tunnelService || cloudflare.accountId !== expected.accountId || cloudflare.zoneId !== expected.zoneId || cloudflare.kvNamespaceId !== expected.kvNamespaceId || cloudflare.tunnelId !== expected.tunnelId)) {
       throw new Error("Cloudflare handoff disagrees with immutable platform runtime coordinates");
     }
@@ -14405,6 +13485,9 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     await seal(host, "warp-auth-client-id", WARP_CLIENT_ID_CREDENTIAL, cloudflare.warp.clientId);
     await seal(host, "warp-auth-client-secret", WARP_CLIENT_SECRET_CREDENTIAL, cloudflare.warp.clientSecret);
   }
+  if (cloudflare && !host.exists(`${CREDS}/cloudflare-kv-token.cred`)) {
+    await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
+  }
   await host.installAgent(config);
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id: id2 }) => id2 === "ufw"));
@@ -14444,7 +13527,6 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       }
     }
     if (cloudflare) {
-      await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
       if (cloudflare.privateNetworkRuntimeToken)
         await seal(host, "cloudflare-network-token", `${CREDS}/cloudflare-network-token.cred`, cloudflare.privateNetworkRuntimeToken);
     }
@@ -14465,16 +13547,23 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       bluePort: runtime.bluePort,
       greenPort: runtime.greenPort,
       collectorUnit: runtime.environment.otlpCollectorUnit,
-      credentials
+      credentials,
+      capacityEnvironmentFile: "/etc/forgezero/capacity.env"
+    });
+    const edge = renderPlatformNginx({
+      publicPort: runtime.environment.publicApiPort,
+      initialSlotPort: runtime.bluePort,
+      concurrencyLimit: runtime.environment.concurrencyLimit,
+      workerDrainSeconds: Math.ceil(runtime.environment.drainDeadlineMs / 1000)
     });
-    const edge = renderPlatformNginx({ publicPort: runtime.environment.publicApiPort, initialSlotPort: runtime.bluePort });
     const activation = renderPlatformActivationFiles({
       root: config.deployRoot ?? "/opt/forgezero",
       serviceUser: runtime.serviceUser,
       bluePort: runtime.bluePort,
       greenPort: runtime.greenPort,
       healthPath: runtime.healthPath,
-      keepReleases: runtime.keepReleases
+      keepReleases: runtime.keepReleases,
+      drainDeadlineMs: runtime.environment.drainDeadlineMs
     });
     await checked(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
       await checked(host, ["id", runtime.serviceUser], "existing API service account");
@@ -14482,6 +13571,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
     host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
+    if (!host.exists("/etc/forgezero/capacity.env")) {
+      host.write("/etc/forgezero/capacity.env", `FZ_CONCURRENCY_LIMIT=${runtime.environment.concurrencyLimit}
+`, 420);
+    }
     await checked(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
     host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
     host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
@@ -14547,7 +13640,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
         host.remove(config.enrolment.tokenFile);
     }
   }
-  if (config.kind === "platform" && config.cloudflareHandoff) {
+  if (config.cloudflareHandoff) {
     if (!host.exists(TUNNEL_CREDENTIAL) && cloudflare) {
       await seal(host, "cloudflared-token", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
     }
@@ -14556,17 +13649,17 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
     await checked(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
     await checked(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
-    const tunnelId = config.runtime.environment.cloudflare?.tunnelId;
+    const tunnelId = cloudflare?.tunnelId ?? installed?.cloudflareTunnelId ?? (config.kind === "platform" ? config.runtime.environment.cloudflare?.tunnelId : undefined);
     if (!tunnelId)
       throw new Error("Cloudflare tunnel identity is missing after handoff validation");
     await waitForCloudflaredTunnel(host, tunnelId);
   }
-  host.write(STATE_PATH, stateFor(config), 384);
+  host.write(STATE_PATH, stateFor(config, cloudflare, installed?.cloudflareTunnelId), 384);
   const status = await bootstrapStatus(host);
   if (!status.initialized)
     throw new Error(`bootstrap verification failed: ${status.problems.join("; ")}`);
   host.remove(INTENT_PATH);
-  if (cloudflare && config.kind === "platform" && config.cloudflareHandoff) {
+  if (cloudflare && config.cloudflareHandoff) {
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
@@ -14614,6 +13707,7 @@ function strictBootstrapDocument(value) {
     "realm",
     "enrolTokenFile",
     "software",
+    "deploymentCredentials",
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
@@ -14680,9 +13774,11 @@ function strictBootstrapDocument(value) {
       exactKeys2(environment.cloudflare.warp, ["organization", "virtualNetworkId", "deviceProfileId"], "Cloudflare WARP runtime config");
     }
   } else if (root.kind === "tenant") {
+    if (root.cloudflareHandoff !== undefined)
+      exactKeys2(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
     if (root.bootstrapRunner !== undefined)
       exactKeys2(root.bootstrapRunner, ["sshPrivateKeyFile", "targetTelemetryEndpoint"], "bootstrap runner config");
-    for (const key of ["environment", "profile", "computeReference", "database", "enrolment", "runtime", "cloudflareHandoff"]) {
+    for (const key of ["environment", "profile", "computeReference", "database", "enrolment", "runtime"]) {
       if (root[key] !== undefined && key !== "profile")
         throw new Error(`tenant bootstrap cannot contain ${key}`);
     }
@@ -14771,6 +13867,7 @@ function localBootstrapHost() {
         branch: config.branch,
         profile: config.kind === "platform" ? config.profile : config.profile,
         deployRoot,
+        deploymentCredentials: config.deploymentCredentials,
         publicApiUrl: config.apiUrl,
         gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
         gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
@@ -14867,20 +13964,8 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
     "hostname",
     "service",
     "tunnelName",
-    "kvNamespaceTitle",
-    "workerScriptName",
-    "serviceTokenName",
-    "policyName",
-    "applicationName",
-    "workerDirectory",
-    "workerMain",
-    "workerCompatibilityDate",
-    "publicDomains",
-    "createRuntimeTokens",
-    "createPrivateNetworkRuntimeToken",
-    "runtimeTokenNamePrefix",
-    "nodes",
-    "privateNetwork"
+    "kvNamespaceId",
+    "nodes"
   ], "Cloudflare bootstrap coordinates");
   if (coordinateSource.nodes !== undefined) {
     if (!Array.isArray(coordinateSource.nodes))
@@ -14890,38 +13975,21 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
         "nodeName",
         "hostname",
         "service",
-        "tunnelName",
-        "applicationName",
-        "privateAddress"
+        "tunnelName"
       ], "Cloudflare bootstrap node");
     }
   }
-  if (coordinateSource.privateNetwork !== undefined) {
-    exactKeys3(record2(coordinateSource.privateNetwork, "Cloudflare bootstrap privateNetwork"), [
-      "warpOrganization",
-      "virtualNetworkName",
-      "deviceProfileName",
-      "enrollmentApplicationName",
-      "deviceProfilePrecedence"
-    ], "Cloudflare bootstrap privateNetwork");
-  }
-  if (typeof coordinateSource.workerDirectory !== "string" || !coordinateSource.workerDirectory.trim()) {
-    throw new Error("Cloudflare bootstrap coordinates.workerDirectory is required");
-  }
-  const coordinates = validateCloudflareBootstrapCoordinates({
-    ...coordinateSource,
-    workerDirectory: resolve3(baseDirectory, coordinateSource.workerDirectory)
-  });
+  const coordinates = validateCloudflareBootstrapCoordinates(coordinateSource);
   let tokenFiles;
   if (input.tokenFiles !== undefined) {
     const source = record2(input.tokenFiles, "Cloudflare bootstrap tokenFiles");
     const keys = [
       "apiTokenFile",
+      "managementApiTokenFile",
+      "runtimeApiTokenFile",
       "tunnelApiTokenFile",
       "dnsApiTokenFile",
-      "kvApiTokenFile",
-      "accessApiTokenFile",
-      "workerApiTokenFile"
+      "kvApiTokenFile"
     ];
     exactKeys3(source, keys, "Cloudflare bootstrap tokenFiles");
     for (const key of keys) {
@@ -14942,8 +14010,8 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
   };
 }
 async function runCloudflareBootstrapCommand(configPath, apply, dependencies = {}) {
-  const request2 = readCloudflareBootstrapCommandConfig(configPath, apply ? "apply" : "plan");
-  const evidence = await (dependencies.run ?? runAttendedCloudflareBootstrap)(request2);
+  const request = readCloudflareBootstrapCommandConfig(configPath, apply ? "apply" : "plan");
+  const evidence = await (dependencies.run ?? runAttendedCloudflareBootstrap)(request);
   (dependencies.write ?? ((text3) => process.stdout.write(text3)))(`${JSON.stringify(evidence, null, 2)}
 `);
   return evidence;
@@ -14956,7 +14024,7 @@ async function runCloudflareBootstrapVerificationCommand(checkpointPath, depende
 }
 
 // src/metal-bootstrap.ts
-import { createHash as createHash4, randomBytes as randomBytes8 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes8 } from "crypto";
 import {
   chmodSync as chmodSync3,
   chownSync,
@@ -14973,7 +14041,7 @@ import {
   writeFileSync as writeFileSync6
 } from "fs";
 import { dirname as dirname7, isAbsolute as isAbsolute2, join as join8, resolve as resolve4 } from "path";
-import { isIP as isIP5 } from "net";
+import { isIP as isIP3 } from "net";
 
 // src/metal-isolation.ts
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
@@ -14981,7 +14049,7 @@ import { join as join7 } from "path";
 
 // src/metal-provision.ts
 import { dirname as dirname6, isAbsolute, join as join6 } from "path";
-import { isIP as isIP4 } from "net";
+import { isIP as isIP2 } from "net";
 
 // src/ubuntu.ts
 var SUPPORTED_GUEST_IMAGE = Object.freeze({
@@ -15039,7 +14107,7 @@ function validateMetalProfile(profile) {
   } catch {
     throw new MetalProvisionError("Agent telemetry endpoint must be an absolute public HTTPS URL");
   }
-  if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP4(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
+  if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP2(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
     throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
   if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
@@ -15291,13 +14359,13 @@ function validateMetalBootstrapConfig(config) {
   } catch {
     throw new MetalBootstrapError("metal API must be a public HTTPS origin");
   }
-  if (api.protocol !== "https:" || api.username || api.password || api.pathname !== "/" || api.search || api.hash || isIP5(api.hostname) !== 0 || !api.hostname.includes(".") || api.hostname.endsWith(".local")) {
+  if (api.protocol !== "https:" || api.username || api.password || api.pathname !== "/" || api.search || api.hash || isIP3(api.hostname) !== 0 || !api.hostname.includes(".") || api.hostname.endsWith(".local")) {
     throw new MetalBootstrapError("metal API must be a credential-free public HTTPS origin");
   }
-  if (config.profile.nameservers?.some((address) => isIP5(address) === 0)) {
+  if (config.profile.nameservers?.some((address) => isIP3(address) === 0)) {
     throw new MetalBootstrapError("metal nameservers must be literal IP addresses");
   }
-  if (isIP5(`${config.profile.subnetPrefix}.1`) !== 4 || isIP5(config.profile.gateway) !== 4 || !config.profile.gateway.startsWith(`${config.profile.subnetPrefix}.`)) {
+  if (isIP3(`${config.profile.subnetPrefix}.1`) !== 4 || isIP3(config.profile.gateway) !== 4 || !config.profile.gateway.startsWith(`${config.profile.subnetPrefix}.`)) {
     throw new MetalBootstrapError("metal gateway must be an IPv4 address in the reviewed subnet");
   }
   if (config.profile.confidential && (!Number.isSafeInteger(config.profile.confidential.cbitpos) || config.profile.confidential.cbitpos < 1 || config.profile.confidential.cbitpos > 63 || !Number.isSafeInteger(config.profile.confidential.reducedPhysBits) || config.profile.confidential.reducedPhysBits < 0 || config.profile.confidential.reducedPhysBits > 63 || !/^0x[0-9a-fA-F]{1,16}$/.test(config.profile.confidential.policy)))
@@ -15714,7 +14782,7 @@ async function applyMetalBootstrap(config, options) {
     initializedAt: new Date().toISOString(),
     role: "metal",
     metalHostname: config.metalHostname,
-    profileSha256: createHash4("sha256").update(JSON.stringify(config.profile)).digest("hex")
+    profileSha256: createHash3("sha256").update(JSON.stringify(config.profile)).digest("hex")
   };
   atomicWrite2(STATE_PATH2, `${JSON.stringify(state, null, 2)}
 `, 384);
@@ -15741,7 +14809,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
       const { metalHostname: profileHostname, hostTelemetryEndpoint, hostTelemetryUnit, ...profile } = persisted;
       validateMetalProfile(profile);
       profileValid = true;
-      profileSha256 = createHash4("sha256").update(JSON.stringify(profile)).digest("hex");
+      profileSha256 = createHash3("sha256").update(JSON.stringify(profile)).digest("hex");
       if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(profileHostname) || hostTelemetryEndpoint !== "http://127.0.0.1:4318") {
         problems.push("persisted metal host coordinates are invalid");
       }
@@ -16020,27 +15088,6 @@ async function api(options, path, init) {
     body = null;
   }
   const challenge = body?.security;
-  if (response.status === 428 && challenge?.scope === "action" && challenge.requestKey && custodyIdentity && !path.startsWith("/security/step-up/")) {
-    const proved = await proveWithAgent(options, challenge.requestKey);
-    if (proved) {
-      const replay = await fetch(`${options.api}${base}${path}`, {
-        method: init?.method ?? "GET",
-        headers: {
-          ...requestHeaders(options.api, sessionCookie),
-          "x-security-request-key": challenge.requestKey
-        },
-        body: init?.body === undefined ? undefined : JSON.stringify(init.body)
-      });
-      captureSession(replay);
-      let replayed = null;
-      try {
-        replayed = await replay.json();
-      } catch {
-        replayed = null;
-      }
-      return { status: replay.status, body: replayed };
-    }
-  }
   if (response.status === 428 && challenge?.scope === "action" && challenge.requestKey && storedSession && !path.startsWith("/security/step-up/")) {
     const proved = await proveWithBrowser(options, challenge.requestKey, base);
     if (proved) {
@@ -16124,27 +15171,6 @@ async function proveWithBrowser(options, requestKey, base) {
   }
   return false;
 }
-var custodyIdentity = null;
-function useCustodyIdentity(identity, socketPath) {
-  custodyIdentity = { identity, socketPath };
-}
-async function proveWithAgent(options, requestKey) {
-  if (!custodyIdentity)
-    return false;
-  const begun = await api(options, "/security/step-up/ssh/begin", {
-    method: "POST",
-    body: { requestKey }
-  });
-  const nonce = begun.body?.nonce;
-  if (begun.status !== 200 || !nonce)
-    return false;
-  const signature = await signWithIdentity(custodyIdentity.identity, new Uint8Array(Buffer.from(nonce, "base64")), custodyIdentity.socketPath);
-  const proved = await api(options, "/security/step-up/ssh/prove", {
-    method: "POST",
-    body: { requestKey, signature: Buffer.from(signature).toString("base64") }
-  });
-  return proved.status === 200;
-}
 function hydrateSession(options) {
   const active = activeSession();
   if (!options.apiExplicit && active)
@@ -16373,37 +15399,6 @@ async function cmdApi(options, args) {
     return 1;
   }
 }
-async function cmdKeys(options) {
-  const identities = await usableIdentities(options.socket);
-  if (options.json) {
-    out.line(JSON.stringify(identities.map(({ fingerprint, comment, responseMs }) => ({
-      fingerprint,
-      comment,
-      responseMs
-    })), null, 2));
-    return 0;
-  }
-  if (identities.length === 0) {
-    out.fail("No usable Ed25519 keys in the agent.");
-    out.line();
-    out.step("Custody needs a key that signs DETERMINISTICALLY, so Ed25519 only.");
-    out.step("Add one with:  ssh-add ~/.ssh/id_ed25519");
-    out.line();
-    out.step("Note that keys which hang \u2014 forwarded agents whose upstream is");
-    out.step("gone, or confirm-on-use keys with nobody at the terminal \u2014 are");
-    out.step("skipped here rather than listed, so this can be shorter than");
-    out.step("`ssh-add -l`.");
-    return 1;
-  }
-  out.line("Usable custody keys:");
-  out.line();
-  identities.forEach((identity, index) => {
-    out.line(`  ${index + 1}.  ${identity.fingerprint}`);
-    out.line(`      ${identity.comment || "(no comment)"}   ${identity.responseMs}ms`);
-  });
-  out.line();
-  return 0;
-}
 async function cmdStatus(options) {
   try {
     const health = await api(options, "/health");
@@ -16704,7 +15699,7 @@ function interactiveBootstrap(kind) {
 async function cmdBootstrap(options, args) {
   try {
     const operation = args[0] ?? "status";
-    if (operation === "platform" && args[1] === "cloudflare") {
+    if ((operation === "platform" || operation === "tenant") && args[1] === "cloudflare") {
       if (!options.bootstrapConfigPath) {
         throw new Error("Cloudflare bootstrap requires --bootstrap-config <owner-only-cloudflare-json>");
       }
@@ -16781,7 +15776,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "tenant", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap platform [prepare|cloudflare [verify]]|tenant|metal|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap platform [prepare|cloudflare [verify]]|tenant [cloudflare [verify]]|metal|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -17186,7 +16181,6 @@ function usage() {
 	 fz api <method> <path>  Use any authorized realm API from a project or AI agent
 	 fz ui routes [search]   Discover the current account's authorized UI actions
 	 fz ui <method> <path>   Run an authorized UI action without visiting the site
-    fz keys                 List agent keys usable for custody
     fz status               Platform, ceremony and vault state
 	 fz genesis              Open first-founder onboarding, link this CLI, then
 	                         continue the custodian ceremony in the browser
@@ -17203,12 +16197,14 @@ function usage() {
 	                         Generate the machine deploy key before private Git deployment
 	 fz bootstrap platform   Install/repair a typed elastic platform compute
 	 fz bootstrap platform cloudflare
-	                         Plan/apply token-file-only KV, Worker, Access, DNS
-	                         and one Tunnel per explicit platform API node
+	                         Plan/apply attended Tunnel and DNS reconciliation
+	                         using supplied management and KV runtime token files
 	 fz bootstrap platform cloudflare verify
-	                         From the operator laptop, prove every Access origin
-	                         and stable Worker /api/health using the 0600 checkpoint
+	                         From the operator laptop, prove every ordinary public
+	                         node /api/health using the 0600 checkpoint
 	 fz bootstrap tenant     Install/enrol reusable tenant compute tooling
+	 fz bootstrap tenant cloudflare
+	                         Use the same attended Tunnel/DNS resource phase for tenant origins
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
 	 fz bootstrap status     Verify persisted profile and supervised units
 	 fz bootstrap repair     Reapply an explicitly supplied reviewed config
@@ -17287,8 +16283,8 @@ function usage() {
     fz unlock opens the signed-in custodian's own phrase envelope. Supply the
     24-word BIP-39 phrase by owner-only file or stdin; it is never accepted in
     argv. Each custodian runs it in their own authenticated session; no process
-    collects several custodians' phrases. SSH identities can prove fresh CLI
-    actions, but cannot open the distinct WebAuthn-PRF custody envelope.
+    collects several custodians' phrases. Fresh privileged actions use the
+    browser passkey/TOTP flow; SSH is transport and Git interoperability only.
 `);
 }
 if (import.meta.main) {
@@ -17320,9 +16316,6 @@ async function runCli() {
     case "ui":
       code = await cmdApi(options, args);
       break;
-    case "keys":
-      code = await cmdKeys(options);
-      break;
     case "status":
       code = await cmdStatus(options);
       break;
@@ -17367,7 +16360,6 @@ async function runCli() {
   process.exit(code);
 }
 export {
-  useCustodyIdentity,
   targetCoordinate,
   safeApiPath,
   requestHeaders