@forgezero/agent 0.1.39 → 0.1.41

package/dist/bootstrap.js

@@ -130,23 +130,32 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
   const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
   const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
-  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
-  const existing = current.config?.ingress ?? [];
-  const catchAll = existing.filter((rule) => !("hostname" in rule));
-  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
-  await cf(tunnelAuth, tunnelPath, {
-    method: "PUT",
-    body: JSON.stringify({ config: { ingress: [
-      { hostname: config.hostname, service: config.service },
-      ...otherHosts,
-      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
-    ] } })
-  }, fetcher);
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
-  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  const [current, records] = await Promise.all([
+    cf(tunnelAuth, tunnelPath, {}, fetcher),
+    cf(dnsAuth, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
+  ]);
   if (records.length > 1) {
     throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
   }
+  const existingRecord = records[0];
+  if (existingRecord && (existingRecord.type !== "CNAME" || existingRecord.name && existingRecord.name.toLowerCase() !== config.hostname.toLowerCase())) {
+    throw new Error(`Cloudflare DNS hostname ${config.hostname} is already owned by an incompatible ${existingRecord.type ?? "unknown"} record`);
+  }
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  const desiredIngress = [
+    { hostname: config.hostname, service: config.service },
+    ...otherHosts,
+    ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+  ];
+  if (JSON.stringify(existing) !== JSON.stringify(desiredIngress)) {
+    await cf(tunnelAuth, tunnelPath, {
+      method: "PUT",
+      body: JSON.stringify({ config: { ingress: desiredIngress } })
+    }, fetcher);
+  }
   const record = {
     type: "CNAME",
     name: config.hostname,
@@ -154,233 +163,13 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
     proxied: true,
     ttl: 1
   };
-  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
-    method: records[0] ? "PUT" : "POST",
-    body: JSON.stringify(record)
-  }, fetcher);
-}
-var exactAccountPermissionGroup = async (config, name, fetcher) => {
-  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
-  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
-  if (matches.length !== 1) {
-    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
-  }
-  return { id: matches[0].id, name };
-};
-async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
-  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
-    throw new Error("Cloudflare account id is invalid");
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
-    throw new Error("Cloudflare account runtime-token name is invalid");
-  }
-  const permissionNames = [...new Set(config.permissionNames)];
-  if (permissionNames.length === 0)
-    throw new Error("Cloudflare account runtime token needs a permission group");
-  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
-  const body = {
-    name,
-    policies: [{
-      effect: "allow",
-      permission_groups: permissionGroups.map(({ id }) => ({ id })),
-      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
-    }]
-  };
-  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
-  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
-    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
-  }
-  return { id: created.id, value: created.value, name, permissionNames };
-}
-async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare Access service-token name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/service_tokens`;
-  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = tokens.filter((token) => token.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
-  if (matches[0]) {
-    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
-      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
-    }
-    return { credentials: config.existing, created: false };
-  }
-  const created = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
-  }, fetcher);
-  if (!created.id || !created.client_id || !created.client_secret) {
-    throw new Error("Cloudflare did not return the new Access service-token secret");
-  }
-  return {
-    credentials: {
-      tokenId: created.id,
-      clientId: created.client_id,
-      clientSecret: created.client_secret
-    },
-    created: true
-  };
-}
-async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/policies`;
-  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === config.name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
-  const desired = {
-    name: config.name,
-    decision: "non_identity",
-    include: [{ service_token: { token_id: config.serviceTokenId } }]
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
-    method: matches[0] ? "PUT" : "POST",
-    body: JSON.stringify(desired)
-  }, fetcher);
-  return { policy, created: !matches[0] };
-}
-async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
-  const desired = {
-    name: config.name,
-    type: "self_hosted",
-    domain: config.hostname,
-    session_duration: "24h",
-    service_auth_401_redirect: true,
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare WARP enrollment application name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
-  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
-    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
-  }
-  const desired = {
-    name,
-    type: "warp",
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!application.id || application.type && application.type !== "warp") {
-    throw new Error("Cloudflare did not return the WARP enrollment application");
-  }
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare VNET name is invalid");
-  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
-  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
-  if (matches[0])
-    return { virtualNetwork: matches[0], created: false };
-  const virtualNetwork = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
-  }, fetcher);
-  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
-    throw new Error("Cloudflare did not return the VNET id");
-  }
-  return { virtualNetwork, created: true };
-}
-async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare WARP device profile name is invalid");
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
-    throw new Error("Cloudflare service-token id is invalid");
-  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
-    throw new Error("Cloudflare VNET id is invalid");
-  const precedence = config.precedence ?? 100;
-  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
-    throw new Error("Cloudflare WARP device profile precedence is invalid");
-  }
-  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
-  const listPath = `/accounts/${config.accountId}/devices/policies`;
-  const path = `/accounts/${config.accountId}/devices/policy`;
-  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
-  if (matches[0]?.match && matches[0].match !== match) {
-    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
-  }
-  const desired = {
-    name,
-    match,
-    precedence,
-    description: "ForgeZero non-interactive compute enrollment",
-    enabled: true,
-    allow_mode_switch: false,
-    allowed_to_leave: false,
-    auto_connect: 0,
-    switch_locked: true,
-    service_mode_v2: { mode: "warp" },
-    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!policy.id)
-    throw new Error("Cloudflare did not return the WARP device profile id");
-  return { policy, created: !matches[0] };
-}
-async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
-    throw new Error("Cloudflare Worker script name is invalid");
-  }
-  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
-    method: "PATCH",
-    body: JSON.stringify({
-      secrets: {
-        CF_ACCESS_CLIENT_ID: {
-          name: "CF_ACCESS_CLIENT_ID",
-          type: "secret_text",
-          text: config.credentials.clientId
-        },
-        CF_ACCESS_CLIENT_SECRET: {
-          name: "CF_ACCESS_CLIENT_SECRET",
-          type: "secret_text",
-          text: config.credentials.clientSecret
-        }
-      }
-    })
-  }, fetcher);
-}
-async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
-  const title = config.title.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
-    throw new Error("Cloudflare KV namespace title is invalid");
+  const dnsAlreadyCorrect = existingRecord?.type === record.type && existingRecord.name?.toLowerCase() === record.name.toLowerCase() && existingRecord.content?.toLowerCase() === record.content.toLowerCase() && existingRecord.proxied === true && existingRecord.ttl === 1;
+  if (!dnsAlreadyCorrect) {
+    await cf(dnsAuth, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
+      method: existingRecord ? "PUT" : "POST",
+      body: JSON.stringify(record)
+    }, fetcher);
   }
-  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
-  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = namespaces.filter((namespace2) => namespace2.title === title);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
-  if (matches[0])
-    return { namespace: matches[0], created: false };
-  const namespace = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ title })
-  }, fetcher);
-  return { namespace, created: true };
 }
 async function ensureCloudflareTunnel(config, fetcher = fetch) {
   const name = config.name.trim();
@@ -406,27 +195,13 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { chmod, lstat, mkdir, mkdtemp, open, rename, rm, stat, unlink } from "fs/promises";
-import { dirname, join, resolve } from "path";
-import { tmpdir } from "os";
 import { randomUUID } from "crypto";
-import { isIP as isIP2 } from "net";
-var acceptanceFetch = async (url, label, fetcher, headers) => {
-  let response;
-  try {
-    response = await fetcher(url, {
-      method: "GET",
-      headers,
-      redirect: "manual",
-      signal: AbortSignal.timeout(5000)
-    });
-  } catch {
-    throw new Error(`${label} is unreachable`);
-  }
-  if (!response.ok)
-    throw new Error(`${label} returned HTTP ${response.status}`);
-  return response.status;
-};
+import { chmod, lstat, mkdir, open, rename, stat, unlink } from "fs/promises";
+import { dirname, join, resolve } from "path";
+var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
+var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -435,8 +210,9 @@ async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   if (metadata.nlink !== 1)
     throw new Error(`${path} must not have multiple hard links`);
   const uid = ownerUid();
-  if (uid !== undefined && uid !== 0 && metadata.uid !== uid)
+  if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`${path} must be owned by the current operator`);
+  }
   if ((metadata.mode & 63) !== 0)
     throw new Error(`${path} must not be accessible by group or other users`);
   if ((metadata.mode & 256) === 0)
@@ -461,25 +237,36 @@ async function readOwnerOnlyFile(path, maximumBytes) {
 }
 async function readOwnerApiToken(path) {
   const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!/^[A-Za-z0-9._-]{40,80}$/.test(token)) {
+  if (!TOKEN.test(token))
     throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
-  }
   return token;
 }
 async function readCloudflareBootstrapTokens(files) {
   const entries = await Promise.all([
     ["apiToken", files.apiTokenFile],
+    ["managementApiToken", files.managementApiTokenFile],
+    ["runtimeApiToken", files.runtimeApiTokenFile],
     ["tunnelApiToken", files.tunnelApiTokenFile],
     ["dnsApiToken", files.dnsApiTokenFile],
-    ["kvApiToken", files.kvApiTokenFile],
-    ["accessApiToken", files.accessApiTokenFile],
-    ["workerApiToken", files.workerApiTokenFile]
+    ["kvApiToken", files.kvApiTokenFile]
   ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
-  const tokens = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
-  const unified = tokens.apiToken;
-  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken", "accessApiToken", "workerApiToken"]) {
-    if (!tokens[key] && !unified)
-      throw new Error(`Cloudflare ${key} file is required when --token-file is omitted`);
+  const supplied = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
+  const tokens = {
+    ...supplied.apiToken ? { apiToken: supplied.apiToken } : {},
+    ...supplied.tunnelApiToken || supplied.managementApiToken ? {
+      tunnelApiToken: supplied.tunnelApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.dnsApiToken || supplied.managementApiToken ? {
+      dnsApiToken: supplied.dnsApiToken ?? supplied.managementApiToken
+    } : {},
+    ...supplied.kvApiToken || supplied.runtimeApiToken ? {
+      kvApiToken: supplied.kvApiToken ?? supplied.runtimeApiToken
+    } : {}
+  };
+  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken"]) {
+    if (!tokens[key] && !tokens.apiToken) {
+      throw new Error(`Cloudflare ${key} file is required when apiTokenFile is omitted`);
+    }
   }
   return tokens;
 }
@@ -489,36 +276,30 @@ var validateId = (value, label) => {
     throw new Error(`${label} must be a 32-character hexadecimal id`);
   return normalized;
 };
-var validateName = (value, label, maximum, allowSpaces = true) => {
+var validateName = (value, label) => {
   const normalized = value.trim();
-  const pattern = allowSpaces ? /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/ : /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-  if (!normalized || normalized.length > maximum || !pattern.test(normalized)) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(normalized))
     throw new Error(`${label} is invalid`);
-  }
   return normalized;
 };
-var privateAddress = (value) => {
-  const address = value.trim().toLowerCase();
-  const family = isIP2(address);
-  if (family === 4) {
-    const [a, b] = address.split(".").map(Number);
-    if (a === 10 || a === 192 && b === 168 || a === 172 && b >= 16 && b <= 31)
-      return address;
+var normalizeService = (value) => {
+  let service;
+  try {
+    service = new URL(value);
+  } catch {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
   }
-  if (family === 6) {
-    const first = Number.parseInt(address.split(":", 1)[0], 16);
-    if (Number.isFinite(first) && (first & 65024) === 64512)
-      return address;
+  if (service.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(service.hostname) || !service.port || service.pathname !== "/" || service.username || service.password || service.search || service.hash) {
+    throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
   }
-  throw new Error("Cloudflare private database address must be RFC 1918 IPv4 or unique-local IPv6");
+  return service.toString().replace(/\/$/, "");
 };
 function validateCloudflareBootstrapCoordinates(input) {
   const nodeInputs = input.nodes?.length ? input.nodes : [{
     nodeName: input.tunnelName,
     hostname: input.hostname,
     service: input.service,
-    tunnelName: input.tunnelName,
-    applicationName: input.applicationName
+    tunnelName: input.tunnelName
   }];
   if (nodeInputs.length < 1 || nodeInputs.length > 32) {
     throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
@@ -528,88 +309,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
       throw new Error("Cloudflare node name is invalid");
     const hostname = node.hostname.trim().toLowerCase();
-    if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname)) {
+    if (!HOSTNAME.test(hostname))
       throw new Error("Cloudflare public node hostname is invalid");
-    }
-    const serviceUrl = new URL(node.service);
-    if (serviceUrl.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(serviceUrl.hostname) || !serviceUrl.port || serviceUrl.pathname !== "/" || serviceUrl.search || serviceUrl.hash) {
-      throw new Error("Cloudflare Tunnel service must be an explicit loopback HTTP port");
-    }
     return {
       nodeName,
       hostname,
-      service: serviceUrl.toString().replace(/\/$/, ""),
-      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name", 100, false),
-      applicationName: validateName(node.applicationName, "Cloudflare Access application name", 100),
-      ...node.privateAddress ? { privateAddress: privateAddress(node.privateAddress) } : {}
+      service: normalizeService(node.service),
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name")
     };
   });
   for (const [label, values] of [
     ["node name", nodes.map(({ nodeName }) => nodeName)],
     ["hostname", nodes.map(({ hostname }) => hostname)],
-    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)],
-    ["Access application name", nodes.map(({ applicationName }) => applicationName)]
+    ["Tunnel name", nodes.map(({ tunnelName }) => tunnelName)]
   ]) {
     if (new Set(values).size !== values.length)
       throw new Error(`Cloudflare fleet ${label} must be unique`);
   }
   const first = nodes[0];
-  const workerScriptName = input.workerScriptName.trim();
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(workerScriptName))
-    throw new Error("Cloudflare Worker script name is invalid");
-  const workerCompatibilityDate = input.workerCompatibilityDate.trim();
-  if (!/^20\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/.test(workerCompatibilityDate)) {
-    throw new Error("Cloudflare Worker compatibility date is invalid");
-  }
-  const publicDomains = [...new Set(input.publicDomains.map((domain) => domain.trim().toLowerCase()))];
-  if (publicDomains.length < 1 || publicDomains.length > 10 || publicDomains.some((domain) => !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(domain) || nodes.some(({ hostname }) => hostname === domain))) {
-    throw new Error("Cloudflare Worker public domains are invalid or include the private origin hostname");
-  }
-  const workerDirectory = resolve(input.workerDirectory);
-  const workerMain = input.workerMain.trim();
-  if (!workerMain || workerMain.startsWith("/") || workerMain.split(/[\\/]/).includes("..")) {
-    throw new Error("Cloudflare Worker main must be a project-relative path");
-  }
-  const runtimeTokenNamePrefix = input.runtimeTokenNamePrefix.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/.test(runtimeTokenNamePrefix)) {
-    throw new Error("Cloudflare runtime-token name prefix is invalid");
-  }
-  if (input.createPrivateNetworkRuntimeToken && !input.createRuntimeTokens) {
-    throw new Error("private-network runtime token requires runtime-token creation");
-  }
-  const privateNetwork = input.privateNetwork ? {
-    warpOrganization: validateName(input.privateNetwork.warpOrganization, "Cloudflare WARP organization", 63, false).toLowerCase(),
-    virtualNetworkName: validateName(input.privateNetwork.virtualNetworkName, "Cloudflare VNET name", 100),
-    deviceProfileName: validateName(input.privateNetwork.deviceProfileName, "Cloudflare WARP device profile name", 100),
-    enrollmentApplicationName: validateName(input.privateNetwork.enrollmentApplicationName, "Cloudflare WARP enrollment application name", 100),
-    ...input.privateNetwork.deviceProfilePrecedence !== undefined ? { deviceProfilePrecedence: input.privateNetwork.deviceProfilePrecedence } : {}
-  } : undefined;
-  if (privateNetwork && (!input.createPrivateNetworkRuntimeToken || nodes.every((node) => !node.privateAddress))) {
-    throw new Error("Cloudflare private network requires its runtime token and at least one DB node private address");
-  }
-  if (!privateNetwork && nodes.some((node) => node.privateAddress)) {
-    throw new Error("Cloudflare node private addresses require privateNetwork coordinates");
-  }
   return {
     accountId: validateId(input.accountId, "Cloudflare account id"),
     zoneId: validateId(input.zoneId, "Cloudflare zone id"),
     hostname: first.hostname,
     service: first.service,
     tunnelName: first.tunnelName,
-    kvNamespaceTitle: validateName(input.kvNamespaceTitle, "Cloudflare KV namespace title", 128, false),
-    workerScriptName,
-    serviceTokenName: validateName(input.serviceTokenName, "Cloudflare Access service-token name", 100),
-    policyName: validateName(input.policyName, "Cloudflare Access policy name", 100),
-    applicationName: first.applicationName,
-    workerDirectory,
-    workerMain,
-    workerCompatibilityDate,
-    publicDomains,
-    createRuntimeTokens: input.createRuntimeTokens,
-    createPrivateNetworkRuntimeToken: input.createPrivateNetworkRuntimeToken,
-    runtimeTokenNamePrefix,
-    nodes,
-    ...privateNetwork ? { privateNetwork } : {}
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    nodes
   };
 }
 function planCloudflareBootstrap(input, outputPath) {
@@ -621,120 +346,18 @@ function planCloudflareBootstrap(input, outputPath) {
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
-      "create or reuse one Workers KV namespace",
       "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
-      ...coordinates.createRuntimeTokens ? [
-        "create exact-account least-privilege runtime tokens and checkpoint their one-time values"
-      ] : [],
-      "deploy the shared Worker once with the created NODES binding and stable custom domains",
-      "create or reuse one shared Access service token/policy and one self-hosted application per node",
-      ...coordinates.privateNetwork ? [
-        "create or reuse the VNET, WARP enrollment application, locked service-token device profile and exact DB host routes"
-      ] : [],
-      "write the Access client id and secret to the existing Worker as encrypted secrets",
-      "reconcile each node ingress rule and proxied CNAME only after all Access applications are ready"
+      "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
+      "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
+      "write one node-specific handoff containing the connector token and owner-supplied KV-write token"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never written to output",
-      "the output contains connector, Access and requested runtime credentials and is atomically written with mode 0600",
-      "the normal API process does not receive or import the management token files"
+      "API tokens are read only from owner-only files and are never placed in argv or stdout",
+      "the management token is never persisted; connector and KV runtime capabilities are atomically checkpointed with mode 0600",
+      "the normal API process receives only its KV-write token and never Tunnel or DNS management authority"
     ]
   };
 }
-var defaultWorkerCommandRunner = async ({ command, cwd, env }) => {
-  const child = Bun.spawn([...command], {
-    cwd,
-    env: { ...env },
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    child.exited,
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text()
-  ]);
-  return { exitCode, stdout, stderr };
-};
-var inheritedWorkerEnvironment = () => {
-  const allowed = [
-    "PATH",
-    "HOME",
-    "TMPDIR",
-    "XDG_CONFIG_HOME",
-    "XDG_CACHE_HOME",
-    "SSL_CERT_FILE",
-    "SSL_CERT_DIR",
-    "NODE_EXTRA_CA_CERTS",
-    "HTTPS_PROXY",
-    "HTTP_PROXY",
-    "NO_PROXY"
-  ];
-  return Object.fromEntries(allowed.flatMap((key) => process.env[key] ? [[key, process.env[key]]] : []));
-};
-var redact = (text, secrets) => {
-  let safe = text.slice(0, 4096);
-  for (const secret of secrets)
-    if (secret)
-      safe = safe.split(secret).join("[REDACTED]");
-  return safe.trim();
-};
-async function deployCloudflareWorker(coordinates, kvNamespaceId, apiToken, runner = defaultWorkerCommandRunner) {
-  const validated = validateCloudflareBootstrapCoordinates(coordinates);
-  const workerDirectoryMetadata = await stat(validated.workerDirectory);
-  if (!workerDirectoryMetadata.isDirectory())
-    throw new Error("Cloudflare Worker directory is not a directory");
-  const workerMain = resolve(validated.workerDirectory, validated.workerMain);
-  const workerMainMetadata = await stat(workerMain);
-  if (!workerMainMetadata.isFile())
-    throw new Error("Cloudflare Worker main is not a regular file");
-  const wrangler = resolve(validated.workerDirectory, "node_modules/.bin/wrangler");
-  const wranglerMetadata = await stat(wrangler);
-  if (!wranglerMetadata.isFile())
-    throw new Error("Cloudflare Wrangler is not installed in the Worker project");
-  if (!/^[a-f0-9]{32}$/.test(kvNamespaceId))
-    throw new Error("Cloudflare KV namespace id is invalid");
-  const temporaryDirectory = await mkdtemp(join(tmpdir(), "fz-wrangler-"));
-  await chmod(temporaryDirectory, 448);
-  const configurationPath = join(temporaryDirectory, "wrangler.json");
-  try {
-    const handle = await open(configurationPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 384);
-    try {
-      await handle.writeFile(`${JSON.stringify({
-        name: validated.workerScriptName,
-        main: workerMain,
-        compatibility_date: validated.workerCompatibilityDate,
-        workers_dev: false,
-        routes: validated.publicDomains.map((pattern) => ({ pattern, custom_domain: true })),
-        observability: { enabled: true },
-        kv_namespaces: [{ binding: "NODES", id: kvNamespaceId }]
-      }, null, 2)}
-`);
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    const result = await runner({
-      command: [wrangler, "deploy", "--config", configurationPath],
-      cwd: validated.workerDirectory,
-      env: {
-        ...inheritedWorkerEnvironment(),
-        XDG_CONFIG_HOME: temporaryDirectory,
-        XDG_CACHE_HOME: temporaryDirectory,
-        WRANGLER_LOG_PATH: join(temporaryDirectory, "wrangler.log"),
-        CLOUDFLARE_ACCOUNT_ID: validated.accountId,
-        CLOUDFLARE_API_TOKEN: apiToken,
-        WRANGLER_SEND_METRICS: "false"
-      }
-    });
-    if (result.exitCode !== 0) {
-      const detail = redact(result.stderr || result.stdout || "no Wrangler diagnostic", [apiToken]);
-      throw new Error(`Cloudflare Worker deployment failed with exit ${result.exitCode}: ${detail}`);
-    }
-  } finally {
-    await rm(temporaryDirectory, { recursive: true, force: true });
-  }
-}
 async function readExistingOutput(path) {
   try {
     await lstat(path);
@@ -743,13 +366,15 @@ async function readExistingOutput(path) {
       return;
     throw cause;
   }
-  const text = await readOwnerOnlyFile(path, 1048576);
-  let output;
+  let parsed;
   try {
-    output = JSON.parse(text);
-  } catch {
-    throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+    parsed = JSON.parse(await readOwnerOnlyFile(path, 1048576));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
+    throw cause;
   }
+  const output = parsed;
   if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
     throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
@@ -777,7 +402,7 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
   }
   const resource = matches[0];
-  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !resource.applicationId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(resource.tunnelId) || !/^[A-Za-z0-9._-]{40,16384}$/.test(resource.connectorToken)) {
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId) || !CONNECTOR_TOKEN.test(resource.connectorToken)) {
     throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
   }
   return {
@@ -817,44 +442,29 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   ].includes(key));
   if (unknown.length)
     throw new Error(`Cloudflare host handoff contains unsupported field ${unknown[0]}`);
-  if (output.warp) {
-    const unknownWarp = Object.keys(output.warp).filter((key) => ![
-      "organization",
-      "clientId",
-      "clientSecret",
-      "virtualNetworkId",
-      "deviceProfileId"
-    ].includes(key));
-    if (unknownWarp.length)
-      throw new Error(`Cloudflare host handoff WARP contains unsupported field ${unknownWarp[0]}`);
-  }
   const normalizedNodeName = nodeName.trim().toLowerCase();
   let service;
   try {
-    service = new URL(output.service ?? "");
+    service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "") || !/^[A-Za-z0-9._-]{40,80}$/.test(output.kvRuntimeToken ?? "") || !output.hostname || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(output.hostname) || !service || service.protocol !== "http:" || service.hostname !== "127.0.0.1" || !service.port || service.pathname !== "/" || service.username || service.password || service.search || service.hash || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(output.tunnelId ?? "") || !/^[A-Za-z0-9._-]{40,16384}$/.test(output.connectorToken ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.kvRuntimeToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
-  const network = output.privateNetworkRuntimeToken;
-  if (network !== undefined && !/^[A-Za-z0-9._-]{40,80}$/.test(network)) {
+  if (output.privateNetworkRuntimeToken !== undefined && !TOKEN.test(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network capability is malformed");
   }
-  if (Boolean(output.warp) !== Boolean(network)) {
+  if (Boolean(output.warp) !== Boolean(output.privateNetworkRuntimeToken)) {
     throw new Error("Cloudflare host handoff private-network resources and capability disagree");
   }
-  if (output.warp && (!output.warp.clientId || !output.warp.clientSecret || !/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(output.warp.organization) || !/^[0-9a-f-]{36}$/i.test(output.warp.virtualNetworkId) || !output.warp.deviceProfileId)) {
-    throw new Error("Cloudflare host handoff WARP enrollment is malformed");
-  }
   const { format: _format, kind: _kind, ...handoff } = output;
   return handoff;
 }
 async function prepareOwnerOutputDirectory(absolutePath) {
   const directory = dirname(absolutePath);
   await mkdir(directory, { recursive: true, mode: 448 });
-  const directoryMetadata = await stat(directory);
+  const metadata = await stat(directory);
   const uid = ownerUid();
-  if (!directoryMetadata.isDirectory() || uid !== undefined && directoryMetadata.uid !== uid || (directoryMetadata.mode & 18) !== 0) {
+  if (!metadata.isDirectory() || uid !== undefined && metadata.uid !== uid || (metadata.mode & 18) !== 0) {
     throw new Error(`bootstrap output directory ${directory} must be operator-owned and not group/other writable`);
   }
   return directory;
@@ -891,13 +501,6 @@ async function writeOwnerBootstrapOutput(path, output) {
   await writeOwnerJson(path, output);
 }
 async function writeCloudflareHostHandoffs(checkpointPath, output) {
-  const kv = output.resources.runtimeTokens?.kv?.value;
-  if (!kv || !/^[A-Za-z0-9._-]{40,80}$/.test(kv)) {
-    return;
-  }
-  const network = output.resources.runtimeTokens?.privateNetwork?.value;
-  const privateNetwork = output.resources.privateNetwork;
-  const access = output.resources.access;
   for (const node of output.resources.nodes) {
     const handoff = {
       format: 1,
@@ -910,34 +513,19 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      kvRuntimeToken: kv,
-      ...network ? { privateNetworkRuntimeToken: network } : {},
-      ...privateNetwork && access ? { warp: {
-        organization: privateNetwork.warpOrganization,
-        clientId: access.clientId,
-        clientSecret: access.clientSecret,
-        virtualNetworkId: privateNetwork.virtualNetworkId,
-        deviceProfileId: privateNetwork.deviceProfileId
-      } } : {}
+      kvRuntimeToken: output.resources.kvRuntimeToken
     };
     await writeOwnerJson(cloudflareHostHandoffPath(checkpointPath, node.nodeName), handoff);
   }
 }
 var tokenFor = (tokens, key) => {
   const token = tokens[key]?.trim() || tokens.apiToken?.trim();
-  if (!token)
+  if (!token || !TOKEN.test(token))
     throw new Error(`Cloudflare ${key} is not configured`);
   return token;
 };
-var initialManagementToken = (tokens) => {
-  const token = tokens.apiToken?.trim();
-  if (!token) {
-    throw new Error("initial Cloudflare --token-file is required to create account-owned runtime tokens");
-  }
-  return token;
-};
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch, workerRunner = defaultWorkerCommandRunner) {
+async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
   const existing = await readExistingOutput(absoluteOutput);
@@ -945,19 +533,18 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
   }
   await prepareOwnerOutputDirectory(absoluteOutput);
-  const namespace = await ensureCloudflareKvNamespace({
-    accountId: coordinates.accountId,
-    title: coordinates.kvNamespaceTitle,
-    apiToken: tokenFor(tokens, "kvApiToken")
-  }, fetcher);
+  const kvRuntimeToken = tokenFor(tokens, "kvApiToken");
   const nodeResources = [];
   const createdNodes = [];
-  let resources;
   for (const node of coordinates.nodes) {
     const checkpointed = existing?.resources.nodes?.find(({ nodeName }) => nodeName === node.nodeName);
+    let resource;
     let created = false;
     if (checkpointed) {
-      nodeResources.push(checkpointed);
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+        throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
+      }
+      resource = checkpointed;
     } else {
       const tunnel = await ensureCloudflareTunnel({
         accountId: coordinates.accountId,
@@ -965,234 +552,29 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         apiToken: tokenFor(tokens, "tunnelApiToken")
       }, fetcher);
       created = tunnel.created;
-      nodeResources.push({
-        nodeName: node.nodeName,
-        hostname: node.hostname,
-        service: node.service,
-        tunnelName: node.tunnelName,
-        tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken
-      });
-    }
-    createdNodes.push({ nodeName: node.nodeName, tunnel: created, application: false });
-    const firstNode = nodeResources[0];
-    resources = {
-      tunnelId: firstNode.tunnelId,
-      kvNamespaceId: namespace.namespace.id,
-      hostname: firstNode.hostname,
-      service: firstNode.service,
-      connectorToken: firstNode.connectorToken,
-      nodes: [...nodeResources],
-      ...existing?.resources.access ? { access: existing.resources.access } : {},
-      ...existing?.resources.runtimeTokens ? { runtimeTokens: existing.resources.runtimeTokens } : {},
-      ...existing?.resources.worker ? { worker: existing.resources.worker } : {},
-      ...existing?.resources.privateNetwork ? { privateNetwork: existing.resources.privateNetwork } : {}
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: resources.access ? "access-token-provisioned" : "edge-resources-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources)
-    throw new Error("Cloudflare fleet has no nodes");
-  if (coordinates.createRuntimeTokens && !resources.runtimeTokens) {
-    resources = {
-      ...resources,
-      runtimeTokens: { kv: await createCloudflareAccountRuntimeToken({
-        accountId: coordinates.accountId,
-        name: `${coordinates.runtimeTokenNamePrefix}-kv-runtime`,
-        permissionNames: ["Workers KV Storage Write"],
-        apiToken: initialManagementToken(tokens)
-      }, fetcher) }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (coordinates.createPrivateNetworkRuntimeToken && resources.runtimeTokens && !resources.runtimeTokens.privateNetwork) {
-    resources = {
-      ...resources,
-      runtimeTokens: {
-        ...resources.runtimeTokens,
-        privateNetwork: await createCloudflareAccountRuntimeToken({
-          accountId: coordinates.accountId,
-          name: `${coordinates.runtimeTokenNamePrefix}-private-network-runtime`,
-          permissionNames: ["Cloudflare One Networks Write", "Zero Trust Write"],
-          apiToken: initialManagementToken(tokens)
-        }, fetcher)
-      }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "runtime-tokens-created",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  if (!resources.worker) {
-    await deployCloudflareWorker(coordinates, namespace.namespace.id, tokenFor(tokens, "workerApiToken"), workerRunner);
-    resources = {
-      ...resources,
-      worker: {
-        scriptName: coordinates.workerScriptName,
-        publicDomains: coordinates.publicDomains,
-        deployed: true
-      }
-    };
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "worker-deployed",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
-    });
-  }
-  const serviceToken = await ensureCloudflareAccessServiceToken({
-    accountId: coordinates.accountId,
-    name: coordinates.serviceTokenName,
-    apiToken: tokenFor(tokens, "accessApiToken"),
-    existing: resources.access
-  }, fetcher);
-  resources = { ...resources, access: serviceToken.credentials };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  const policy = await ensureCloudflareAccessPolicy({
-    accountId: coordinates.accountId,
-    name: coordinates.policyName,
-    serviceTokenId: serviceToken.credentials.tokenId,
-    apiToken: tokenFor(tokens, "accessApiToken")
-  }, fetcher);
-  if (!policy.policy.id)
-    throw new Error("Cloudflare did not return the Access policy id");
-  resources = {
-    ...resources,
-    access: { ...serviceToken.credentials, policyId: policy.policy.id }
-  };
-  await writeOwnerBootstrapOutput(absoluteOutput, {
-    format: 1,
-    kind: "forgezero-cloudflare-bootstrap",
-    phase: "access-token-provisioned",
-    updatedAt: new Date().toISOString(),
-    coordinates,
-    resources
-  });
-  let privateNetworkCreated = false;
-  if (coordinates.privateNetwork && !resources.privateNetwork) {
-    const managementToken = initialManagementToken(tokens);
-    const virtualNetwork = await ensureCloudflareVirtualNetwork({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.virtualNetworkName,
-      comment: "ForgeZero private database network",
-      apiToken: managementToken
-    }, fetcher);
-    const enrollment = await ensureCloudflareWarpEnrollmentApplication({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.enrollmentApplicationName,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    const deviceProfile = await ensureCloudflareWarpDevicePolicy({
-      accountId: coordinates.accountId,
-      name: coordinates.privateNetwork.deviceProfileName,
-      serviceTokenId: serviceToken.credentials.tokenId,
-      virtualNetworkId: virtualNetwork.virtualNetwork.id,
-      precedence: coordinates.privateNetwork.deviceProfilePrecedence,
-      apiToken: managementToken
-    }, fetcher);
-    const routes = [];
-    for (const node of coordinates.nodes.filter((item) => item.privateAddress)) {
-      const resource = resources.nodes.find((item) => item.nodeName === node.nodeName);
-      const route = await ensureCloudflarePrivateDatabaseRoute({
-        accountId: coordinates.accountId,
-        tunnelId: resource.tunnelId,
-        privateAddress: node.privateAddress,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        comment: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      await ensureCloudflareWarpDatabaseInclude({
-        accountId: coordinates.accountId,
-        policyId: deviceProfile.policy.id,
-        privateAddress: node.privateAddress,
-        description: `ForgeZero ${node.nodeName} database`,
-        apiToken: managementToken
-      }, fetcher);
-      routes.push({ nodeName: node.nodeName, routeId: route.route.id, privateAddress: node.privateAddress });
+      resource = { ...node, tunnelId: tunnel.tunnel.id, connectorToken: tunnel.connectorToken };
     }
-    resources = {
-      ...resources,
-      privateNetwork: {
-        warpOrganization: coordinates.privateNetwork.warpOrganization,
-        virtualNetworkId: virtualNetwork.virtualNetwork.id,
-        deviceProfileId: deviceProfile.policy.id,
-        enrollmentApplicationId: enrollment.application.id,
-        routes
-      }
-    };
-    privateNetworkCreated = virtualNetwork.created || enrollment.created || deviceProfile.created || routes.length > 0;
+    nodeResources.push(resource);
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created });
+    const first2 = nodeResources[0];
     await writeOwnerBootstrapOutput(absoluteOutput, {
       format: 1,
       kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
+      phase: "edge-resources-provisioned",
       updatedAt: new Date().toISOString(),
       coordinates,
-      resources
-    });
-  }
-  for (const node of coordinates.nodes) {
-    const application = await ensureCloudflareAccessApplication({
-      accountId: coordinates.accountId,
-      name: node.applicationName,
-      hostname: node.hostname,
-      policyId: policy.policy.id,
-      apiToken: tokenFor(tokens, "accessApiToken")
-    }, fetcher);
-    if (!application.application.id)
-      throw new Error(`Cloudflare did not return the Access application id for ${node.nodeName}`);
-    resources = {
-      ...resources,
-      nodes: resources.nodes.map((resource) => resource.nodeName === node.nodeName ? { ...resource, applicationId: application.application.id } : resource),
-      access: {
-        ...resources.access,
-        ...node.nodeName === coordinates.nodes[0].nodeName ? { applicationId: application.application.id } : {}
+      resources: {
+        tunnelId: first2.tunnelId,
+        kvNamespaceId: coordinates.kvNamespaceId,
+        hostname: first2.hostname,
+        service: first2.service,
+        connectorToken: first2.connectorToken,
+        kvRuntimeToken,
+        nodes: [...nodeResources]
       }
-    };
-    const createdNode = createdNodes.find(({ nodeName }) => nodeName === node.nodeName);
-    createdNode.application = application.created;
-    await writeOwnerBootstrapOutput(absoluteOutput, {
-      format: 1,
-      kind: "forgezero-cloudflare-bootstrap",
-      phase: "access-token-provisioned",
-      updatedAt: new Date().toISOString(),
-      coordinates,
-      resources
     });
   }
-  await configureCloudflareWorkerAccessSecrets({
-    accountId: coordinates.accountId,
-    scriptName: coordinates.workerScriptName,
-    credentials: serviceToken.credentials,
-    apiToken: tokenFor(tokens, "workerApiToken")
-  }, fetcher);
-  for (const node of resources.nodes) {
+  for (const node of nodeResources) {
     await configureCloudflareEdge({
       accountId: coordinates.accountId,
       zoneId: coordinates.zoneId,
@@ -1204,21 +586,24 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       dnsApiToken: tokenFor(tokens, "dnsApiToken")
     }, fetcher);
   }
+  const first = nodeResources[0];
   const output = {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap",
     phase: "complete",
     updatedAt: new Date().toISOString(),
     coordinates,
-    resources,
+    resources: {
+      tunnelId: first.tunnelId,
+      kvNamespaceId: coordinates.kvNamespaceId,
+      hostname: first.hostname,
+      service: first.service,
+      connectorToken: first.connectorToken,
+      kvRuntimeToken,
+      nodes: nodeResources
+    },
     created: {
       tunnel: createdNodes.some(({ tunnel }) => tunnel),
-      kvNamespace: namespace.created,
-      serviceToken: serviceToken.created,
-      policy: policy.created,
-      application: createdNodes.some(({ application }) => application),
-      privateNetwork: privateNetworkCreated,
-      workerDeployed: true,
       nodes: createdNodes
     }
   };
@@ -1234,91 +619,65 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       kind: "forgezero-cloudflare-bootstrap-evidence",
       phase: "planned",
       checkpointFile: plan.outputFile,
-      workerScriptName: plan.coordinates.workerScriptName,
-      publicDomains: plan.coordinates.publicDomains,
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
   if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
     throw new Error("Cloudflare apply requires owner-only management token file paths");
   }
-  if (plan.coordinates.createRuntimeTokens && !request.tokenFiles.apiTokenFile) {
-    throw new Error("Cloudflare runtime-token creation requires the initial management token file");
-  }
   const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
-  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch, dependencies.workerRunner);
+  const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-evidence",
     phase: "complete",
     checkpointFile: plan.outputFile,
     kvNamespaceId: output.resources.kvNamespaceId,
-    workerScriptName: output.coordinates.workerScriptName,
-    publicDomains: output.resources.worker?.publicDomains ?? output.coordinates.publicDomains,
-    runtimeTokenIds: {
-      kv: output.resources.runtimeTokens?.kv.id,
-      privateNetwork: output.resources.runtimeTokens?.privateNetwork?.id
-    },
-    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId, applicationId }) => ({
+    nodes: output.resources.nodes.map(({ nodeName, hostname, tunnelId }) => ({
       nodeName,
       hostname,
-      ...output.resources.runtimeTokens?.kv ? {
-        handoffFile: cloudflareHostHandoffPath(plan.outputFile, nodeName)
-      } : {},
-      tunnelId,
-      applicationId
+      handoffFile: cloudflareHostHandoffPath(plan.outputFile, nodeName),
+      tunnelId
     }))
   };
 }
+var acceptanceFetch = async (url, label, fetcher) => {
+  let response;
+  try {
+    response = await fetcher(url, { method: "GET", redirect: "manual", signal: AbortSignal.timeout(5000) });
+  } catch {
+    throw new Error(`${label} is unreachable`);
+  }
+  if (!response.ok)
+    throw new Error(`${label} returned HTTP ${response.status}`);
+  return response.status;
+};
 async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fetch) {
   const absolute = resolve(checkpointPath);
   const output = await readExistingOutput(absolute);
   if (!output || output.phase !== "complete")
     throw new Error("Cloudflare acceptance requires a completed owner checkpoint");
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
-  const access = output.resources.access;
-  if (!access?.clientId?.trim() || !access.clientSecret?.trim()) {
-    throw new Error("Cloudflare acceptance checkpoint is missing the Access service credential");
-  }
-  if (!output.resources.worker?.deployed || output.resources.worker.scriptName !== coordinates.workerScriptName || JSON.stringify(output.resources.worker.publicDomains) !== JSON.stringify(coordinates.publicDomains)) {
-    throw new Error("Cloudflare acceptance checkpoint does not prove the expected Worker deployment");
-  }
   if (output.resources.nodes.length !== coordinates.nodes.length) {
     throw new Error("Cloudflare acceptance checkpoint does not cover the declared node fleet");
   }
-  const nodeNames = new Set;
-  const hostnames = new Set;
   for (const node of output.resources.nodes) {
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
-    if (!expected || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(node.tunnelId)) {
+    if (!expected || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(node.tunnelId)) {
       throw new Error("Cloudflare acceptance checkpoint has an unbound node resource");
     }
-    if (nodeNames.has(node.nodeName) || hostnames.has(node.hostname)) {
-      throw new Error("Cloudflare acceptance checkpoint has duplicate node coordinates");
-    }
-    nodeNames.add(node.nodeName);
-    hostnames.add(node.hostname);
   }
-  const accessHeaders = {
-    "CF-Access-Client-Id": access.clientId,
-    "CF-Access-Client-Secret": access.clientSecret
-  };
   const nodes = await Promise.all(output.resources.nodes.map(async ({ nodeName, hostname }) => ({
     nodeName,
     hostname,
-    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare origin ${nodeName}`, fetcher, accessHeaders)
-  })));
-  const publicDomains = await Promise.all(output.resources.worker.publicDomains.map(async (hostname) => ({
-    hostname,
-    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare public domain ${hostname}`, fetcher)
+    status: await acceptanceFetch(`https://${hostname}/api/health`, `Cloudflare origin ${nodeName}`, fetcher)
   })));
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-acceptance",
     checkpointFile: absolute,
     verifiedAt: new Date().toISOString(),
-    nodes,
-    publicDomains
+    nodes
   };
 }
 
@@ -1353,7 +712,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.39";
+var VERSION = "0.1.41";
 
 // src/software.ts
 var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
@@ -1372,8 +731,8 @@ var UBUNTU_2604_X64 = [
   },
   {
     requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install`
+    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
+    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
   },
   {
     requirement: { id: "cloudflared", version: "2026.7.3" },
@@ -1459,7 +818,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/provision.ts
-import { isIP as isIP3 } from "net";
+import { isIP as isIP2 } from "net";
 function atLeast(version, floor) {
   const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
   const got = parse(version);
@@ -1916,7 +1275,7 @@ function agentUnit(options) {
     } catch {
       throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
     }
-    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
+    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP2(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
       throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
   }
@@ -2597,6 +1956,8 @@ function renderPlatformApiUnits(input) {
     throw new Error("Blue and green ports must differ.");
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
+  const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
 After=network-online.target ${input.collectorUnit}
@@ -2609,7 +1970,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${credentials}
+${capacityEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2
@@ -2645,16 +2006,24 @@ Environment=PORT=${input.greenPort}
 function renderPlatformNginx(input) {
   boundedInteger("publicPort", input.publicPort, 1024, 65535);
   boundedInteger("initialSlotPort", input.initialSlotPort, 1024, 65535);
+  const concurrencyLimit = boundedInteger("concurrencyLimit", input.concurrencyLimit ?? 256, 1, 1e6);
+  boundedInteger("workerDrainSeconds", input.workerDrainSeconds ?? 35, 1, 300);
   if (input.publicPort === input.initialSlotPort)
     throw new Error("Edge and slot ports must differ.");
   return {
     upstream: `upstream forgezero { server 127.0.0.1:${input.initialSlotPort}; }
 `,
-    site: `server {
+    site: `limit_conn_zone $server_name zone=forgezero_admission:10m;
+map $http_upgrade $forgezero_connection { default upgrade; '' close; }
+map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED_DRY_RUN 1; }
+server {
   listen 127.0.0.1:${input.publicPort};
   server_name _;
-  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
-  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; }
+  limit_conn forgezero_admission ${concurrencyLimit};
+  limit_conn_status 503;
+  add_header Retry-After $forgezero_retry_after always;
+  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
+  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
   location / { return 404; }
 }
 `
@@ -2670,6 +2039,7 @@ function renderPlatformActivationFiles(input) {
   if (input.bluePort === input.greenPort)
     throw new Error("Activation slot ports must differ.");
   boundedInteger("keepReleases", input.keepReleases, 2, 100);
+  const drainDeadlineMs = boundedInteger("drainDeadlineMs", input.drainDeadlineMs ?? 35000, 1000, 300000);
   if (!/^\/[A-Za-z0-9/_-]{1,128}$/.test(input.healthPath) || input.healthPath.includes("..")) {
     throw new Error("Activation health path is malformed.");
   }
@@ -2679,7 +2049,8 @@ function renderPlatformActivationFiles(input) {
     `FZ_BLUE_PORT=${input.bluePort}`,
     `FZ_GREEN_PORT=${input.greenPort}`,
     `FZ_HEALTH_PATH=${input.healthPath}`,
-    `FZ_KEEP_RELEASES=${input.keepReleases}`
+    `FZ_KEEP_RELEASES=${input.keepReleases}`,
+    `FZ_DRAIN_DEADLINE_MS=${drainDeadlineMs}`
   ].join(`
 `) + `
 `;
@@ -2701,7 +2072,14 @@ if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true;
 upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
 printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
 if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
-rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"; [[ -n "$previous_slot" && "$previous_slot" != "$target" ]] && systemctl stop "forgezero@\${previous_slot}.service" || true
+rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"
+# New nginx workers select the new slot after reload. Keep the old slot alive
+# while old workers drain in-flight requests and upgraded connections.
+if [[ -n "$previous_slot" && "$previous_slot" != "$target" ]]; then
+  sleep_seconds="$(( (FZ_DRAIN_DEADLINE_MS + 999) / 1000 ))"
+  sleep "$sleep_seconds"
+  systemctl stop "forgezero@\${previous_slot}.service" || true
+fi
 mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
 for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
 printf 'promoted %s on %s\\n' "$release" "$target"
@@ -2832,6 +2210,18 @@ function validateBootstrapConfig(value) {
   if (telemetry.protocol !== "https:" || telemetry.port && telemetry.port !== "443" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
     throw new Error("telemetry endpoint must be public HTTPS on port 443 without credentials, query or fragment");
   }
+  const deploymentCredentials = value.deploymentCredentials ?? {};
+  if (!deploymentCredentials || typeof deploymentCredentials !== "object" || Array.isArray(deploymentCredentials) || Object.keys(deploymentCredentials).length > 64) {
+    throw new Error("deployment credentials must be a bounded name-to-path object");
+  }
+  for (const [name, path] of Object.entries(deploymentCredentials)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || typeof path !== "string" || !path.startsWith("/") || /[\r\n:]/.test(path) || !path.endsWith(".cred")) {
+      throw new Error(`deployment credential ${name} must map to an absolute encrypted .cred path`);
+    }
+  }
+  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
+    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  }
   if (value.kind === "tenant") {
     if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
       throw new Error("tenant realm is malformed");
@@ -2911,9 +2301,6 @@ function validateBootstrapConfig(value) {
   if (!["genesis-derived", "api-token"].includes(value.enrolment.source) || value.enrolment.source === "api-token" && !value.enrolment.tokenFile || value.enrolment.source === "genesis-derived" && value.enrolment.tokenFile) {
     throw new Error("platform enrolment source and token file disagree");
   }
-  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
-    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
-  }
   value.runtime.environment = runtime;
   return value;
 }
@@ -3243,7 +2630,7 @@ async function preparePlatformBootstrap(input, host = localBootstrapHost()) {
     next: "register this read-only deploy key, then run --apply concurrently on all three genesis Agency members"
   };
 }
-function stateFor(config) {
+function stateFor(config, cloudflare, previousCloudflareTunnelId) {
   return `${JSON.stringify({
     format: 2,
     kind: config.kind,
@@ -3264,7 +2651,11 @@ function stateFor(config) {
       healthPath: config.runtime.healthPath,
       cloudflare: config.runtime.environment.cloudflare,
       cloudflared: Boolean(config.cloudflareHandoff)
-    } : { realm: config.realm }
+    } : {
+      realm: config.realm,
+      cloudflared: Boolean(config.cloudflareHandoff),
+      cloudflareTunnelId: cloudflare?.tunnelId ?? previousCloudflareTunnelId
+    }
   }, null, 2)}
 `;
 }
@@ -3282,7 +2673,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     units.push("nginx.service");
   if (state.kind === "platform" && state.collectorUnit)
     units.push(state.collectorUnit);
-  if (state.kind === "platform" && state.cloudflared)
+  if (state.cloudflared)
     units.push("cloudflared.service");
   if (state.kind === "platform" && state.databaseRole !== "none")
     units.push("forgezero-db.service", "forgezero-db-verify.service");
@@ -3299,13 +2690,25 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (!services[socket])
       problems.push(`${socket} is missing`);
   }
+  if (state.cloudflared) {
+    for (const credential of [TUNNEL_CREDENTIAL, `${CREDS}/cloudflare-kv-token.cred`]) {
+      services[credential] = host.exists(credential);
+      if (!services[credential])
+        problems.push(`${credential} is missing`);
+    }
+    const tunnelId = state.cloudflare?.tunnelId ?? state.cloudflareTunnelId;
+    if (!tunnelId) {
+      services["cloudflared-tunnel"] = false;
+      problems.push("Cloudflare tunnel identity is missing from bootstrap state");
+    } else {
+      const evidence = await inspectCloudflaredTunnel(host, tunnelId);
+      services["cloudflared-tunnel"] = evidence.healthy;
+      if (!evidence.healthy)
+        problems.push(evidence.problem);
+    }
+  }
   if (state.kind === "platform") {
     if (state.cloudflared) {
-      for (const credential of [TUNNEL_CREDENTIAL, `${CREDS}/cloudflare-kv-token.cred`]) {
-        services[credential] = host.exists(credential);
-        if (!services[credential])
-          problems.push(`${credential} is missing`);
-      }
       if (state.cloudflare?.warp) {
         for (const credential of [
           `${CREDS}/cloudflare-network-token.cred`,
@@ -3317,15 +2720,6 @@ async function bootstrapStatus(host = localBootstrapHost()) {
             problems.push(`${credential} is missing`);
         }
       }
-      if (!state.cloudflare?.tunnelId) {
-        services["cloudflared-tunnel"] = false;
-        problems.push("Cloudflare tunnel identity is missing from bootstrap state");
-      } else {
-        const evidence = await inspectCloudflaredTunnel(host, state.cloudflare.tunnelId);
-        services["cloudflared-tunnel"] = evidence.healthy;
-        if (!evidence.healthy)
-          problems.push(evidence.problem);
-      }
     }
     const [blue, green] = await Promise.all([
       host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
@@ -3394,20 +2788,21 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
   let cloudflare;
-  if (config.kind === "platform" && config.cloudflareHandoff) {
+  if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
       cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.handoffFile, config.cloudflareHandoff.nodeName);
-    } else if (installed?.cloudflare) {
+    } else if (config.kind === "platform" && installed?.cloudflare) {
       config.runtime.environment.cloudflare = installed.cloudflare;
       config.runtime.environment = validatePlatformSharedEnvironment(config.runtime.environment);
-    } else {
+    } else if (!(config.kind === "tenant" && installed?.cloudflareTunnelId)) {
       throw new Error("node-specific Cloudflare host handoff is missing before credential sealing");
     }
   }
+  if (cloudflare && cloudflare.hostname !== config.nodeHostname) {
+    throw new Error("Cloudflare handoff hostname disagrees with node hostname");
+  }
   if (cloudflare && config.kind === "platform") {
     const expected = config.runtime.environment.cloudflare;
-    if (cloudflare.hostname !== config.nodeHostname)
-      throw new Error("Cloudflare handoff hostname disagrees with platform node hostname");
     if (expected && (cloudflare.service !== expected.tunnelService || cloudflare.accountId !== expected.accountId || cloudflare.zoneId !== expected.zoneId || cloudflare.kvNamespaceId !== expected.kvNamespaceId || cloudflare.tunnelId !== expected.tunnelId)) {
       throw new Error("Cloudflare handoff disagrees with immutable platform runtime coordinates");
     }
@@ -3449,6 +2844,9 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     await seal(host, "warp-auth-client-id", WARP_CLIENT_ID_CREDENTIAL, cloudflare.warp.clientId);
     await seal(host, "warp-auth-client-secret", WARP_CLIENT_SECRET_CREDENTIAL, cloudflare.warp.clientSecret);
   }
+  if (cloudflare && !host.exists(`${CREDS}/cloudflare-kv-token.cred`)) {
+    await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
+  }
   await host.installAgent(config);
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id }) => id === "ufw"));
@@ -3488,7 +2886,6 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       }
     }
     if (cloudflare) {
-      await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
       if (cloudflare.privateNetworkRuntimeToken)
         await seal(host, "cloudflare-network-token", `${CREDS}/cloudflare-network-token.cred`, cloudflare.privateNetworkRuntimeToken);
     }
@@ -3509,16 +2906,23 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       bluePort: runtime.bluePort,
       greenPort: runtime.greenPort,
       collectorUnit: runtime.environment.otlpCollectorUnit,
-      credentials
+      credentials,
+      capacityEnvironmentFile: "/etc/forgezero/capacity.env"
+    });
+    const edge = renderPlatformNginx({
+      publicPort: runtime.environment.publicApiPort,
+      initialSlotPort: runtime.bluePort,
+      concurrencyLimit: runtime.environment.concurrencyLimit,
+      workerDrainSeconds: Math.ceil(runtime.environment.drainDeadlineMs / 1000)
     });
-    const edge = renderPlatformNginx({ publicPort: runtime.environment.publicApiPort, initialSlotPort: runtime.bluePort });
     const activation = renderPlatformActivationFiles({
       root: config.deployRoot ?? "/opt/forgezero",
       serviceUser: runtime.serviceUser,
       bluePort: runtime.bluePort,
       greenPort: runtime.greenPort,
       healthPath: runtime.healthPath,
-      keepReleases: runtime.keepReleases
+      keepReleases: runtime.keepReleases,
+      drainDeadlineMs: runtime.environment.drainDeadlineMs
     });
     await checked(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
       await checked(host, ["id", runtime.serviceUser], "existing API service account");
@@ -3526,6 +2930,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
     host.write(envPath, renderPlatformSharedEnvironment(runtime.environment), 416);
+    if (!host.exists("/etc/forgezero/capacity.env")) {
+      host.write("/etc/forgezero/capacity.env", `FZ_CONCURRENCY_LIMIT=${runtime.environment.concurrencyLimit}
+`, 420);
+    }
     await checked(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
     host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
     host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
@@ -3591,7 +2999,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
         host.remove(config.enrolment.tokenFile);
     }
   }
-  if (config.kind === "platform" && config.cloudflareHandoff) {
+  if (config.cloudflareHandoff) {
     if (!host.exists(TUNNEL_CREDENTIAL) && cloudflare) {
       await seal(host, "cloudflared-token", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
     }
@@ -3600,17 +3008,17 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
     await checked(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
     await checked(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
-    const tunnelId = config.runtime.environment.cloudflare?.tunnelId;
+    const tunnelId = cloudflare?.tunnelId ?? installed?.cloudflareTunnelId ?? (config.kind === "platform" ? config.runtime.environment.cloudflare?.tunnelId : undefined);
     if (!tunnelId)
       throw new Error("Cloudflare tunnel identity is missing after handoff validation");
     await waitForCloudflaredTunnel(host, tunnelId);
   }
-  host.write(STATE_PATH, stateFor(config), 384);
+  host.write(STATE_PATH, stateFor(config, cloudflare, installed?.cloudflareTunnelId), 384);
   const status = await bootstrapStatus(host);
   if (!status.initialized)
     throw new Error(`bootstrap verification failed: ${status.problems.join("; ")}`);
   host.remove(INTENT_PATH);
-  if (cloudflare && config.kind === "platform" && config.cloudflareHandoff) {
+  if (cloudflare && config.cloudflareHandoff) {
     host.remove(config.cloudflareHandoff.handoffFile);
   }
   let launch;
@@ -3658,6 +3066,7 @@ function strictBootstrapDocument(value) {
     "realm",
     "enrolTokenFile",
     "software",
+    "deploymentCredentials",
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
@@ -3724,9 +3133,11 @@ function strictBootstrapDocument(value) {
       exactKeys(environment.cloudflare.warp, ["organization", "virtualNetworkId", "deviceProfileId"], "Cloudflare WARP runtime config");
     }
   } else if (root.kind === "tenant") {
+    if (root.cloudflareHandoff !== undefined)
+      exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
     if (root.bootstrapRunner !== undefined)
       exactKeys(root.bootstrapRunner, ["sshPrivateKeyFile", "targetTelemetryEndpoint"], "bootstrap runner config");
-    for (const key of ["environment", "profile", "computeReference", "database", "enrolment", "runtime", "cloudflareHandoff"]) {
+    for (const key of ["environment", "profile", "computeReference", "database", "enrolment", "runtime"]) {
       if (root[key] !== undefined && key !== "profile")
         throw new Error(`tenant bootstrap cannot contain ${key}`);
     }
@@ -3815,6 +3226,7 @@ function localBootstrapHost() {
         branch: config.branch,
         profile: config.kind === "platform" ? config.profile : config.profile,
         deployRoot,
+        deploymentCredentials: config.deploymentCredentials,
         publicApiUrl: config.apiUrl,
         gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
         gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",