@forgezero/agent 0.1.40 → 0.1.42

package/dist/bootstrap.js

@@ -94,6 +94,39 @@ async function removeCloudflarePrivateDatabaseRoute(config, fetcher = fetch) {
     network: privateDatabaseHostRoute(config.privateAddress)
   }, fetcher);
 }
+var privateNetworkCidr = (value) => {
+  const [address, prefixText, ...extra] = value.trim().toLowerCase().split("/");
+  const family = isIP(address ?? "");
+  const prefix = Number(prefixText);
+  if (extra.length || !family || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128) || !isPrivateDatabaseAddress(address)) {
+    throw new Error("Cloudflare WARP include must be an explicit private IPv4 or IPv6 CIDR");
+  }
+  return `${address}/${prefix}`;
+};
+async function ensureCloudflareWarpNetworkIncludes(config, fetcher = fetch) {
+  if (!/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
+    throw new Error("Cloudflare WARP policy id is invalid");
+  if (!Array.isArray(config.networks) || config.networks.length < 1 || config.networks.length > 256) {
+    throw new Error("Cloudflare WARP networks must contain 1-256 explicit CIDRs");
+  }
+  const networks = config.networks.map(privateNetworkCidr);
+  if (new Set(networks).size !== networks.length)
+    throw new Error("Cloudflare WARP networks must be unique");
+  const path = `/accounts/${config.accountId}/devices/policy/${config.policyId}/include`;
+  const entries = await cf(config, path, {}, fetcher);
+  const present = new Set(entries.flatMap(({ address }) => address ? [address.toLowerCase()] : []));
+  const additions = networks.filter((network) => !present.has(network)).map((address) => ({
+    address,
+    description: `${config.descriptionPrefix}:${address}`.slice(0, 100)
+  }));
+  if (!additions.length)
+    return { entries, created: 0 };
+  const updated = await cf(config, path, {
+    method: "PUT",
+    body: JSON.stringify([...entries, ...additions])
+  }, fetcher);
+  return { entries: updated, created: additions.length };
+}
 async function ensureCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
   if (config.policyId && !/^[A-Za-z0-9-]{1,64}$/.test(config.policyId))
     throw new Error("Cloudflare WARP policy id is invalid");
@@ -127,13 +160,11 @@ async function removeCloudflareWarpDatabaseInclude(config, fetcher = fetch) {
   return { entries: updated, removed: true };
 }
 async function configureCloudflareEdge(config, fetcher = fetch) {
-  const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
-  const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
   const [current, records] = await Promise.all([
-    cf(tunnelAuth, tunnelPath, {}, fetcher),
-    cf(dnsAuth, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
+    cf(config, tunnelPath, {}, fetcher),
+    cf(config, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
   ]);
   if (records.length > 1) {
     throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
@@ -151,7 +182,7 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
     ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
   ];
   if (JSON.stringify(existing) !== JSON.stringify(desiredIngress)) {
-    await cf(tunnelAuth, tunnelPath, {
+    await cf(config, tunnelPath, {
       method: "PUT",
       body: JSON.stringify({ config: { ingress: desiredIngress } })
     }, fetcher);
@@ -165,12 +196,72 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
   };
   const dnsAlreadyCorrect = existingRecord?.type === record.type && existingRecord.name?.toLowerCase() === record.name.toLowerCase() && existingRecord.content?.toLowerCase() === record.content.toLowerCase() && existingRecord.proxied === true && existingRecord.ttl === 1;
   if (!dnsAlreadyCorrect) {
-    await cf(dnsAuth, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
-      method: existingRecord ? "PUT" : "POST",
-      body: JSON.stringify(record)
+    await cf(config, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
+      method: existingRecord ? "PATCH" : "POST",
+      body: JSON.stringify(existingRecord ? {
+        ...record,
+        ...existingRecord.comment === undefined ? {} : { comment: existingRecord.comment },
+        ...existingRecord.tags === undefined ? {} : { tags: existingRecord.tags },
+        ...existingRecord.settings === undefined ? {} : { settings: existingRecord.settings }
+      } : record)
     }, fetcher);
   }
 }
+async function verifyCloudflareWorkerDurableObjects(config, fetcher = fetch) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/.test(config.scriptName)) {
+    throw new Error("Cloudflare Worker script name is invalid");
+  }
+  const namespaces = await cf(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces?per_page=1000`, {}, fetcher);
+  const owned = namespaces.filter(({ script }) => script === config.scriptName);
+  if (!owned.length)
+    throw new Error(`Cloudflare Worker ${config.scriptName} has no Durable Object namespace`);
+  return owned;
+}
+async function configureCloudflareRealtimeSecrets(config, fetcher = fetch) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/.test(config.scriptName) || ![config.publishSecret, config.ticketSecret].every((value) => /^[A-Za-z0-9_-]{64,128}$/.test(value)) || config.publishSecret === config.ticketSecret) {
+    throw new Error("Cloudflare realtime secret coordinates are invalid");
+  }
+  await cf(config, `/accounts/${config.accountId}/workers/scripts/${encodeURIComponent(config.scriptName)}/secrets-bulk`, {
+    method: "PATCH",
+    body: JSON.stringify({
+      secrets: {
+        REALTIME_PUBLISH_SECRET: {
+          name: "REALTIME_PUBLISH_SECRET",
+          text: config.publishSecret,
+          type: "secret_text"
+        },
+        REALTIME_TICKET_SECRET: {
+          name: "REALTIME_TICKET_SECRET",
+          text: config.ticketSecret,
+          type: "secret_text"
+        }
+      }
+    })
+  }, fetcher);
+}
+async function ensureCloudflareMeshConnector(config, fetcher = fetch) {
+  const name = config.name.trim();
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(name)) {
+    throw new Error("Cloudflare Mesh connector name is invalid");
+  }
+  const path = `/accounts/${config.accountId}/warp_connector`;
+  const connectors = await cf(config, `${path}?is_deleted=false&name=${encodeURIComponent(name)}&per_page=1000`, {}, fetcher);
+  const matches = connectors.filter((connector2) => connector2.name === name && !connector2.deleted_at);
+  if (matches.length > 1)
+    throw new Error(`Cloudflare Mesh connector ${name} is ambiguous`);
+  const created = !matches[0];
+  const connector = matches[0] ?? await cf(config, path, {
+    method: "POST",
+    body: JSON.stringify({ name, ha: config.highAvailability })
+  }, fetcher);
+  if (!connector.id)
+    throw new Error("Cloudflare returned an invalid Mesh connector");
+  const connectorToken = await cf(config, `${path}/${encodeURIComponent(connector.id)}/token`, {}, fetcher);
+  if (!connectorToken || connectorToken.length > 16384) {
+    throw new Error("Cloudflare returned an invalid Mesh connector token");
+  }
+  return { connector, connectorToken, created };
+}
 async function ensureCloudflareTunnel(config, fetcher = fetch) {
   const name = config.name.trim();
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/.test(name)) {
@@ -195,13 +286,15 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { randomUUID } from "crypto";
-import { chmod, lstat, mkdir, open, rename, stat, unlink } from "fs/promises";
+import { randomBytes, randomUUID } from "crypto";
+import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
 import { dirname, join, resolve } from "path";
+import { isIP as isIP2 } from "net";
 var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
 var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
+var REALTIME_SECRET = /^[A-Za-z0-9_-]{64,128}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -242,33 +335,23 @@ async function readOwnerApiToken(path) {
   return token;
 }
 async function readCloudflareBootstrapTokens(files) {
-  const entries = await Promise.all([
-    ["apiToken", files.apiTokenFile],
-    ["managementApiToken", files.managementApiTokenFile],
-    ["runtimeApiToken", files.runtimeApiTokenFile],
-    ["tunnelApiToken", files.tunnelApiTokenFile],
-    ["dnsApiToken", files.dnsApiTokenFile],
-    ["kvApiToken", files.kvApiTokenFile]
-  ].map(async ([key, path]) => [key, path ? await readOwnerApiToken(path) : undefined]));
-  const supplied = Object.fromEntries(entries.filter(([, value]) => value !== undefined));
-  const tokens = {
-    ...supplied.apiToken ? { apiToken: supplied.apiToken } : {},
-    ...supplied.tunnelApiToken || supplied.managementApiToken ? {
-      tunnelApiToken: supplied.tunnelApiToken ?? supplied.managementApiToken
-    } : {},
-    ...supplied.dnsApiToken || supplied.managementApiToken ? {
-      dnsApiToken: supplied.dnsApiToken ?? supplied.managementApiToken
-    } : {},
-    ...supplied.kvApiToken || supplied.runtimeApiToken ? {
-      kvApiToken: supplied.kvApiToken ?? supplied.runtimeApiToken
-    } : {}
-  };
-  for (const key of ["tunnelApiToken", "dnsApiToken", "kvApiToken"]) {
-    if (!tokens[key] && !tokens.apiToken) {
-      throw new Error(`Cloudflare ${key} file is required when apiTokenFile is omitted`);
-    }
+  const unsupported = Object.keys(files).filter((key) => ![
+    "tunnelTokenFile",
+    "apiTokenFile"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap token files contain unsupported field ${unsupported[0]}`);
+  if (!files.tunnelTokenFile?.trim() || !files.apiTokenFile?.trim()) {
+    throw new Error("Cloudflare bootstrap requires exactly tunnelTokenFile and apiTokenFile");
+  }
+  const [tunnelToken, apiToken] = await Promise.all([
+    readOwnerApiToken(files.tunnelTokenFile),
+    readOwnerApiToken(files.apiTokenFile)
+  ]);
+  if (tunnelToken === apiToken) {
+    throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege tokens");
   }
-  return tokens;
+  return { tunnelToken, apiToken };
 }
 var validateId = (value, label) => {
   const normalized = value.trim().toLowerCase();
@@ -294,28 +377,89 @@ var normalizeService = (value) => {
   }
   return service.toString().replace(/\/$/, "");
 };
+var privateMeshCidr = (value) => {
+  const [address, prefixText, ...extra] = value.trim().toLowerCase().split("/");
+  const family = isIP2(address ?? "");
+  const prefix = Number(prefixText);
+  const v4 = family === 4 ? address.split(".").map(Number) : undefined;
+  const privateAddress = family === 4 ? Boolean(v4 && (v4[0] === 10 || v4[0] === 172 && v4[1] >= 16 && v4[1] <= 31 || v4[0] === 192 && v4[1] === 168)) : family === 6 && /^f[cd][0-9a-f]:/i.test(address);
+  if (extra.length || !family || !privateAddress || !Number.isInteger(prefix) || prefix < 0 || prefix > (family === 4 ? 32 : 128)) {
+    throw new Error("Cloudflare Mesh route must be an explicit private IPv4 or IPv6 CIDR");
+  }
+  return `${address}/${prefix}`;
+};
 function validateCloudflareBootstrapCoordinates(input) {
-  const nodeInputs = input.nodes?.length ? input.nodes : [{
-    nodeName: input.tunnelName,
-    hostname: input.hostname,
-    service: input.service,
-    tunnelName: input.tunnelName
-  }];
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const nodeInputs = input.nodes;
+  if (!Array.isArray(nodeInputs))
+    throw new Error("Cloudflare bootstrap requires an explicit nodes array");
   if (nodeInputs.length < 1 || nodeInputs.length > 32) {
     throw new Error("Cloudflare bootstrap requires between 1 and 32 explicit nodes");
   }
   const nodes = nodeInputs.map((node) => {
+    if (!node || typeof node !== "object" || Array.isArray(node)) {
+      throw new Error("Cloudflare bootstrap node must be an object");
+    }
+    const unknownNode = Object.keys(node).filter((key) => ![
+      "nodeName",
+      "hostname",
+      "service",
+      "tunnelName",
+      "mesh"
+    ].includes(key));
+    if (unknownNode.length)
+      throw new Error(`Cloudflare bootstrap node contains unsupported field ${unknownNode[0]}`);
     const nodeName = node.nodeName.trim().toLowerCase();
     if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName))
       throw new Error("Cloudflare node name is invalid");
     const hostname = node.hostname.trim().toLowerCase();
     if (!HOSTNAME.test(hostname))
       throw new Error("Cloudflare public node hostname is invalid");
+    let mesh;
+    if (node.mesh !== undefined) {
+      if (!node.mesh || typeof node.mesh !== "object" || Array.isArray(node.mesh)) {
+        throw new Error("Cloudflare Mesh coordinates must be an object");
+      }
+      const unknownMesh = Object.keys(node.mesh).filter((key) => ![
+        "connectorName",
+        "routes",
+        "highAvailability"
+      ].includes(key));
+      if (unknownMesh.length)
+        throw new Error(`Cloudflare Mesh contains unsupported field ${unknownMesh[0]}`);
+      if (!Array.isArray(node.mesh.routes) || node.mesh.routes.length < 1 || node.mesh.routes.length > 64) {
+        throw new Error("Cloudflare Mesh node requires 1-64 private routes");
+      }
+      const routes = node.mesh.routes.map(privateMeshCidr);
+      if (new Set(routes).size !== routes.length)
+        throw new Error("Cloudflare Mesh routes must be unique per node");
+      if (node.mesh.highAvailability !== undefined && typeof node.mesh.highAvailability !== "boolean") {
+        throw new Error("Cloudflare Mesh highAvailability must be a boolean");
+      }
+      mesh = {
+        connectorName: validateName(node.mesh.connectorName, "Cloudflare Mesh connector name"),
+        routes,
+        highAvailability: node.mesh.highAvailability === true
+      };
+    }
     return {
       nodeName,
       hostname,
       service: normalizeService(node.service),
-      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name")
+      tunnelName: validateName(node.tunnelName, "Cloudflare Tunnel name"),
+      ...mesh ? { mesh } : {}
     };
   });
   for (const [label, values] of [
@@ -326,14 +470,51 @@ function validateCloudflareBootstrapCoordinates(input) {
     if (new Set(values).size !== values.length)
       throw new Error(`Cloudflare fleet ${label} must be unique`);
   }
-  const first = nodes[0];
+  const meshNodes = nodes.filter(({ mesh }) => mesh);
+  if (meshNodes.length && !input.meshDevicePolicyId?.trim()) {
+    throw new Error("Cloudflare Mesh requires an explicit dedicated device policy id");
+  }
+  if (!meshNodes.length && input.meshDevicePolicyId !== undefined) {
+    throw new Error("Cloudflare Mesh device policy is not allowed without Mesh nodes");
+  }
+  const connectorNames = meshNodes.map(({ mesh }) => mesh.connectorName);
+  if (new Set(connectorNames).size !== connectorNames.length) {
+    throw new Error("Cloudflare Mesh connector names must be unique");
+  }
+  const routeOwners = new Map;
+  for (const node of meshNodes)
+    for (const route of node.mesh.routes) {
+      const owner = routeOwners.get(route);
+      if (owner)
+        throw new Error(`Cloudflare Mesh route ${route} is declared by both ${owner} and ${node.nodeName}`);
+      routeOwners.set(route, node.nodeName);
+    }
+  let realtime;
+  if (input.realtime !== undefined) {
+    if (!input.realtime || typeof input.realtime !== "object" || Array.isArray(input.realtime) || Object.keys(input.realtime).some((key) => !["workerScriptName", "endpoint", "producer"].includes(key))) {
+      throw new Error("Cloudflare realtime coordinates are malformed");
+    }
+    const workerScriptName = input.realtime.workerScriptName.trim();
+    const producer = input.realtime.producer.trim();
+    let endpoint2;
+    try {
+      endpoint2 = new URL(input.realtime.endpoint);
+    } catch {
+      throw new Error("Cloudflare realtime endpoint is malformed");
+    }
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/.test(workerScriptName) || !/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,127}$/.test(producer) || endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.pathname !== "/" || endpoint2.search || endpoint2.hash) {
+      throw new Error("Cloudflare realtime Worker, endpoint, or producer is invalid");
+    }
+    realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
+  }
   return {
     accountId: validateId(input.accountId, "Cloudflare account id"),
     zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    hostname: first.hostname,
-    service: first.service,
-    tunnelName: first.tunnelName,
     kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...input.meshDevicePolicyId ? {
+      meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
+    } : {},
+    ...realtime ? { realtime } : {},
     nodes
   };
 }
@@ -346,18 +527,50 @@ function planCloudflareBootstrap(input, outputPath) {
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
+      "prove CF_API_TOKEN can write, read and remove one namespaced nonce in the existing KV namespace",
+      ...coordinates.realtime ? [
+        "prove the existing Worker owns a Durable Object namespace and install its publish/ticket secrets with CF_API_TOKEN"
+      ] : [],
       "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      ...coordinates.nodes.some(({ mesh }) => mesh) ? [
+        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint its registration token",
+        "reconcile every unique private CIDR to its Mesh connector and include all declared CIDRs in the dedicated Mesh device profile"
+      ] : [],
       "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
       "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
-      "write one node-specific handoff containing the connector token and owner-supplied KV-write token"
+      "write one node-specific handoff containing the connector token and owner-supplied KV/Worker runtime token"
     ],
     secrets: [
       "API tokens are read only from owner-only files and are never placed in argv or stdout",
-      "the management token is never persisted; connector and KV runtime capabilities are atomically checkpointed with mode 0600",
-      "the normal API process receives only its KV-write token and never Tunnel or DNS management authority"
+      "CF_TUNNEL_TOKEN is never persisted; cloudflared, Mesh, CF_API_TOKEN and generated realtime capabilities are atomically checkpointed with mode 0600",
+      "the normal API process receives only CF_API_TOKEN and never Tunnel, DNS or Mesh management authority"
     ]
   };
 }
+async function preflightCloudflareKvRuntime(coordinates, apiToken, fetcher) {
+  const nonce = randomUUID();
+  const key = `forgezero/bootstrap-preflight/${nonce}`;
+  const url = `https://api.cloudflare.com/client/v4/accounts/${coordinates.accountId}` + `/storage/kv/namespaces/${coordinates.kvNamespaceId}/values/${encodeURIComponent(key)}`;
+  const headers = { authorization: `Bearer ${apiToken}`, "content-type": "text/plain" };
+  let written = false;
+  try {
+    const put = await fetcher(url, { method: "PUT", headers, body: nonce });
+    if (!put.ok)
+      throw new Error(`Cloudflare KV runtime preflight write returned HTTP ${put.status}`);
+    written = true;
+    const get = await fetcher(url, { method: "GET", headers: { authorization: `Bearer ${apiToken}` } });
+    if (!get.ok)
+      throw new Error(`Cloudflare KV runtime preflight read returned HTTP ${get.status}`);
+    if (await get.text() !== nonce)
+      throw new Error("Cloudflare KV runtime preflight read returned unexpected data");
+  } finally {
+    if (written) {
+      const removed = await fetcher(url, { method: "DELETE", headers: { authorization: `Bearer ${apiToken}` } });
+      if (!removed.ok)
+        throw new Error(`Cloudflare KV runtime preflight cleanup returned HTTP ${removed.status}`);
+    }
+  }
+}
 async function readExistingOutput(path) {
   try {
     await lstat(path);
@@ -374,10 +587,84 @@ async function readExistingOutput(path) {
       throw new Error(`${resolve(path)} is not valid bootstrap JSON`);
     throw cause;
   }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
+  }
   const output = parsed;
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !output.resources) {
+  const unsupported = Object.keys(output).filter((key) => ![
+    "format",
+    "kind",
+    "phase",
+    "updatedAt",
+    "coordinates",
+    "resources",
+    "created"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`${resolve(path)} contains unsupported field ${unsupported[0]}`);
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !["edge-resources-provisioned", "complete"].includes(String(output.phase)) || typeof output.updatedAt !== "string" || Number.isNaN(Date.parse(output.updatedAt)) || !output.resources || typeof output.resources !== "object" || Array.isArray(output.resources)) {
     throw new Error(`${resolve(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
+  const resources = output.resources;
+  const unsupportedResource = Object.keys(resources).filter((key) => ![
+    "kvNamespaceId",
+    "apiToken",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupportedResource.length) {
+    throw new Error(`${resolve(path)} resources contain unsupported field ${unsupportedResource[0]}`);
+  }
+  const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
+  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !TOKEN.test(String(resources.apiToken ?? "")) || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
+    throw new Error(`${resolve(path)} has malformed Cloudflare bootstrap resources`);
+  }
+  if (coordinates.realtime) {
+    const realtime = resources.realtime;
+    if (!realtime || !REALTIME_SECRET.test(String(realtime.publishSecret ?? "")) || !REALTIME_SECRET.test(String(realtime.ticketSecret ?? "")) || realtime.publishSecret === realtime.ticketSecret) {
+      throw new Error(`${resolve(path)} has malformed Cloudflare realtime resources`);
+    }
+  } else if (resources.realtime !== undefined) {
+    throw new Error(`${resolve(path)} contains undeclared Cloudflare realtime resources`);
+  }
+  const seen = new Set;
+  for (const item of resources.nodes) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw new Error(`${resolve(path)} has a malformed Cloudflare node resource`);
+    }
+    const node = item;
+    const unknownNode = Object.keys(node).filter((key) => ![
+      "nodeName",
+      "hostname",
+      "service",
+      "tunnelName",
+      "tunnelId",
+      "connectorToken",
+      "mesh"
+    ].includes(key));
+    const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
+    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? "")) || !CONNECTOR_TOKEN.test(String(node.connectorToken ?? ""))) {
+      throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare node resource`);
+    }
+    if (expected.mesh) {
+      const mesh = node.mesh;
+      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? "")) || !CONNECTOR_TOKEN.test(String(mesh.connectorToken ?? ""))) {
+        throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare Mesh resource`);
+      }
+    } else if (node.mesh !== undefined) {
+      throw new Error(`${resolve(path)} contains an undeclared Cloudflare Mesh resource`);
+    }
+    seen.add(expected.nodeName);
+  }
+  if (output.phase === "complete" && resources.nodes.length !== coordinates.nodes.length) {
+    throw new Error(`${resolve(path)} completed output does not cover the declared node fleet`);
+  }
+  if (output.created !== undefined) {
+    if (!output.created || typeof output.created !== "object" || Array.isArray(output.created) || Object.keys(output.created).some((key) => key !== "nodes") || !Array.isArray(output.created.nodes) || output.created.nodes.some((node) => !node || typeof node !== "object" || Array.isArray(node) || Object.keys(node).some((key) => !["nodeName", "tunnel", "mesh"].includes(key)) || typeof node.nodeName !== "string" || typeof node.tunnel !== "boolean" || typeof node.mesh !== "boolean")) {
+      throw new Error(`${resolve(path)} has malformed Cloudflare creation evidence`);
+    }
+  }
+  output.coordinates = coordinates;
   return output;
 }
 function cloudflareHostHandoffPath(checkpointPath, nodeName) {
@@ -410,7 +697,12 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     hostname: resource.hostname,
     service: resource.service,
     tunnelId: resource.tunnelId,
-    connectorToken: resource.connectorToken
+    connectorToken: resource.connectorToken,
+    ...resource.mesh ? { mesh: {
+      connectorId: resource.mesh.connectorId,
+      connectorToken: resource.mesh.connectorToken,
+      routes: resource.mesh.routes
+    } } : {}
   };
 }
 async function readCloudflareHostHandoff(handoffPath, nodeName) {
@@ -436,9 +728,9 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     "accountId",
     "zoneId",
     "kvNamespaceId",
-    "kvRuntimeToken",
-    "privateNetworkRuntimeToken",
-    "warp"
+    "apiToken",
+    "mesh",
+    "realtime"
   ].includes(key));
   if (unknown.length)
     throw new Error(`Cloudflare host handoff contains unsupported field ${unknown[0]}`);
@@ -447,17 +739,53 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   try {
     service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.kvRuntimeToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.apiToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
-  if (output.privateNetworkRuntimeToken !== undefined && !TOKEN.test(output.privateNetworkRuntimeToken)) {
-    throw new Error("Cloudflare host handoff private-network capability is malformed");
+  if (output.mesh !== undefined) {
+    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !CONNECTOR_TOKEN.test(output.mesh.connectorToken) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
+      try {
+        return privateMeshCidr(route) !== route;
+      } catch {
+        return true;
+      }
+    })) {
+      throw new Error("Cloudflare host handoff contains malformed Mesh coordinates");
+    }
   }
-  if (Boolean(output.warp) !== Boolean(output.privateNetworkRuntimeToken)) {
-    throw new Error("Cloudflare host handoff private-network resources and capability disagree");
+  if (output.realtime !== undefined) {
+    let realtime;
+    try {
+      const { workerScriptName, endpoint: endpoint2, producer } = output.realtime;
+      realtime = validateCloudflareBootstrapCoordinates({
+        accountId: output.accountId,
+        zoneId: output.zoneId,
+        kvNamespaceId: output.kvNamespaceId,
+        realtime: { workerScriptName, endpoint: endpoint2, producer },
+        nodes: [{
+          nodeName: output.nodeName,
+          hostname: output.hostname,
+          service: output.service,
+          tunnelName: "handoff"
+        }]
+      }).realtime;
+    } catch {
+      throw new Error("Cloudflare host handoff contains malformed realtime coordinates");
+    }
+    if (!REALTIME_SECRET.test(output.realtime.publishSecret) || !REALTIME_SECRET.test(output.realtime.ticketSecret) || output.realtime.publishSecret === output.realtime.ticketSecret || realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
+      throw new Error("Cloudflare host handoff contains malformed realtime credentials");
+    }
   }
   const { format: _format, kind: _kind, ...handoff } = output;
-  return handoff;
+  return {
+    ...handoff,
+    nodeName: normalizedNodeName,
+    hostname: handoff.hostname.toLowerCase(),
+    service,
+    accountId: handoff.accountId.toLowerCase(),
+    zoneId: handoff.zoneId.toLowerCase(),
+    kvNamespaceId: handoff.kvNamespaceId.toLowerCase()
+  };
 }
 async function prepareOwnerOutputDirectory(absolutePath) {
   const directory = dirname(absolutePath);
@@ -513,18 +841,22 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      kvRuntimeToken: output.resources.kvRuntimeToken
+      apiToken: output.resources.apiToken,
+      ...output.coordinates.realtime && output.resources.realtime ? { realtime: {
+        ...output.coordinates.realtime,
+        ...output.resources.realtime
+      } } : {},
+      ...node.mesh ? { mesh: {
+        connectorId: node.mesh.connectorId,
+        connectorToken: node.mesh.connectorToken,
+        routes: node.mesh.routes
+      } } : {}
     };
     await writeOwnerJson(cloudflareHostHandoffPath(checkpointPath, node.nodeName), handoff);
   }
 }
-var tokenFor = (tokens, key) => {
-  const token = tokens[key]?.trim() || tokens.apiToken?.trim();
-  if (!token || !TOKEN.test(token))
-    throw new Error(`Cloudflare ${key} is not configured`);
-  return token;
-};
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+var newRealtimeSecret = () => randomBytes(48).toString("base64url");
 async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
@@ -533,7 +865,46 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
   }
   await prepareOwnerOutputDirectory(absoluteOutput);
-  const kvRuntimeToken = tokenFor(tokens, "kvApiToken");
+  const tunnelToken = tokens.tunnelToken.trim();
+  const apiToken = tokens.apiToken.trim();
+  if (!TOKEN.test(tunnelToken) || !TOKEN.test(apiToken)) {
+    throw new Error("Cloudflare bootstrap tokens are malformed");
+  }
+  if (tunnelToken === apiToken) {
+    throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege capabilities");
+  }
+  await preflightCloudflareKvRuntime(coordinates, apiToken, fetcher);
+  const realtime = coordinates.realtime ? existing?.resources.realtime ?? {
+    publishSecret: newRealtimeSecret(),
+    ticketSecret: newRealtimeSecret()
+  } : undefined;
+  if (coordinates.realtime && realtime) {
+    await verifyCloudflareWorkerDurableObjects({
+      accountId: coordinates.accountId,
+      scriptName: coordinates.realtime.workerScriptName,
+      apiToken
+    }, fetcher);
+    await writeOwnerBootstrapOutput(absoluteOutput, {
+      format: 1,
+      kind: "forgezero-cloudflare-bootstrap",
+      phase: "edge-resources-provisioned",
+      updatedAt: new Date().toISOString(),
+      coordinates,
+      resources: {
+        kvNamespaceId: coordinates.kvNamespaceId,
+        apiToken,
+        realtime,
+        nodes: existing?.resources.nodes ?? []
+      }
+    });
+    await configureCloudflareRealtimeSecrets({
+      accountId: coordinates.accountId,
+      scriptName: coordinates.realtime.workerScriptName,
+      publishSecret: realtime.publishSecret,
+      ticketSecret: realtime.ticketSecret,
+      apiToken
+    }, fetcher);
+  }
   const nodeResources = [];
   const createdNodes = [];
   for (const node of coordinates.nodes) {
@@ -549,14 +920,33 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       const tunnel = await ensureCloudflareTunnel({
         accountId: coordinates.accountId,
         name: node.tunnelName,
-        apiToken: tokenFor(tokens, "tunnelApiToken")
+        apiToken: tunnelToken
       }, fetcher);
       created = tunnel.created;
-      resource = { ...node, tunnelId: tunnel.tunnel.id, connectorToken: tunnel.connectorToken };
+      let mesh;
+      if (node.mesh) {
+        const ensured = await ensureCloudflareMeshConnector({
+          accountId: coordinates.accountId,
+          name: node.mesh.connectorName,
+          highAvailability: node.mesh.highAvailability === true,
+          apiToken: tunnelToken
+        }, fetcher);
+        mesh = {
+          ...node.mesh,
+          connectorId: ensured.connector.id,
+          connectorToken: ensured.connectorToken
+        };
+      }
+      const { mesh: _declaredMesh, ...publicNode } = node;
+      resource = {
+        ...publicNode,
+        tunnelId: tunnel.tunnel.id,
+        connectorToken: tunnel.connectorToken,
+        ...mesh ? { mesh } : {}
+      };
     }
     nodeResources.push(resource);
-    createdNodes.push({ nodeName: node.nodeName, tunnel: created });
-    const first2 = nodeResources[0];
+    createdNodes.push({ nodeName: node.nodeName, tunnel: created, mesh: Boolean(resource.mesh) });
     await writeOwnerBootstrapOutput(absoluteOutput, {
       format: 1,
       kind: "forgezero-cloudflare-bootstrap",
@@ -564,16 +954,34 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       updatedAt: new Date().toISOString(),
       coordinates,
       resources: {
-        tunnelId: first2.tunnelId,
         kvNamespaceId: coordinates.kvNamespaceId,
-        hostname: first2.hostname,
-        service: first2.service,
-        connectorToken: first2.connectorToken,
-        kvRuntimeToken,
+        apiToken,
+        ...realtime ? { realtime } : {},
         nodes: [...nodeResources]
       }
     });
   }
+  const meshResources = nodeResources.filter((node) => node.mesh);
+  for (const node of meshResources) {
+    for (const network of node.mesh.routes) {
+      await ensureCloudflarePrivateRoute({
+        accountId: coordinates.accountId,
+        tunnelId: node.mesh.connectorId,
+        network,
+        comment: `ForgeZero Mesh ${node.nodeName}`,
+        apiToken: tunnelToken
+      }, fetcher);
+    }
+  }
+  if (meshResources.length) {
+    await ensureCloudflareWarpNetworkIncludes({
+      accountId: coordinates.accountId,
+      policyId: coordinates.meshDevicePolicyId,
+      networks: meshResources.flatMap((node) => node.mesh.routes),
+      descriptionPrefix: "ForgeZero Mesh",
+      apiToken: tunnelToken
+    }, fetcher);
+  }
   for (const node of nodeResources) {
     await configureCloudflareEdge({
       accountId: coordinates.accountId,
@@ -581,12 +989,9 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       tunnelId: node.tunnelId,
       hostname: node.hostname,
       service: node.service,
-      apiToken: tokenFor(tokens, "tunnelApiToken"),
-      tunnelApiToken: tokenFor(tokens, "tunnelApiToken"),
-      dnsApiToken: tokenFor(tokens, "dnsApiToken")
+      apiToken: tunnelToken
     }, fetcher);
   }
-  const first = nodeResources[0];
   const output = {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap",
@@ -594,16 +999,12 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     updatedAt: new Date().toISOString(),
     coordinates,
     resources: {
-      tunnelId: first.tunnelId,
       kvNamespaceId: coordinates.kvNamespaceId,
-      hostname: first.hostname,
-      service: first.service,
-      connectorToken: first.connectorToken,
-      kvRuntimeToken,
+      apiToken,
+      ...realtime ? { realtime } : {},
       nodes: nodeResources
     },
     created: {
-      tunnel: createdNodes.some(({ tunnel }) => tunnel),
       nodes: createdNodes
     }
   };
@@ -622,8 +1023,8 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
-  if (!request.tokenFiles || !Object.values(request.tokenFiles).some(Boolean)) {
-    throw new Error("Cloudflare apply requires owner-only management token file paths");
+  if (!request.tokenFiles) {
+    throw new Error("Cloudflare apply requires exactly two owner-only token file paths");
   }
   const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
   const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
@@ -680,20 +1081,114 @@ async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fet
     nodes
   };
 }
+async function readCloudflareBootstrapAcceptanceEvidence(acceptancePath, expectedNodes) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readOwnerOnlyFile(acceptancePath, 65536));
+  } catch (cause) {
+    if (cause instanceof SyntaxError)
+      throw new Error("Cloudflare acceptance evidence is not valid JSON");
+    throw cause;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Cloudflare acceptance evidence is malformed");
+  }
+  const evidence = parsed;
+  if (Object.keys(evidence).some((key) => ![
+    "format",
+    "kind",
+    "checkpointFile",
+    "verifiedAt",
+    "nodes"
+  ].includes(key)) || evidence.format !== 1 || evidence.kind !== "forgezero-cloudflare-bootstrap-acceptance" || typeof evidence.checkpointFile !== "string" || !evidence.checkpointFile || typeof evidence.verifiedAt !== "string" || Number.isNaN(Date.parse(evidence.verifiedAt)) || !Array.isArray(evidence.nodes) || evidence.nodes.length < 1 || evidence.nodes.length > 32) {
+    throw new Error("Cloudflare acceptance evidence is malformed");
+  }
+  const nodes = evidence.nodes.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item) || Object.keys(item).some((key) => !["nodeName", "hostname", "status"].includes(key))) {
+      throw new Error("Cloudflare acceptance evidence contains a malformed node");
+    }
+    const node = item;
+    const nodeName = node.nodeName?.trim().toLowerCase();
+    const hostname = node.hostname?.trim().toLowerCase();
+    if (!nodeName || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(nodeName) || !hostname || !HOSTNAME.test(hostname) || !Number.isInteger(node.status) || node.status < 200 || node.status > 299) {
+      throw new Error("Cloudflare acceptance evidence contains a malformed node");
+    }
+    return { nodeName, hostname, status: node.status };
+  });
+  if (new Set(nodes.map(({ nodeName }) => nodeName)).size !== nodes.length || new Set(nodes.map(({ hostname }) => hostname)).size !== nodes.length) {
+    throw new Error("Cloudflare acceptance evidence contains duplicate nodes");
+  }
+  if (expectedNodes) {
+    const expected = expectedNodes.map(({ nodeName, hostname }) => ({
+      nodeName: nodeName.trim().toLowerCase(),
+      hostname: hostname.trim().toLowerCase()
+    })).sort((left, right) => left.nodeName.localeCompare(right.nodeName));
+    const observed = nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname })).sort((left, right) => left.nodeName.localeCompare(right.nodeName));
+    if (JSON.stringify(observed) !== JSON.stringify(expected)) {
+      throw new Error("Cloudflare acceptance evidence does not cover the declared platform fleet");
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-acceptance",
+    checkpointFile: evidence.checkpointFile,
+    verifiedAt: evidence.verifiedAt,
+    nodes
+  };
+}
+async function removeCloudflareBootstrapSecrets(checkpointPath, output) {
+  const directory = `${resolve(checkpointPath)}.hosts`;
+  let entries;
+  try {
+    const metadata = await lstat(directory);
+    const uid = ownerUid();
+    if (!metadata.isDirectory() || metadata.isSymbolicLink() || uid !== undefined && metadata.uid !== uid || (metadata.mode & 63) !== 0) {
+      throw new Error(`Cloudflare host handoff directory ${directory} is not owner-only`);
+    }
+    entries = await readdir(directory);
+  } catch (cause) {
+    if (cause.code !== "ENOENT")
+      throw cause;
+  }
+  if (entries) {
+    const expected = output.coordinates.nodes.map(({ nodeName }) => `${nodeName}.json`).sort();
+    if (JSON.stringify([...entries].sort()) !== JSON.stringify(expected)) {
+      throw new Error("Cloudflare host handoff directory contains unexpected files; refusing secret cleanup");
+    }
+    for (const name of expected)
+      await unlink(join(directory, name));
+    await rmdir(directory);
+  }
+  await unlink(resolve(checkpointPath));
+}
+async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
+  const checkpointPath = resolve(request.checkpointPath);
+  const acceptancePath = resolve(request.acceptancePath);
+  if (acceptancePath === checkpointPath || acceptancePath.startsWith(`${checkpointPath}.hosts/`)) {
+    throw new Error("Cloudflare acceptance evidence must be outside the secret checkpoint and handoff directory");
+  }
+  const output = await readExistingOutput(checkpointPath);
+  if (!output || output.phase !== "complete")
+    throw new Error("Cloudflare finalization requires a completed owner checkpoint");
+  const evidence = await verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher);
+  await writeOwnerJson(acceptancePath, evidence);
+  await removeCloudflareBootstrapSecrets(checkpointPath, output);
+  return evidence;
+}
 
 // src/bootstrap.ts
-import { createHash, createHmac, randomBytes } from "crypto";
+import { createHash, createHmac, randomBytes as randomBytes3 } from "crypto";
 import {
-  chmodSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  writeFileSync
+  chmodSync as chmodSync2,
+  existsSync as existsSync3,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname4 } from "path";
 import { fileURLToPath } from "url";
 
 // src/agent-update-helper.ts
@@ -712,53 +1207,79 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.40";
+var VERSION = "0.1.42";
 
 // src/software.ts
-var BUN_INSTALLER_SHA256 = "bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd";
-var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
-var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
-var UBUNTU_2604_X64 = [
-  {
-    requirement: { id: "bun", version: "1.3.14" },
-    check: 'test "$(/usr/local/bin/bun --version 2>/dev/null)" = 1.3.14',
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL https://bun.sh/install -o "$tmp/install"; ` + `echo "${BUN_INSTALLER_SHA256}  $tmp/install" | sha256sum -c -; ` + `BUN_INSTALL="$tmp/bun" BUN_VERSION=1.3.14 bash "$tmp/install" >/dev/null; ` + `install -d -m 0755 /usr/local/lib/forgezero/runtime; ` + `install -m 0755 "$tmp/bun/bin/bun" /usr/local/lib/forgezero/runtime/bun.next; ` + `mv -Tf /usr/local/lib/forgezero/runtime/bun.next /usr/local/lib/forgezero/runtime/bun; ` + `ln -sfn /usr/local/lib/forgezero/runtime/bun /usr/local/bin/bun`
-  },
-  {
-    requirement: { id: "nginx", version: "ubuntu-26.04" },
-    check: "command -v nginx >/dev/null && systemctl is-active --quiet nginx",
-    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y nginx && systemctl enable --now nginx"
-  },
-  {
-    requirement: { id: "arangodb", version: "3.11.14" },
-    check: `arangod --version 2>/dev/null | head -1 | grep -q '3.11.14' && ` + `! systemctl is-active --quiet arangodb3.service && ` + `! systemctl is-enabled --quiet arangodb3.service`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb' -o "$tmp/arangodb.deb"; ` + `echo "${ARANGO_SHA256}  $tmp/arangodb.deb" | sha256sum -c -; ` + `DEBIAN_FRONTEND=noninteractive dpkg -i "$tmp/arangodb.deb" >/dev/null 2>&1 || ` + `DEBIAN_FRONTEND=noninteractive apt-get -y -f install; ` + `systemctl disable --now arangodb3.service`
+var PINNED_BUN_VERSION = "1.3.14";
+var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+
+// src/service-supervisor.ts
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2, resolve as resolve2, sep } from "path";
+
+// src/definition.ts
+var RESERVED_STEP_ENV = new Set([
+  "PATH",
+  "HOME",
+  "SHELL",
+  "PWD",
+  "BUN_INSTALL",
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "GIT_SSH",
+  "GIT_SSH_COMMAND"
+]);
+
+// src/service-supervisor.ts
+var defaultHost = {
+  write(path, content, mode) {
+    mkdirSync(dirname2(path), { recursive: true, mode: 493 });
+    const next = `${path}.next`;
+    writeFileSync(next, content, { mode });
+    renameSync(next, path);
   },
-  {
-    requirement: { id: "cloudflared", version: "2026.7.3" },
-    check: `cloudflared --version 2>/dev/null | grep -q '2026.7.3'`,
-    install: `tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT; ` + `curl -fsSL 'https://github.com/cloudflare/cloudflared/releases/download/2026.7.3/cloudflared-linux-amd64' -o "$tmp/cloudflared"; ` + `echo "${CLOUDFLARED_SHA256}  $tmp/cloudflared" | sha256sum -c -; ` + `install -m 0755 "$tmp/cloudflared" /usr/local/bin/cloudflared`
+  read: (path) => readFileSync(path, "utf8"),
+  exists: existsSync,
+  list: (path) => existsSync(path) ? readdirSync(path) : [],
+  realpath: realpathSync,
+  mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
+  remove: (path) => rmSync(path, { force: true }),
+  async exec(argv) {
+    const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: {
+      PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      LANG: "C",
+      LC_ALL: "C"
+    } });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}` };
   },
-  {
-    requirement: { id: "ufw", version: "ubuntu-26.04" },
-    check: "command -v ufw >/dev/null",
-    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y ufw"
+  async health(port, path) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, {
+        signal: AbortSignal.timeout(2000),
+        redirect: "manual"
+      });
+      return response.status >= 200 && response.status < 300;
+    } catch {
+      return false;
+    }
   },
-  {
-    requirement: { id: "openssh-client", version: "ubuntu-26.04" },
-    check: "command -v ssh >/dev/null && command -v scp >/dev/null && command -v ssh-keyscan >/dev/null && command -v ssh-keygen >/dev/null",
-    install: "DEBIAN_FRONTEND=noninteractive apt-get update -qq && apt-get install -y openssh-client"
-  }
-];
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
 
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
 var SOFTWARE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-software-helper.service";
-var MAX_REQUEST_BYTES2 = 8 * 1024;
+var MAX_REQUEST_BYTES2 = 128 * 1024;
 
 // src/egress-policy.ts
-var AGENT_EGRESS_TABLE = "forgezero_agent_egress";
 var SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
 var BLOCKED_IPV4 = [
   "0.0.0.0/8",
@@ -818,7 +1339,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/provision.ts
-import { isIP as isIP2 } from "net";
+import { isIP as isIP3 } from "net";
 function atLeast(version, floor) {
   const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
   const got = parse(version);
@@ -837,22 +1358,26 @@ function atLeast(version, floor) {
 }
 var CAPABILITY_CHECKS = {
   snpGuest: {
-    command: "test -e /dev/sev-guest && echo yes || echo no",
+    command: "fz host check-device /dev/sev-guest",
+    operation: { kind: "path-exists", path: "/dev/sev-guest", nodeType: "file" },
     satisfied: (stdout) => stdout.trim() === "yes",
     remedy: "Not a confidential guest. The agent will run in `enrolled` mode, which is still stronger than an API key in the application."
   },
   systemd: {
-    command: "test -d /run/systemd/system && echo yes || echo no",
+    command: "fz host check-directory /run/systemd/system",
+    operation: { kind: "path-exists", path: "/run/systemd/system", nodeType: "directory" },
     satisfied: (stdout) => stdout.trim() === "yes",
     remedy: "systemd is what supervises the agent. On a non-systemd host, run `fz-agent` under whatever supervises services there."
   },
   bun: {
-    command: "bun --version 2>/dev/null || echo missing",
+    command: "fz host check-version bun",
+    operation: { kind: "version", argv: ["/usr/local/bin/bun", "--version"] },
     satisfied: (stdout) => atLeast(stdout, "1.1.0"),
-    remedy: "Install bun: curl -fsSL https://bun.sh/install | bash"
+    remedy: "Install the pinned Bun release with `fz bootstrap`."
   },
   python: {
-    command: "python3 --version 2>/dev/null || echo missing",
+    command: "fz host check-version python3",
+    operation: { kind: "version", argv: ["/usr/bin/python3", "--version"] },
     satisfied: (stdout, exitCode) => exitCode === 0 && /^Python 3\./.test(stdout.trim()),
     remedy: "Install Python 3. It supplies the standard-library ioctl boundary for SNP reports."
   }
@@ -860,6 +1385,7 @@ var CAPABILITY_CHECKS = {
 var modeFor = (capabilities) => capabilities.snpGuest ? "attested" : "enrolled";
 var reasonFor = (mode) => mode === "attested" ? "SEV-SNP guest device present, so the agent can prove what it is running and the platform can refuse it if the measurement is wrong." : "No SEV-SNP guest device. The agent authenticates with its enrolment token and hybrid Ed25519 + ML-DSA signature \u2014 weaker than attestation, stronger than an API key in the application.";
 var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
+var APPLICATION_RUNTIME_USER = "forgezero-app";
 var DEPLOYMENT_GROUP = "forgezero-deploy";
 var VAULT_GROUP = "forgezero-vault";
 var LIFECYCLE_GROUP = "forgezero-lifecycle";
@@ -889,11 +1415,7 @@ function agentEgressUnit(options) {
     systemdAgentEgressDirectives(runnerLoopbackPorts);
   const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
   const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
-  const policyProofs = deploymentEnabled ? [
-    ...runnerLoopbackPorts.length > 0 ? [`loopback=.*:${runnerLoopbackPorts.join(",")}`] : [],
-    `public-tcp=${runnerPublicTcpPorts.join(",")}`
-  ].map((pattern) => `ExecStartPost=/bin/sh -c '/usr/sbin/nft --numeric list table inet ${AGENT_EGRESS_TABLE} | /usr/bin/grep -q "${pattern}"'`).join(`
-`) : "";
+  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}`;
   return `[Unit]
 Description=ForgeZero Agent host egress policy
 Documentation=https://www.forgezero.net/docs/agent
@@ -907,7 +1429,7 @@ NotifyAccess=all
 User=root
 Group=root
 ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
-${policyProofs}
+${policyProof}
 Restart=on-failure
 RestartSec=2
 LimitCORE=0
@@ -931,6 +1453,7 @@ WantedBy=multi-user.target
 }
 function softwareHelperUnit(options) {
   const bin = options.binPath ?? "fz-agent";
+  const root = options.deployRoot ?? "/opt/forgezero";
   return `[Unit]
 Description=ForgeZero declarative software strategy helper
 Documentation=https://www.forgezero.net/docs/agent
@@ -942,6 +1465,7 @@ Type=simple
 User=root
 Group=${SOFTWARE_HELPER_GROUP}
 Environment=FZ_SOFTWARE_HELPER_SOCKET=${DEFAULT_SOFTWARE_HELPER_SOCKET}
+Environment=FZ_DEPLOY_ROOT=${root}
 ExecStart=${bin} software-helper
 Restart=always
 RestartSec=2
@@ -1057,10 +1581,6 @@ var systemdPath = (value, label) => {
     throw new Error(`invalid ${label} path`);
   return value;
 };
-var awaitSocketCommand = (path) => {
-  const socket = systemdPath(path, "readiness socket");
-  return `for attempt in $(seq 1 100); do test -S ${socket} && exit 0; sleep 0.1; done; exit 1`;
-};
 var validNodeHostname = (value) => !value || value.length <= 253 && value === value.toLowerCase() && value.split(".").length >= 3 && value.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
 function warpConfigUnit(options) {
   if (!options.warpOrganization || !/^[a-z0-9][a-z0-9-]{0,62}$/i.test(options.warpOrganization)) {
@@ -1161,6 +1681,8 @@ function agentEnrolmentUnit(options) {
   const hostname = options.nodeHostname ? `Environment=FZ_NODE_HOSTNAME=${options.nodeHostname}
 ` : "";
   const gitPublicKey = options.gitPublicKeyPath ? `Environment=FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}
+` : "";
+  const bootstrapSshPublicKey = options.bootstrapSshPublicKeyPath ? `Environment=FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE=${options.bootstrapSshPublicKeyPath}
 ` : "";
   const networkAttachment = [
     options.cloudflareAccountId ? `Environment=FZ_CF_ACCOUNT_ID=${options.cloudflareAccountId}
@@ -1195,7 +1717,7 @@ Environment=FZ_SEED_CREDENTIAL=agent-seed
 Environment=FZ_ENROL_TOKEN_CREDENTIAL=enrol-token
 Environment=FZ_ENROL_STATE_FILE=${options.enrolStatePath}
 Environment=FZ_API=${options.apiUrl}
-${label}${hostname}${gitPublicKey}${networkAttachment}ExecStart=${bin} enrol
+${label}${hostname}${gitPublicKey}${bootstrapSshPublicKey}${networkAttachment}ExecStart=${bin} enrol
 # A '+' fixed command runs as root solely to remove the host-bound one-time
 # ciphertext. Tenant code and the agent never receive a privilege boundary.
 ExecStartPost=+/usr/bin/rm -f ${options.enrolTokenCredentialPath}
@@ -1275,7 +1797,7 @@ function agentUnit(options) {
     } catch {
       throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
     }
-    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP2(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
+    if (endpoint2.protocol !== "https:" || endpoint2.username || endpoint2.password || endpoint2.search || endpoint2.hash || isIP3(endpoint2.hostname) !== 0 || !endpoint2.hostname.includes(".") || endpoint2.hostname === "localhost" || endpoint2.hostname.endsWith(".local"))
       throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
     telemetryEndpoint = endpoint2.toString().replace(/\/$/, "");
   }
@@ -1289,9 +1811,14 @@ function agentUnit(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([options.pullBootstrap, options.bootstrapSshCredentialPath, options.bootstrapTargetTelemetryEndpoint].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential and target telemetry endpoint must be supplied together");
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([
+    options.pullBootstrap,
+    options.bootstrapSshCredentialPath,
+    options.bootstrapSshPublicKeyPath,
+    options.bootstrapTargetTelemetryEndpoint
+  ].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
   }
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
   const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
@@ -1362,6 +1889,7 @@ function agentUnit(options) {
     options.pullMigrations ? "FZ_MIGRATION_PULL=true" : null,
     options.pullBootstrap ? "FZ_BOOTSTRAP_PULL=true" : null,
     options.pullBootstrap ? "FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL=bootstrap-ssh-key" : null,
+    options.pullBootstrap && options.bootstrapSshPublicKeyPath ? `FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE=${options.bootstrapSshPublicKeyPath}` : null,
     options.pullBootstrap ? `FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT=${options.bootstrapTargetTelemetryEndpoint}` : null,
     `FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}`,
     options.pullMigrations ? `FZ_LIFECYCLE_HELPER_SOCKET=${lifecycleHelperSocketPath}` : null
@@ -1467,6 +1995,55 @@ ${deploymentWrites}
 WantedBy=multi-user.target
 `;
 }
+var renderOperation = (operation) => {
+  if (operation.kind === "commands")
+    return operation.commands.map(({ argv }) => argv.join(" ")).join(`
+`);
+  if (operation.kind === "directories")
+    return operation.directories.map((directory) => [
+      "/usr/bin/install",
+      "-d",
+      ...directory.owner ? ["-o", directory.owner] : [],
+      ...directory.group ? ["-g", directory.group] : [],
+      "-m",
+      directory.mode.toString(8).padStart(4, "0"),
+      directory.path
+    ].join(" ")).join(`
+`);
+  if (operation.kind === "install-runtime")
+    return `/usr/bin/install -m 0755 ${operation.source} /opt/forgezero/agent/versions/${operation.version}/dist/fz-agent.js`;
+  if (operation.kind === "ensure-seed")
+    return `/usr/bin/systemd-creds encrypt --name=agent-seed - ${operation.credential}`;
+  if (operation.kind === "ensure-git-identity")
+    return `/usr/bin/ssh-keygen -t ed25519
+/usr/bin/systemd-creds encrypt --name=git-deploy-key <private> ${operation.credential}
+fz host write-public-key ${operation.publicKey}`;
+  if (operation.kind === "ensure-bootstrap-ssh-identity")
+    return `/usr/bin/ssh-keygen -t ed25519
+/usr/bin/systemd-creds encrypt --name=bootstrap-ssh-key <private> ${operation.credential}
+fz host write-public-key ${operation.publicKey}`;
+  if (operation.kind === "ensure-enrolment")
+    return `/usr/bin/systemd-creds encrypt --name=enrol-token ${operation.source} ${operation.credential}
+/usr/bin/rm -f ${operation.source}`;
+  if (operation.kind === "wait-socket")
+    return `fz host wait-socket ${operation.path}`;
+  if (operation.kind === "verify-file")
+    return `fz host verify-file ${operation.path}`;
+  if (operation.kind === "verify-egress")
+    return `/usr/sbin/nft --numeric list table inet forgezero_agent_egress
+fz-agent egress-policy-check`;
+  if (operation.kind === "verify-resolved-stub")
+    return "fz host verify-resolved-stub /run/systemd/resolve/stub-resolv.conf";
+  if (operation.kind === "install-warp")
+    return "/usr/bin/apt-get install -y cloudflare-warp";
+  return "/usr/bin/warp-cli --accept-tos status";
+};
+var step = (label, operation, optional = false) => ({
+  label,
+  operation,
+  optional: optional || undefined,
+  command: renderOperation(operation)
+});
 var UNIT_PATH = "/etc/systemd/system/forgezero-agent.service";
 function planProvision(options) {
   const mode = options.mode;
@@ -1481,9 +2058,15 @@ function planProvision(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([options.pullBootstrap, options.bootstrapSshCredentialPath, options.bootstrapTargetTelemetryEndpoint].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential and target telemetry endpoint must be supplied together");
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([
+    options.pullBootstrap,
+    options.bootstrapSshCredentialPath,
+    options.bootstrapSshPublicKeyPath,
+    options.bootstrapSshSourcePath,
+    options.bootstrapTargetTelemetryEndpoint
+  ].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
   }
   const warpValues = [
     options.warpOrganization,
@@ -1511,8 +2094,29 @@ function planProvision(options) {
   const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
   const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshPublicKeyPath = bootstrapEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
+  const bootstrapSshSourcePath = options.bootstrapSshSourcePath ? systemdPath(options.bootstrapSshSourcePath, "bootstrap SSH private-key source") : undefined;
+  const bootstrapSshPublicKeyDir = bootstrapSshPublicKeyPath?.replace(/\/[^/]+$/, "");
   const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
   const warpClientSecretCredentialPath = warpEnabled ? systemdPath(options.warpClientSecretCredentialPath, "WARP client-secret credential") : undefined;
+  const enabledUnits = [
+    "forgezero-agent.socket",
+    "forgezero-agent-update-helper.service",
+    ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
+    ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
+    ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
+    "forgezero-agent.service"
+  ];
+  const restartedUnits = [
+    "forgezero-agent-update-helper.service",
+    ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
+    ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
+    ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
+  ];
   return {
     mode,
     reason: reasonFor(mode),
@@ -1557,157 +2161,117 @@ function planProvision(options) {
     socketPath: options.socketPath,
     user,
     steps: [
-      ...options.enforceEgress ? [{
-        label: "Ubuntu Agent egress prerequisites",
-        command: `. /etc/os-release; test "$ID" = ubuntu; ` + `DEBIAN_FRONTEND=noninteractive apt-get update -qq; ` + `DEBIAN_FRONTEND=noninteractive apt-get install -y nftables; ` + `systemctl enable --now systemd-resolved.service; ` + `test "$(readlink -f /etc/resolv.conf)" = /run/systemd/resolve/stub-resolv.conf; ` + `test -s /run/systemd/resolve/stub-resolv.conf`
-      }] : [],
-      {
-        label: "vault socket access group",
-        command: `groupadd --system ${VAULT_GROUP} || true`
-      },
-      {
-        label: "Agent update helper access group",
-        command: `groupadd --system ${AGENT_UPDATE_GROUP} || true`
-      },
-      ...sourceBinPath && binPath ? [{
-        label: "root-owned agent runtime",
-        command: `install -d -o root -g root -m 0755 ${binPath.replace(/\/[^/]+$/, "")} ` + `${DEFAULT_AGENT_RELEASE_ROOT}/versions/${VERSION}/dist; ` + `install -o root -g root -m 0755 ${sourceBinPath} ` + `${DEFAULT_AGENT_RELEASE_ROOT}/versions/${VERSION}/dist/fz-agent.js; ` + `ln -sfn versions/${VERSION} ${DEFAULT_AGENT_RELEASE_ROOT}/current.next; ` + `mv -Tf ${DEFAULT_AGENT_RELEASE_ROOT}/current.next ${DEFAULT_AGENT_RELEASE_ROOT}/current; ` + `rm -f ${binPath}; ln -s ${DEFAULT_AGENT_RELEASE_ROOT}/current/dist/fz-agent.js ${binPath}`
-      }] : [],
-      ...warpEnabled ? [{
-        label: "Cloudflare One client for Ubuntu 26.04",
-        command: `. /etc/os-release; test "$ID" = ubuntu && test "$VERSION_ID" = 26.04; ` + `install -d -m 0755 /usr/share/keyrings /etc/apt/sources.list.d /etc/systemd/system/warp-svc.service.d; ` + `curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg -o /run/cloudflare-warp-key.gpg; ` + `gpg --batch --yes --dearmor -o /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg /run/cloudflare-warp-key.gpg; ` + `rm -f /run/cloudflare-warp-key.gpg; ` + `printf 'deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ %s main\\n' "$VERSION_CODENAME" > /etc/apt/sources.list.d/cloudflare-client.list; ` + `apt-get update -qq; DEBIAN_FRONTEND=noninteractive apt-get install -y cloudflare-warp`
-      }] : [],
-      ...deploymentEnabled ? [{
-        label: "deployment isolation group",
-        command: `groupadd --system ${DEPLOYMENT_GROUP} || true; groupadd --system ${SOFTWARE_HELPER_GROUP} || true`
-      }] : [],
-      ...lifecycleEnabled ? [{
-        label: "lifecycle helper access group",
-        command: `groupadd --system ${LIFECYCLE_GROUP} || true`
-      }] : [],
-      {
-        label: "service account",
-        command: `useradd --system --no-create-home --shell /usr/sbin/nologin ${user} || true`
-      },
-      {
-        label: "bind service account to vault group",
-        command: `usermod -g ${VAULT_GROUP} ${user}`
-      },
-      {
-        label: "grant verified Agent update access",
-        command: `usermod -a -G ${AGENT_UPDATE_GROUP} ${user}`
-      },
-      ...lifecycleEnabled ? [{
-        label: "grant lifecycle helper socket access",
-        command: `usermod -a -G ${LIFECYCLE_GROUP} ${user}`
-      }] : [],
-      ...deploymentEnabled ? [{
-        label: "credential-free deployment account",
-        command: `useradd --system --no-create-home --shell /usr/sbin/nologin --gid ${DEPLOYMENT_GROUP} ${DEPLOYMENT_RUNNER_USER} || true; ` + `usermod -a -G ${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP} ${user}`
-      }] : [],
-      {
-        label: "credential directory",
-        command: `install -d -o root -g root -m 0700 ${credentialDir}`
-      },
-      {
-        label: "Agent state directory",
-        command: "install -d -o root -g root -m 0750 /var/lib/forgezero"
-      },
-      {
-        label: "encrypted node identity",
-        command: `test -s ${seedCredentialPath} || { ` + `openssl rand -base64 32 | tr '+/' '-_' | tr -d '=\\n' | ` + `systemd-creds encrypt --name=agent-seed - ${seedCredentialPath}; ` + `chmod 0400 ${seedCredentialPath}; }`
-      },
+      ...options.enforceEgress ? [step("Ubuntu Agent egress prerequisites", { kind: "commands", commands: [
+        { argv: ["/usr/bin/apt-get", "update", "-qq"] },
+        { argv: ["/usr/bin/apt-get", "install", "-y", "nftables"] },
+        { argv: ["/usr/bin/systemctl", "enable", "--now", "systemd-resolved.service"] }
+      ] }), step("prove systemd-resolved stub ownership", { kind: "verify-resolved-stub" })] : [],
+      step("vault socket access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", VAULT_GROUP], acceptedExitCodes: [0, 9] }] }),
+      step("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
+      ...sourceBinPath && binPath ? [step("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION })] : [],
+      ...warpEnabled ? [step("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
+      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
+        { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
+      ] })] : [],
+      ...lifecycleEnabled ? [step("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
+      step("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
+      step("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
+      step("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      ...lifecycleEnabled ? [step("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
+      ...deploymentEnabled ? [step("credential-free deployment account", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
+        { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
+        { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
+        { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
+      ] })] : [],
+      step("credential and state directories", { kind: "directories", directories: [
+        { path: credentialDir, mode: 448, owner: "root", group: "root" },
+        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
+      ] }),
+      step("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
       ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
-        {
-          label: "Git deploy identity directory",
-          command: `install -d -o root -g root -m 0755 ${gitPublicKeyDir}`
-        },
-        {
-          label: "unique encrypted Git deploy identity",
-          command: `test -s ${gitCredentialPath} || { ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; ` + `ssh-keygen -q -t ed25519 -N '' -C forgezero-compute -f /run/forgezero-git-deploy-key; ` + `systemd-creds encrypt --name=git-deploy-key /run/forgezero-git-deploy-key ${gitCredentialPath}; ` + `install -o root -g root -m 0444 /run/forgezero-git-deploy-key.pub ${gitPublicKeyPath}; ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; ` + `chmod 0400 ${gitCredentialPath}; }; ` + `test -s ${gitPublicKeyPath} || { ` + `systemd-creds decrypt --name=git-deploy-key ${gitCredentialPath} /run/forgezero-git-deploy-key; ` + `ssh-keygen -y -f /run/forgezero-git-deploy-key | ` + `sed 's/$/ forgezero-compute/' > /run/forgezero-git-deploy-key.pub; ` + `install -o root -g root -m 0444 /run/forgezero-git-deploy-key.pub ${gitPublicKeyPath}; ` + `rm -f /run/forgezero-git-deploy-key /run/forgezero-git-deploy-key.pub; }; ` + `test -s ${gitCredentialPath} && test -s ${gitPublicKeyPath}`
-        }
+        step("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
+        step("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
+      ] : [],
+      ...bootstrapEnabled ? [
+        step("bootstrap SSH public identity directory", { kind: "directories", directories: [
+          { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
+        ] }),
+        step("unique encrypted bootstrap SSH identity", {
+          kind: "ensure-bootstrap-ssh-identity",
+          credential: bootstrapSshCredentialPath,
+          publicKey: bootstrapSshPublicKeyPath,
+          ...bootstrapSshSourcePath ? { source: bootstrapSshSourcePath } : {}
+        })
       ] : [],
       ...enrolmentEnabled ? [
-        {
-          label: "enrolment state directory",
-          command: `install -d -o ${user} -g ${user} -m 0700 ${enrolStateDir}`
-        },
-        {
-          label: "encrypted one-time enrolment capability",
-          command: `test -s ${enrolStatePath} || test -s ${enrolTokenCredentialPath} || { test -r ${enrolTokenSourcePath}; ` + `systemd-creds encrypt --name=enrol-token ${enrolTokenSourcePath} ${enrolTokenCredentialPath}; ` + `chmod 0400 ${enrolTokenCredentialPath}; rm -f ${enrolTokenSourcePath}; }`
-        }
+        step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
+        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
       ] : [],
-      ...deploymentEnabled ? [{
-        label: "deployment directories",
-        command: `install -d -o root -g root -m 0755 ${deployRoot} && ` + `install -d -o root -g ${DEPLOYMENT_GROUP} -m 3770 ${deployRoot}/releases && ` + `install -d -o ${user} -g ${user} -m 0750 ${deployRoot}/cache && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/capacity && ` + `install -d -o ${user} -g ${user} -m 0700 ${deployRoot}/agent-home && ` + `install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0700 ${deployRoot}/runner-home ${deployRoot}/runner-home/cache`
-      }] : [],
-      { label: "reload units", command: "systemctl daemon-reload" },
-      ...deploymentEnabled ? [{
-        label: "remove unsupported deployment socket activation",
-        command: "systemctl disable --now forgezero-deploy-runner.socket 2>/dev/null || true; rm -f /etc/systemd/system/forgezero-deploy-runner.socket; systemctl daemon-reload"
-      }] : [],
-      {
-        label: "enable and converge services",
-        command: `systemctl enable ${[
-          "forgezero-agent.socket",
-          "forgezero-agent-update-helper.service",
-          ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-          ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
-          ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
-          ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
-          ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
-          "forgezero-agent.service"
-        ].join(" ")}; systemctl reset-failed forgezero-agent.service || true; systemctl restart ${[
-          "forgezero-agent-update-helper.service",
-          ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
-          ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
-          ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
-          ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
-          ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
-        ].join(" ")}; systemctl restart forgezero-agent.socket; systemctl reset-failed forgezero-agent.service || true; systemctl restart forgezero-agent.service`
-      },
-      ...enrolmentEnabled ? [{
-        label: "prove the compute binding is durable",
-        command: `test -s ${enrolStatePath}`
-      }] : [],
-      ...options.enforceEgress ? [{
-        label: "prove the Agent egress policy is active",
-        command: "systemctl is-active forgezero-agent-egress.service && " + "nft --numeric list table inet forgezero_agent_egress | grep -q forgezero-agent-egress-v1" + (deploymentEnabled ? ` && nft --numeric list table inet forgezero_agent_egress | grep -q 'public-tcp=${runnerPublicTcpPorts.join(",")}'` + (runnerLoopbackPorts.length > 0 ? ` && nft --numeric list table inet forgezero_agent_egress | grep -Eq 'loopback=[0-9]+:${runnerLoopbackPorts.join(",")}( |")'` : "") : "")
-      }] : [],
-      { label: "prove it is running", command: "systemctl is-active forgezero-agent.service" },
-      { label: "prove the public Vault socket exists", command: awaitSocketCommand(options.socketPath) },
-      { label: "prove the Agent Vault backend exists", command: awaitSocketCommand(agentBackendSocketPath(options.socketPath)) },
-      { label: "prove the Agent update helper exists", command: awaitSocketCommand(DEFAULT_AGENT_UPDATE_SOCKET) },
-      ...deploymentEnabled ? [{
-        label: "prove the deployment runner socket exists",
-        command: awaitSocketCommand(DEPLOYMENT_RUNNER_SOCKET)
-      }, {
-        label: "prove the software strategy helper socket exists",
-        command: awaitSocketCommand(DEFAULT_SOFTWARE_HELPER_SOCKET)
-      }] : [],
-      ...lifecycleEnabled ? [{
-        label: "prove the lifecycle helper socket exists",
-        command: awaitSocketCommand(lifecycleHelperSocketPath)
-      }] : [],
-      ...warpEnabled ? [{
-        label: "prove Cloudflare WARP is connected",
-        command: `warp-cli --accept-tos status | grep -Eiq '(^|[[:space:]])Connected([[:space:]]|$)'`
-      }] : [],
-      ...options.repository ? [{
-        label: "prove the deployment control socket exists",
-        command: awaitSocketCommand(options.controlSocketPath ?? "/run/forgezero/control.sock")
-      }] : []
+      ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
+        { path: deployRoot, mode: 493, owner: "root", group: "root" },
+        { path: `${deployRoot}/releases`, mode: 2040, owner: "root", group: DEPLOYMENT_GROUP },
+        { path: `${deployRoot}/cache`, mode: 488, owner: user, group: user },
+        { path: `${deployRoot}/capacity`, mode: 448, owner: user, group: user },
+        { path: `${deployRoot}/agent-home`, mode: 448, owner: user, group: user },
+        { path: `${deployRoot}/runner-home`, mode: 448, owner: DEPLOYMENT_RUNNER_USER, group: DEPLOYMENT_GROUP },
+        { path: `${deployRoot}/runner-home/cache`, mode: 448, owner: DEPLOYMENT_RUNNER_USER, group: DEPLOYMENT_GROUP },
+        { path: `${deployRoot}/app-home`, mode: 448, owner: APPLICATION_RUNTIME_USER, group: VAULT_GROUP }
+      ] })] : [],
+      step("reload units", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "daemon-reload"] }] }),
+      ...deploymentEnabled ? [step("remove unsupported deployment socket activation", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-deploy-runner.socket"], acceptedExitCodes: [0, 1, 5] },
+        { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
+        { argv: ["/usr/bin/systemctl", "daemon-reload"] }
+      ] })] : [],
+      step("enable and converge services", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
+        { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
+        ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
+        { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.socket"] },
+        { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
+        { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
+      ] }),
+      ...enrolmentEnabled ? [step("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
+      ...options.enforceEgress ? [step("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      step("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
+      step("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
+      step("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
+      step("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      ...deploymentEnabled ? [
+        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
+        step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+      ] : [],
+      ...lifecycleEnabled ? [step("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
+      ...warpEnabled ? [step("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
+      ...options.repository ? [step("prove the deployment control socket exists", { kind: "wait-socket", path: options.controlSocketPath ?? "/run/forgezero/control.sock", attempts: 100, intervalMs: 100 })] : []
     ]
   };
 }
 
 // src/cli/agent-install.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  realpathSync as realpathSync2,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  symlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3 } from "path";
 async function readCapabilities(run) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
   for (const [id, check] of checks) {
     try {
-      const result = await run(check.command);
+      const result = await run(check.operation);
       answers[id] = check.satisfied(result.stdout, result.exitCode);
     } catch {
       answers[id] = false;
@@ -1715,10 +2279,253 @@ async function readCapabilities(run) {
   }
   return answers;
 }
-async function localRunner(command) {
-  const proc = Bun.spawn(["sh", "-c", command], { stdout: "pipe", stderr: "pipe" });
-  const stdout = await new Response(proc.stdout).text();
-  return { stdout, exitCode: await proc.exited };
+var fixed = async (argv, stdin) => {
+  const child = Bun.spawn([...argv], {
+    stdin: stdin === undefined ? "ignore" : "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
+  });
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
+    child.stdin.write(stdin);
+    child.stdin.end();
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { stdout: `${stdout}${stderr}`, exitCode };
+};
+var runProvisionOperation = async (operation) => {
+  if (operation.kind === "commands") {
+    let output = "";
+    for (const command of operation.commands) {
+      const result = await fixed(command.argv);
+      output += result.stdout;
+      if (!(command.acceptedExitCodes ?? [0]).includes(result.exitCode))
+        return { stdout: output, exitCode: result.exitCode };
+    }
+    return { stdout: output, exitCode: 0 };
+  }
+  if (operation.kind === "directories") {
+    for (const directory of operation.directories) {
+      const argv = ["/usr/bin/install", "-d", "-m", directory.mode.toString(8).padStart(4, "0")];
+      if (directory.owner)
+        argv.push("-o", directory.owner);
+      if (directory.group)
+        argv.push("-g", directory.group);
+      argv.push(directory.path);
+      const result = await fixed(argv);
+      if (result.exitCode !== 0)
+        return result;
+    }
+    return { stdout: "", exitCode: 0 };
+  }
+  if (operation.kind === "install-runtime") {
+    const release = `/opt/forgezero/agent/versions/${operation.version}`;
+    mkdirSync2(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync2(dirname3(operation.binary), { recursive: true, mode: 493 });
+    copyFileSync(operation.source, `${release}/dist/fz-agent.js`);
+    chmodSync(`${release}/dist/fz-agent.js`, 493);
+    const gitSshSource = `${dirname3(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync2(gitSshSource))
+      return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
+    copyFileSync(gitSshSource, `${release}/dist/fz-git-ssh.js`);
+    chmodSync(`${release}/dist/fz-git-ssh.js`, 493);
+    const pending = "/opt/forgezero/agent/current.next";
+    rmSync2(pending, { force: true });
+    symlinkSync(`versions/${operation.version}`, pending);
+    renameSync2(pending, "/opt/forgezero/agent/current");
+    rmSync2(operation.binary, { force: true });
+    symlinkSync("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
+    const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
+    rmSync2(gitSshBinary, { force: true });
+    symlinkSync("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
+    return { stdout: "", exitCode: 0 };
+  }
+  if (operation.kind === "ensure-seed") {
+    if (existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+      return { stdout: "", exitCode: 0 };
+    const seed = randomBytes2(32).toString("base64url");
+    const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
+    if (result.exitCode === 0)
+      chmodSync(operation.credential, 256);
+    return result;
+  }
+  if (operation.kind === "ensure-git-identity") {
+    const key = "/run/forgezero-git-deploy-key";
+    const publicKey = `${key}.pub`;
+    try {
+      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync2(key, { force: true });
+        rmSync2(publicKey, { force: true });
+        let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
+        if (result.exitCode !== 0)
+          return result;
+        result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=git-deploy-key", key, operation.credential]);
+        if (result.exitCode !== 0)
+          return result;
+        chmodSync(operation.credential, 256);
+      }
+      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync2(key)) {
+          const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
+          if (decrypted.exitCode !== 0)
+            return decrypted;
+        }
+        const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
+        if (derived.exitCode !== 0)
+          return derived;
+        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+`, { mode: 292 });
+      }
+      return { stdout: "", exitCode: 0 };
+    } finally {
+      rmSync2(key, { force: true });
+      rmSync2(publicKey, { force: true });
+    }
+  }
+  if (operation.kind === "ensure-bootstrap-ssh-identity") {
+    const key = "/run/forgezero-bootstrap-ssh-key";
+    const generatedPublicKey = `${key}.pub`;
+    try {
+      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync2(key, { force: true });
+        rmSync2(generatedPublicKey, { force: true });
+        let result;
+        if (operation.source) {
+          const source = existsSync2(operation.source) ? lstatSync(operation.source) : undefined;
+          if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
+            return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
+          }
+          copyFileSync(operation.source, key);
+          chmodSync(key, 384);
+        } else {
+          result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-bootstrap-runner", "-f", key]);
+          if (result.exitCode !== 0)
+            return result;
+        }
+        result = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
+        if (result.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(result.stdout)) {
+          return { stdout: "bootstrap SSH private key is not a valid Ed25519 OpenSSH key", exitCode: 1 };
+        }
+        result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
+        if (result.exitCode !== 0)
+          return result;
+        chmodSync(operation.credential, 256);
+      }
+      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync2(key)) {
+          const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
+          if (decrypted.exitCode !== 0)
+            return decrypted;
+          chmodSync(key, 384);
+        }
+        const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
+        if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
+          return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
+        }
+        mkdirSync2(dirname3(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+`, { mode: 292 });
+        chmodSync(operation.publicKey, 292);
+      }
+      if (operation.source)
+        rmSync2(operation.source, { force: true });
+      return { stdout: "", exitCode: 0 };
+    } finally {
+      rmSync2(key, { force: true });
+      rmSync2(generatedPublicKey, { force: true });
+    }
+  }
+  if (operation.kind === "ensure-enrolment") {
+    if (existsSync2(operation.state) && lstatSync(operation.state).size > 0 || existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+      return { stdout: "", exitCode: 0 };
+    if (!existsSync2(operation.source))
+      return { stdout: "enrolment source is missing", exitCode: 1 };
+    const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
+    if (result.exitCode === 0) {
+      chmodSync(operation.credential, 256);
+      rmSync2(operation.source, { force: true });
+    }
+    return result;
+  }
+  if (operation.kind === "wait-socket") {
+    for (let attempt = 0;attempt < operation.attempts; attempt += 1) {
+      try {
+        if (lstatSync(operation.path).isSocket())
+          return { stdout: "", exitCode: 0 };
+      } catch {}
+      await Bun.sleep(operation.intervalMs);
+    }
+    return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
+  }
+  if (operation.kind === "verify-file")
+    return existsSync2(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+  if (operation.kind === "verify-egress") {
+    const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
+    if (active.exitCode !== 0)
+      return active;
+    const policy = await fixed(["/usr/sbin/nft", "--numeric", "list", "table", "inet", "forgezero_agent_egress"]);
+    const required = [
+      "forgezero-agent-egress-v1",
+      `public-tcp=${operation.runnerPublicTcpPorts.join(",")}`,
+      ...operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
+    ];
+    return policy.exitCode === 0 && required.every((part) => policy.stdout.includes(part)) ? { stdout: policy.stdout, exitCode: 0 } : { stdout: policy.stdout, exitCode: 1 };
+  }
+  if (operation.kind === "verify-resolved-stub") {
+    try {
+      const expected = "/run/systemd/resolve/stub-resolv.conf";
+      return realpathSync2("/etc/resolv.conf") === expected && realpathSync2(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+    } catch {
+      return { stdout: "resolver stub missing", exitCode: 1 };
+    }
+  }
+  if (operation.kind === "install-warp") {
+    const os = readFileSync2("/etc/os-release", "utf8");
+    if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
+      return { stdout: "unsupported WARP host OS", exitCode: 1 };
+    const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
+    if (!response.ok)
+      return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
+    mkdirSync2("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync2("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync2("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    const key = "/run/cloudflare-warp-key.gpg";
+    writeFileSync2(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
+    rmSync2(key, { force: true });
+    if (result.exitCode !== 0)
+      return result;
+    const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
+    if (!codename)
+      return { stdout: "Ubuntu codename missing", exitCode: 1 };
+    writeFileSync2("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+`, { mode: 420 });
+    result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
+    return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
+  }
+  const status = await fixed(["/usr/bin/warp-cli", "--accept-tos", "status"]);
+  return status.exitCode === 0 && /(^|\s)Connected(\s|$)/i.test(status.stdout) ? status : { ...status, exitCode: 1 };
+};
+async function localRunner(operation) {
+  if (!["path-exists", "version"].includes(operation.kind))
+    return runProvisionOperation(operation);
+  const capability = operation;
+  if (capability.kind === "version")
+    return fixed(capability.argv);
+  try {
+    const metadata = lstatSync(capability.path);
+    const present = capability.nodeType === "directory" ? metadata.isDirectory() : true;
+    return { stdout: present ? `yes
+` : `no
+`, exitCode: present ? 0 : 1 };
+  } catch {
+    return { stdout: `no
+`, exitCode: 1 };
+  }
 }
 function planInstall(options) {
   const { capabilities, ...unit } = options;
@@ -1726,11 +2533,11 @@ function planInstall(options) {
 }
 async function applyPlan(plan, run) {
   const transcript = [];
-  for (const step of plan.steps) {
-    const result = await run(step.command);
-    transcript.push({ label: step.label, command: step.command, exitCode: result.exitCode });
-    if (result.exitCode !== 0 && !step.optional) {
-      throw new Error(`${step.label} failed (exit ${result.exitCode}): ${step.command}`);
+  for (const step2 of plan.steps) {
+    const result = await run(step2.operation);
+    transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
+    if (result.exitCode !== 0 && !step2.optional) {
+      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
     }
   }
   return transcript;
@@ -1773,7 +2580,7 @@ var systemdValue = (name, raw) => {
   const value = raw;
   return `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("$", "\\$")}"`;
 };
-function validatePlatformSharedEnvironment(input, options = {}) {
+function validatePlatformSharedEnvironment(input) {
   if (input.softwareProfile === "platform-api" !== (input.databaseRole === "none")) {
     throw new Error("platform-api requires database role none; platform-db-api requires master or joiner.");
   }
@@ -1783,14 +2590,26 @@ function validatePlatformSharedEnvironment(input, options = {}) {
   const coordinators = input.databaseCoordinators.map(privateCoordinator);
   if (new Set(coordinators).size !== coordinators.length)
     throw new Error("databaseCoordinators must be unique.");
-  if (!["private-lan", "cloudflare-warp"].includes(input.databaseNetworkMode)) {
-    throw new Error("Database networking must be private-lan or cloudflare-warp.");
+  if (input.databaseNetworkMode !== "private-lan") {
+    throw new Error("Attended platform bootstrap supports only private-lan database networking.");
   }
   boundedInteger("databaseReplicationFactor", input.databaseReplicationFactor, 1, 16);
   boundedInteger("databaseWriteConcern", input.databaseWriteConcern, 1, 16);
   if (input.databaseWriteConcern > input.databaseReplicationFactor) {
     throw new Error("databaseWriteConcern cannot exceed databaseReplicationFactor.");
   }
+  if (input.email?.provider === "smtp") {
+    safeAtom("email.host", input.email.host);
+    boundedInteger("email.port", input.email.port, 1, 65535);
+    safeAtom("email.user", input.email.user);
+    safeAtom("email.from", input.email.from);
+  } else if (input.email?.provider === "jetemail") {
+    safeAtom("email.from", input.email.from);
+    if (typeof input.email.eu !== "boolean")
+      throw new Error("JetEmail eu must be boolean.");
+  } else if (input.email !== undefined) {
+    throw new Error("Bootstrap email provider must be smtp or jetemail.");
+  }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
@@ -1823,13 +2642,6 @@ function validatePlatformSharedEnvironment(input, options = {}) {
     if (url.username || url.password || url.hash)
       throw new Error("Seed peers cannot contain credentials or fragments.");
   }
-  if (input.smtp) {
-    safeAtom("smtp.host", input.smtp.host);
-    boundedInteger("smtp.port", input.smtp.port, 1, 65535);
-    safeAtom("smtp.from", input.smtp.from);
-    if (input.smtp.user)
-      safeAtom("smtp.user", input.smtp.user);
-  }
   if (input.backup) {
     httpsOrigin("backup.endpoint", input.backup.endpoint);
     for (const [name, value] of Object.entries(input.backup))
@@ -1842,14 +2654,12 @@ function validatePlatformSharedEnvironment(input, options = {}) {
     const service = new URL(input.cloudflare.tunnelService);
     if (service.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(service.hostname) || service.username || service.password || service.search || service.hash)
       throw new Error("Cloudflare Tunnel service must be loopback HTTP.");
-    if (input.cloudflare.warp) {
-      if (!/^[A-Za-z0-9][A-Za-z0-9-]{0,62}$/.test(input.cloudflare.warp.organization) || !/^[0-9a-f-]{36}$/i.test(input.cloudflare.warp.virtualNetworkId) || !/^[A-Za-z0-9_-]{1,128}$/.test(input.cloudflare.warp.deviceProfileId)) {
-        throw new Error("Cloudflare WARP organization, VNET or device profile is malformed.");
-      }
-    }
   }
-  if (!options.allowPendingCloudflareHandoff && input.databaseNetworkMode === "cloudflare-warp" !== Boolean(input.cloudflare?.warp)) {
-    throw new Error("cloudflare-warp networking requires its exact enrolled Cloudflare coordinates.");
+  if (input.realtime) {
+    input.realtime.endpoint = httpsOrigin("realtime.endpoint", input.realtime.endpoint);
+    if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(input.realtime.workerScriptName) || !/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,127}$/.test(input.realtime.producer)) {
+      throw new Error("realtime.producer is invalid.");
+    }
   }
   return {
     ...input,
@@ -1904,10 +2714,12 @@ function renderPlatformSharedEnvironment(input) {
     FZ_PROFILE: value.deployProfile,
     FZ_REPO: value.repository,
     FZ_BRANCH: value.branch,
-    FZ_SMTP_HOST: value.smtp?.host ?? "",
-    FZ_SMTP_PORT: value.smtp ? String(value.smtp.port) : "",
-    FZ_SMTP_USER: value.smtp?.user ?? "",
-    FZ_SMTP_FROM: value.smtp?.from ?? "",
+    FZ_EMAIL_PROVIDER: value.email?.provider ?? "",
+    FZ_SMTP_HOST: value.email?.provider === "smtp" ? value.email.host : "",
+    FZ_SMTP_PORT: value.email?.provider === "smtp" ? String(value.email.port) : "",
+    FZ_SMTP_USER: value.email?.provider === "smtp" ? value.email.user : "",
+    FZ_EMAIL_FROM: value.email?.from ?? "",
+    FZ_JETEMAIL_EU: value.email?.provider === "jetemail" ? String(value.email.eu) : "",
     BACKUP_S3_ENDPOINT: value.backup?.endpoint ?? "",
     BACKUP_S3_REGION: value.backup?.region ?? "",
     BACKUP_S3_BUCKET: value.backup?.bucket ?? "",
@@ -1917,9 +2729,9 @@ function renderPlatformSharedEnvironment(input) {
     FZ_CF_KV_NAMESPACE_ID: value.cloudflare?.kvNamespaceId ?? "",
     FZ_CF_TUNNEL_ID: value.cloudflare?.tunnelId ?? "",
     FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
-    FZ_WARP_ORGANIZATION: value.cloudflare?.warp?.organization ?? "",
-    FZ_CF_VIRTUAL_NETWORK_ID: value.cloudflare?.warp?.virtualNetworkId ?? "",
-    FZ_CF_WARP_POLICY_ID: value.cloudflare?.warp?.deviceProfileId ?? ""
+    FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
+    FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
 ` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
@@ -1928,9 +2740,11 @@ function renderPlatformSharedEnvironment(input) {
 }
 function platformApiCredentialSpecs(options) {
   const optional = [
-    ["bootstrap-smtp-password", options.smtp],
-    ["cloudflare-kv-token", options.cloudflareKv],
-    ["cloudflare-network-token", options.cloudflareNetwork]
+    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
+    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["CF_API_TOKEN", options.cloudflareKv],
+    ["REALTIME_PUBLISH_SECRET", options.realtime],
+    ["REALTIME_TICKET_SECRET", options.realtime]
   ];
   return [
     { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
@@ -2054,40 +2868,12 @@ function renderPlatformActivationFiles(input) {
   ].join(`
 `) + `
 `;
-  const helper = `#!/usr/bin/env bash
-set -Eeuo pipefail
-source /etc/forgezero/deploy.env
-[[ $# == 1 ]] || { echo "usage: forgezero-activate <release>" >&2; exit 2; }
-release="$(realpath -e "$1")"; releases="$(realpath -e "$FZ_DIR/releases")"; slots="$FZ_DIR/slots"
-install -d -o root -g root -m 0755 "$slots"
-case "$release/" in "$releases"/*/) ;; *) echo "release is outside $releases" >&2; exit 2 ;; esac
-[[ -f "$release/.fz/deploy.json" && -s "$release/src/index.ts" && -s "$release/bun.lock" ]] || { echo "release is incomplete" >&2; exit 2; }
-slot_file="$FZ_DIR/.forge-slot"; previous_slot="$(cat "$slot_file" 2>/dev/null || true)"
-if [[ "$previous_slot" == blue ]]; then target=green; port="$FZ_GREEN_PORT"; else target=blue; port="$FZ_BLUE_PORT"; fi
-target_link="$slots/$target"; previous_target_link="$(readlink -f "$target_link" 2>/dev/null || true)"
-chown -R root:"$FZ_USER" "$release"; chmod -R a-w "$release"; find "$release" -type d -exec chmod a+rx {} +; find "$release" -type f -exec chmod a+r {} +
-ln -sfn "$release" "$target_link"; systemctl restart "forgezero@\${target}.service"
-healthy=0; for _ in $(seq 1 30); do curl -fsS --max-time 2 "http://127.0.0.1:\${port}\${FZ_HEALTH_PATH}" >/dev/null 2>&1 && { healthy=1; break; }; sleep 1; done
-if (( ! healthy )); then systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; exit 1; fi
-upstream=/etc/nginx/conf.d/forgezero-upstream.conf; backup="$(mktemp -p /run forgezero-upstream.XXXXXX)"; [[ -f "$upstream" ]] && cp "$upstream" "$backup" || : >"$backup"
-printf 'upstream forgezero { server 127.0.0.1:%s; }\\n' "$port" >"$upstream"
-if ! nginx -t || ! nginx -s reload; then [[ -s "$backup" ]] && cp "$backup" "$upstream" || rm -f "$upstream"; rm -f "$backup"; systemctl stop "forgezero@\${target}.service" || true; [[ -n "$previous_target_link" && -d "$previous_target_link" ]] && ln -sfn "$previous_target_link" "$target_link" || rm -f "$target_link"; nginx -t >/dev/null 2>&1 && nginx -s reload || true; exit 1; fi
-rm -f "$backup"; printf '%s\\n' "$target" >"$slot_file"
-# New nginx workers select the new slot after reload. Keep the old slot alive
-# while old workers drain in-flight requests and upgraded connections.
-if [[ -n "$previous_slot" && "$previous_slot" != "$target" ]]; then
-  sleep_seconds="$(( (FZ_DRAIN_DEADLINE_MS + 999) / 1000 ))"
-  sleep "$sleep_seconds"
-  systemctl stop "forgezero@\${previous_slot}.service" || true
-fi
-mapfile -t old < <(find "$releases" -mindepth 1 -maxdepth 1 -type d -printf '%T@ %p\\n' | sort -rn | tail -n "+$((FZ_KEEP_RELEASES + 1))" | cut -d' ' -f2-)
-for path in "\${old[@]}"; do [[ "$path" == "$release" ]] || rm -rf -- "$path"; done
-printf 'promoted %s on %s\\n' "$release" "$target"
+  const helper = `${JSON.stringify({ ...input, drainDeadlineMs }, null, 2)}
 `;
   return {
     environment,
     helper,
-    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/libexec/forgezero-activate *
+    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/lib/forgezero/agent/fz-agent platform-activate --config=/etc/forgezero/deploy-activation.json *
 `
   };
 }
@@ -2128,12 +2914,143 @@ function planLocalOtlpProof(endpoint2, collectorUnit) {
   };
 }
 
+// src/otel-collector.ts
+var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
+var FORGEZERO_OTEL_COLLECTOR_VERSION = "0.157.0";
+var FORGEZERO_OTEL_COLLECTOR_SHA256 = "2937cf24892af55b143c072fddece17862239cf78280620029276493eb81beae";
+var ARCHIVE = "/run/forgezero-otelcol.tar.gz";
+var EXTRACT = "/run/forgezero-otelcol-release";
+var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
+var CONFIG = "/etc/forgezero/otelcol.yaml";
+var UNIT = `/etc/systemd/system/${FORGEZERO_OTEL_COLLECTOR_UNIT}`;
+var checked = async (host, argv) => {
+  const result = await host.exec(argv);
+  const output = `${result.output ?? result.stdout ?? ""}${result.stderr ?? ""}`;
+  if (result.exitCode !== 0)
+    throw new Error(`OTLP collector operation failed: ${argv.join(" ")}${output.trim() ? `: ${output.trim()}` : ""}`);
+  return output.trim();
+};
+var destination = (value) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("OTLP collector export endpoint must be an absolute HTTPS URL");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.port && url.port !== "443") {
+    throw new Error("OTLP collector export endpoint must be credential-free HTTPS");
+  }
+  return url.toString().replace(/\/$/, "");
+};
+function renderForgeZeroOtelCollector(exportEndpoint) {
+  const endpoint2 = destination(exportEndpoint);
+  return {
+    config: `receivers:
+  otlp:
+    protocols:
+      http:
+        endpoint: 127.0.0.1:4318
+exporters:
+  otlphttp:
+    endpoint: ${JSON.stringify(endpoint2)}
+service:
+  telemetry:
+    metrics:
+      address: 127.0.0.1:8888
+  pipelines:
+    traces:
+      receivers: [otlp]
+      exporters: [otlphttp]
+    metrics:
+      receivers: [otlp]
+      exporters: [otlphttp]
+    logs:
+      receivers: [otlp]
+      exporters: [otlphttp]
+`,
+    unit: `[Unit]
+Description=ForgeZero independently supervised OpenTelemetry Collector
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=forgezero-otel
+Group=forgezero-otel
+ExecStart=${BINARY} --config=${CONFIG}
+Restart=always
+RestartSec=2
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`
+  };
+}
+async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
+  const rendered = renderForgeZeroOtelCollector(exportEndpoint);
+  const observed = await host.exec([BINARY, "--version"]);
+  const versionOutput = `${observed.output ?? observed.stdout ?? ""}${observed.stderr ?? ""}`;
+  if (observed.exitCode !== 0 || !versionOutput.includes(`otelcol version ${FORGEZERO_OTEL_COLLECTOR_VERSION}`)) {
+    await checked(host, [
+      "/usr/bin/curl",
+      "--fail",
+      "--silent",
+      "--show-error",
+      "--location",
+      "--proto",
+      "=https",
+      "--output",
+      ARCHIVE,
+      `https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v${FORGEZERO_OTEL_COLLECTOR_VERSION}/otelcol_${FORGEZERO_OTEL_COLLECTOR_VERSION}_linux_amd64.tar.gz`
+    ]);
+    const digest = (await checked(host, ["/usr/bin/sha256sum", ARCHIVE])).split(/\s+/)[0];
+    if (digest !== FORGEZERO_OTEL_COLLECTOR_SHA256)
+      throw new Error("OTLP collector archive checksum mismatch");
+    await checked(host, ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/otelcol", EXTRACT]);
+    await checked(host, ["/usr/bin/tar", "-xzf", ARCHIVE, "-C", EXTRACT, "otelcol"]);
+    await checked(host, ["/usr/bin/install", "-m", "0755", `${EXTRACT}/otelcol`, BINARY]);
+    await checked(host, ["/usr/bin/rm", "-f", ARCHIVE, `${EXTRACT}/otelcol`]);
+  }
+  if ((await host.exec(["/usr/bin/getent", "group", "forgezero-otel"])).exitCode !== 0) {
+    await checked(host, ["/usr/sbin/groupadd", "--system", "forgezero-otel"]);
+  }
+  if ((await host.exec(["/usr/bin/id", "forgezero-otel"])).exitCode !== 0) {
+    await checked(host, [
+      "/usr/sbin/useradd",
+      "--system",
+      "--no-create-home",
+      "--shell",
+      "/usr/sbin/nologin",
+      "--gid",
+      "forgezero-otel",
+      "forgezero-otel"
+    ]);
+  }
+  host.write(CONFIG, rendered.config, 420);
+  host.write(UNIT, rendered.unit, 420);
+  await checked(host, ["/usr/bin/systemctl", "daemon-reload"]);
+  await checked(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+}
+
 // src/bootstrap.ts
 import { DEFAULT_SOCKET as DEFAULT_SOCKET2 } from "@forgezero/vault";
 var PLATFORM_BOOTSTRAP_PROFILES = [
   "platform-db-api",
   "platform-api"
 ];
+var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
 function resolveInstalledBootstrapKind(states) {
   if (states.compute && states.metal) {
     throw new Error("host has both metal and compute bootstrap state; refusing an ambiguous operation");
@@ -2146,12 +3063,15 @@ var INTENT_PATH = "/var/lib/forgezero/bootstrap.intent.json";
 var CREDS = "/etc/forgezero/creds";
 var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
-var TUNNEL_CREDENTIAL = `${CREDS}/cloudflared-token.cred`;
+var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
+var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
+var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
+var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
 var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
 var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
-var WARP_CLIENT_ID_CREDENTIAL = `${CREDS}/warp-auth-client-id.cred`;
-var WARP_CLIENT_SECRET_CREDENTIAL = `${CREDS}/warp-auth-client-secret.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
+var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
 var GIT_PUBLIC_KEY = "/etc/forgezero/git/deploy.pub";
 var PLATFORM_ENROL_SOURCE = "/run/forgezero-platform-enrol-token";
 var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
@@ -2219,19 +3139,22 @@ function validateBootstrapConfig(value) {
       throw new Error(`deployment credential ${name} must map to an absolute encrypted .cred path`);
     }
   }
-  if (value.cloudflareHandoff && (!value.installCloudflared || !value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
-    throw new Error("Cloudflare handoff requires cloudflared installation, a checkpoint and a valid node name");
+  if (Boolean(value.installCloudflared) !== Boolean(value.cloudflareHandoff) || value.cloudflareHandoff && (!value.cloudflareHandoff.handoffFile || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.cloudflareHandoff.nodeName))) {
+    throw new Error("cloudflared requires a node-specific Cloudflare handoff and both must be supplied together");
   }
-  if (value.kind === "tenant") {
+  if (value.installWarp && !value.cloudflareHandoff) {
+    throw new Error("Cloudflare Mesh/WARP requires a node-specific Cloudflare handoff");
+  }
+  if (value.kind === "enrolled-compute") {
     if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
       throw new Error("tenant realm is malformed");
     if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
       throw new Error("tenant API must be public HTTPS or loopback HTTP");
     }
     if (!value.enrolTokenFile)
-      throw new Error("tenant bootstrap requires --enrol-token-file");
+      throw new Error("enrolled-compute activation requires an enrolment-token file");
     if (value.bootstrapRunner) {
-      if (!value.bootstrapRunner.sshPrivateKeyFile.startsWith("/") || /[\r\n]/.test(value.bootstrapRunner.sshPrivateKeyFile)) {
+      if (value.bootstrapRunner.sshPrivateKeyFile !== undefined && (!value.bootstrapRunner.sshPrivateKeyFile.startsWith("/") || /[\r\n]/.test(value.bootstrapRunner.sshPrivateKeyFile))) {
         throw new Error("bootstrap runner SSH private-key file must be absolute");
       }
       let targetTelemetry;
@@ -2280,14 +3203,21 @@ function validateBootstrapConfig(value) {
     throw new Error("database coordinators must contain 1-16 unique private origins");
   }
   value.database.coordinators = write;
-  const runtime = validatePlatformSharedEnvironment(value.runtime.environment, {
-    allowPendingCloudflareHandoff: Boolean(value.cloudflareHandoff)
-  });
+  const runtime = validatePlatformSharedEnvironment(value.runtime.environment);
+  if (runtime.otlpCollectorUnit !== FORGEZERO_OTEL_COLLECTOR_UNIT) {
+    throw new Error(`platform bootstrap requires ${FORGEZERO_OTEL_COLLECTOR_UNIT}`);
+  }
   if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.repository !== value.repository || runtime.branch !== value.branch || runtime.databaseCoordinators.join(",") !== write.join(",")) {
     throw new Error("platform runtime coordinates disagree with immutable bootstrap coordinates");
   }
   if (runtime.deployProfile !== value.environment)
     throw new Error("runtime deployment profile disagrees with bootstrap environment");
+  if (Boolean(runtime.email) !== Boolean(value.runtime.credentialFiles?.emailSecret)) {
+    throw new Error("Bootstrap email configuration and its owner-only credential file must be supplied together");
+  }
+  if (value.runtime.credentialFiles?.emailSecret && (!value.runtime.credentialFiles.emailSecret.startsWith("/") || /[\r\n]/.test(value.runtime.credentialFiles.emailSecret))) {
+    throw new Error("Bootstrap email credential file must be an absolute single-line path");
+  }
   if (value.database.address !== runtime.databaseAddress || value.database.master !== runtime.databaseMaster) {
     throw new Error("runtime database topology disagrees with bootstrap topology");
   }
@@ -2306,16 +3236,19 @@ function validateBootstrapConfig(value) {
 }
 function planBootstrap(input, initialized = false) {
   const config = validateBootstrapConfig(structuredClone(input));
-  const software = config.kind === "tenant" ? [
+  const software = config.kind === "enrolled-compute" ? [
     ...config.software ?? [],
     ...config.bootstrapRunner && !config.software?.some(({ id }) => id === "openssh-client") ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
-    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : []
+    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : [],
+    ...config.installWarp ? [{ id: "cloudflare-warp", version: "2026.6.822.0-min" }] : []
   ] : [
     ...config.firewall.enabled ? [{ id: "ufw", version: "ubuntu-26.04" }] : [],
     { id: "bun", version: "1.3.14" },
     { id: "nginx", version: "ubuntu-26.04" },
+    ...platformBootstrapRunner(config) ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
     ...config.profile === "platform-api" ? [] : [{ id: "arangodb", version: "3.11.14" }],
-    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : []
+    ...config.installCloudflared ? [{ id: "cloudflared", version: "2026.7.3" }] : [],
+    ...config.installWarp ? [{ id: "cloudflare-warp", version: "2026.6.822.0-min" }] : []
   ];
   return {
     kind: config.kind,
@@ -2325,7 +3258,7 @@ function planBootstrap(input, initialized = false) {
     statePath: STATE_PATH,
     steps: [
       { id: "agent", label: "Install and verify the common Agent supervision boundary", mutation: true },
-      { id: "software", label: "Install exact Agent-owned software coordinates in order", mutation: true },
+      { id: "software", label: "Install exact Agent-owned software coordinates and the checksum-verified OTLP collector in order", mutation: true },
       { id: "credentials", label: "Seal bootstrap credentials with systemd-creds", mutation: true },
       ...config.kind === "platform" && config.database.role !== "none" ? [{ id: "database", label: "Provision Community 3.11.14 cluster and Coordinator mode", mutation: true }] : [],
       ...config.kind === "platform" ? [
@@ -2333,19 +3266,18 @@ function planBootstrap(input, initialized = false) {
         { id: "deploy", label: "Create the first invite when required and health-gate the initial deployment", mutation: true },
         { id: "enrol", label: "Consume the API-bound platform capability and enable signed control", mutation: true }
       ] : [],
-      ...config.installCloudflared ? [{ id: "cloudflared-install-only", label: "Install cloudflared without creating Cloudflare resources", mutation: true }] : [],
+      ...config.installCloudflared ? [{ id: "cloudflare-connectors", label: "Install cloudflared and optional Mesh/WARP connector from the attended handoff", mutation: true }] : [],
       { id: "state", label: "Persist immutable bootstrap profile and evidence coordinates", mutation: true },
       { id: "status", label: "Verify services and immutable profile", mutation: false }
     ]
   };
 }
-var checked = async (host, argv, label, options) => {
+var checked2 = async (host, argv, label, options) => {
   const result = await host.exec(argv, options);
   if (result.exitCode !== 0)
     throw new Error(`${label} failed: ${result.output.trim()}`);
   return result.output;
 };
-var shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 var unitEscape = (value) => {
   if (/[^A-Za-z0-9_./:@,+-]/.test(value))
     throw new Error(`unsafe systemd coordinate: ${value}`);
@@ -2353,7 +3285,7 @@ var unitEscape = (value) => {
 };
 function databaseUnit(config) {
   const db = config.database;
-  const join2 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
+  const join3 = db.role === "joiner" ? ` --starter.join=${unitEscape(db.master)}` : "";
   const agency = db.agency === "none" ? " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true" : "";
   return `[Unit]
 Description=ForgeZero ArangoDB Community 3.11.14 cluster (${db.role}; agency=${db.agency})
@@ -2365,7 +3297,7 @@ Type=simple
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join2}${agency}
+ExecStart=/usr/bin/arangodb --starter.mode=cluster --starter.address=${unitEscape(db.address)} --starter.host=${unitEscape(db.address)} --starter.data-dir=/var/lib/forgezero-cluster --auth.jwt-secret=%d/arangodb-jwt${join3}${agency}
 Restart=always
 RestartSec=5
 UMask=0077
@@ -2420,8 +3352,8 @@ Wants=network-online.target
 [Service]
 Type=simple
 DynamicUser=yes
-LoadCredentialEncrypted=cloudflared-token:${TUNNEL_CREDENTIAL}
-ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate --metrics ${CLOUDFLARED_METRICS_ADDRESS} run --token-file %d/cloudflared-token
+LoadCredentialEncrypted=CF_TUNNEL_CONNECTOR_TOKEN:${TUNNEL_CREDENTIAL}
+ExecStart=/usr/local/bin/cloudflared tunnel --no-autoupdate --metrics ${CLOUDFLARED_METRICS_ADDRESS} run --token-file %d/CF_TUNNEL_CONNECTOR_TOKEN
 Restart=always
 RestartSec=5
 NoNewPrivileges=true
@@ -2429,6 +3361,28 @@ PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
 
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function meshConnectorUnit() {
+  return `[Unit]
+Description=ForgeZero Cloudflare Mesh/WARP connector registration
+Requires=warp-svc.service
+After=network-online.target warp-svc.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+LoadCredentialEncrypted=CF_WARP_CONNECTOR_TOKEN:${WARP_CONNECTOR_CREDENTIAL}
+ExecStart=/usr/local/bin/fz-agent mesh-config
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/cloudflare-warp
+
 [Install]
 WantedBy=multi-user.target
 `;
@@ -2492,15 +3446,15 @@ var derive = (root, label) => {
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   return createHmac("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
 };
-async function seal(host, name, destination, value) {
-  if (host.exists(destination))
+async function seal(host, name, destination2, value) {
+  if (host.exists(destination2))
     return;
-  const result = await host.exec(["systemd-creds", "encrypt", `--name=${name}`, "-", destination], { stdin: value });
+  const result = await host.exec(["systemd-creds", "encrypt", `--name=${name}`, "-", destination2], { stdin: value });
   if (result.exitCode !== 0)
     throw new Error(`could not seal ${name}: ${result.output.trim()}`);
 }
 function bootstrapIdentity(config) {
-  if (config.kind === "tenant")
+  if (config.kind === "enrolled-compute")
     return {
       kind: config.kind,
       apiUrl: config.apiUrl,
@@ -2513,9 +3467,11 @@ function bootstrapIdentity(config) {
       deployRoot: config.deployRoot ?? "/opt/forgezero",
       software: (config.software ?? []).map(({ id, version }) => ({ id, version })),
       installCloudflared: Boolean(config.installCloudflared),
+      installWarp: Boolean(config.installWarp),
       bootstrapRunner: config.bootstrapRunner ? { targetTelemetryEndpoint: config.bootstrapRunner.targetTelemetryEndpoint } : null
     };
   const environment = config.runtime.environment;
+  const { cloudflare: _cloudflare, realtime: _realtime, ...stableEnvironment } = environment;
   return {
     kind: config.kind,
     environment: config.environment,
@@ -2545,10 +3501,12 @@ function bootstrapIdentity(config) {
       publicApiPort: environment.publicApiPort,
       healthPath: config.runtime.healthPath,
       keepReleases: config.runtime.keepReleases,
-      environment
+      environment: stableEnvironment
     },
     firewall: config.firewall,
-    installCloudflared: Boolean(config.installCloudflared)
+    installCloudflared: Boolean(config.installCloudflared),
+    installWarp: Boolean(config.installWarp),
+    cloudflareNodeName: config.cloudflareHandoff?.nodeName ?? null
   };
 }
 function bootstrapIdentityDigest(config) {
@@ -2564,7 +3522,7 @@ function parseStoredState(raw) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("bootstrap state is malformed");
   const state = value;
-  if (state.format !== 2 || !["platform", "tenant"].includes(state.kind ?? "") || !/^[a-f0-9]{64}$/.test(state.identityDigest ?? "") || typeof state.profile !== "string" || typeof state.nodeHostname !== "string" || typeof state.apiUrl !== "string" || state.kind === "platform" && !["member", "none"].includes(state.databaseAgency ?? "")) {
+  if (state.format !== 2 || !["platform", "enrolled-compute"].includes(state.kind ?? "") || !/^[a-f0-9]{64}$/.test(state.identityDigest ?? "") || typeof state.profile !== "string" || typeof state.nodeHostname !== "string" || typeof state.apiUrl !== "string" || state.kind === "platform" && !["member", "none"].includes(state.databaseAgency ?? "")) {
     throw new Error("bootstrap state is legacy or incomplete; refusing an unbound repair");
   }
   return state;
@@ -2579,7 +3537,7 @@ function parseStoredIntent(raw) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error("bootstrap intent is malformed");
   const intent = value;
-  if (intent.format !== 1 || !["platform", "tenant"].includes(intent.kind ?? "") || !/^[a-f0-9]{64}$/.test(intent.identityDigest ?? "") || Number.isNaN(Date.parse(intent.createdAt ?? ""))) {
+  if (intent.format !== 1 || !["platform", "enrolled-compute"].includes(intent.kind ?? "") || !/^[a-f0-9]{64}$/.test(intent.identityDigest ?? "") || Number.isNaN(Date.parse(intent.createdAt ?? ""))) {
     throw new Error("bootstrap intent is incomplete; refusing an unbound resume");
   }
   return intent;
@@ -2650,10 +3608,13 @@ function stateFor(config, cloudflare, previousCloudflareTunnelId) {
       publicApiPort: config.runtime.environment.publicApiPort,
       healthPath: config.runtime.healthPath,
       cloudflare: config.runtime.environment.cloudflare,
-      cloudflared: Boolean(config.cloudflareHandoff)
+      realtime: config.runtime.environment.realtime,
+      cloudflared: Boolean(config.cloudflareHandoff),
+      warp: Boolean(config.installWarp)
     } : {
       realm: config.realm,
       cloudflared: Boolean(config.cloudflareHandoff),
+      warp: Boolean(config.installWarp),
       cloudflareTunnelId: cloudflare?.tunnelId ?? previousCloudflareTunnelId
     }
   }, null, 2)}
@@ -2675,6 +3636,8 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     units.push(state.collectorUnit);
   if (state.cloudflared)
     units.push("cloudflared.service");
+  if (state.warp)
+    units.push("warp-svc.service", "forgezero-mesh-config.service");
   if (state.kind === "platform" && state.databaseRole !== "none")
     units.push("forgezero-db.service", "forgezero-db-verify.service");
   const services = {};
@@ -2691,7 +3654,7 @@ async function bootstrapStatus(host = localBootstrapHost()) {
       problems.push(`${socket} is missing`);
   }
   if (state.cloudflared) {
-    for (const credential of [TUNNEL_CREDENTIAL, `${CREDS}/cloudflare-kv-token.cred`]) {
+    for (const credential of [TUNNEL_CREDENTIAL, CF_API_CREDENTIAL]) {
       services[credential] = host.exists(credential);
       if (!services[credential])
         problems.push(`${credential} is missing`);
@@ -2707,20 +3670,16 @@ async function bootstrapStatus(host = localBootstrapHost()) {
         problems.push(evidence.problem);
     }
   }
+  if (state.warp) {
+    services[WARP_CONNECTOR_CREDENTIAL] = host.exists(WARP_CONNECTOR_CREDENTIAL);
+    if (!services[WARP_CONNECTOR_CREDENTIAL])
+      problems.push(`${WARP_CONNECTOR_CREDENTIAL} is missing`);
+    const status = await host.exec(["/usr/bin/warp-cli", "--accept-tos", "status"]);
+    services["cloudflare-mesh"] = status.exitCode === 0 && /\bconnected\b/i.test(status.output) && !/\bdisconnected\b/i.test(status.output);
+    if (!services["cloudflare-mesh"])
+      problems.push("Cloudflare Mesh/WARP is not connected");
+  }
   if (state.kind === "platform") {
-    if (state.cloudflared) {
-      if (state.cloudflare?.warp) {
-        for (const credential of [
-          `${CREDS}/cloudflare-network-token.cred`,
-          WARP_CLIENT_ID_CREDENTIAL,
-          WARP_CLIENT_SECRET_CREDENTIAL
-        ]) {
-          services[credential] = host.exists(credential);
-          if (!services[credential])
-            problems.push(`${credential} is missing`);
-        }
-      }
-    }
     const [blue, green] = await Promise.all([
       host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
       host.exec(["systemctl", "is-active", "--quiet", "forgezero@green.service"])
@@ -2779,7 +3738,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   const config = validateBootstrapConfig(structuredClone(input));
   if (host.uid() !== 0)
     throw new Error("fz bootstrap --apply must run as root");
-  if (config.kind === "tenant") {
+  if (config.kind === "enrolled-compute") {
     const token = privateFile(host, config.enrolTokenFile, "tenant enrolment token");
     if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(token))
       throw new Error("tenant enrolment token is malformed");
@@ -2793,14 +3752,18 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       cloudflare = await readCloudflareHostHandoff(config.cloudflareHandoff.handoffFile, config.cloudflareHandoff.nodeName);
     } else if (config.kind === "platform" && installed?.cloudflare) {
       config.runtime.environment.cloudflare = installed.cloudflare;
+      config.runtime.environment.realtime = installed.realtime;
       config.runtime.environment = validatePlatformSharedEnvironment(config.runtime.environment);
-    } else if (!(config.kind === "tenant" && installed?.cloudflareTunnelId)) {
+    } else if (!(config.kind === "enrolled-compute" && installed?.cloudflareTunnelId)) {
       throw new Error("node-specific Cloudflare host handoff is missing before credential sealing");
     }
   }
   if (cloudflare && cloudflare.hostname !== config.nodeHostname) {
     throw new Error("Cloudflare handoff hostname disagrees with node hostname");
   }
+  if (cloudflare && Boolean(cloudflare.mesh) !== Boolean(config.installWarp)) {
+    throw new Error("Cloudflare Mesh handoff and installWarp selection disagree");
+  }
   if (cloudflare && config.kind === "platform") {
     const expected = config.runtime.environment.cloudflare;
     if (expected && (cloudflare.service !== expected.tunnelService || cloudflare.accountId !== expected.accountId || cloudflare.zoneId !== expected.zoneId || cloudflare.kvNamespaceId !== expected.kvNamespaceId || cloudflare.tunnelId !== expected.tunnelId)) {
@@ -2811,19 +3774,25 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       zoneId: cloudflare.zoneId,
       kvNamespaceId: cloudflare.kvNamespaceId,
       tunnelId: cloudflare.tunnelId,
-      tunnelService: cloudflare.service,
-      ...cloudflare.warp ? { warp: {
-        organization: cloudflare.warp.organization,
-        virtualNetworkId: cloudflare.warp.virtualNetworkId,
-        deviceProfileId: cloudflare.warp.deviceProfileId
-      } } : {}
+      tunnelService: cloudflare.service
     };
     if (expected && JSON.stringify(expected) !== JSON.stringify(discovered)) {
-      throw new Error("Cloudflare handoff disagrees with immutable WARP/runtime coordinates");
+      throw new Error("Cloudflare handoff disagrees with immutable runtime coordinates");
     }
     config.runtime.environment.cloudflare = expected ?? discovered;
-    if (config.runtime.environment.databaseNetworkMode === "cloudflare-warp" !== Boolean(cloudflare.warp)) {
-      throw new Error("Cloudflare handoff private-network mode disagrees with the platform database network mode");
+    if (cloudflare.realtime) {
+      const expectedRealtime = config.runtime.environment.realtime;
+      const discoveredRealtime = {
+        workerScriptName: cloudflare.realtime.workerScriptName,
+        endpoint: cloudflare.realtime.endpoint,
+        producer: cloudflare.realtime.producer
+      };
+      if (expectedRealtime && JSON.stringify(expectedRealtime) !== JSON.stringify(discoveredRealtime)) {
+        throw new Error("Cloudflare realtime handoff disagrees with immutable runtime coordinates");
+      }
+      config.runtime.environment.realtime = expectedRealtime ?? discoveredRealtime;
+    } else if (config.runtime.environment.realtime) {
+      throw new Error("platform realtime coordinates require a realtime-enabled Cloudflare handoff");
     }
   }
   if (installed) {
@@ -2831,21 +3800,30 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
   }
+  const platformPrivate = config.kind === "platform" ? {
+    root: privateFile(host, config.database.bootstrapSecretFile, "database bootstrap secret"),
+    email: config.runtime.credentialFiles?.emailSecret && !host.exists(`${CREDS}/${config.runtime.environment.email?.provider === "jetemail" ? "bootstrap-jetemail-api-key" : "bootstrap-smtp-password"}.cred`) ? privateFile(host, config.runtime.credentialFiles.emailSecret, "bootstrap email credential") : undefined,
+    backup: config.runtime.credentialFiles?.backupS3Secret && !host.exists(`${CREDS}/backup-s3-secret.cred`) ? privateFile(host, config.runtime.credentialFiles.backupS3Secret, "backup S3 credential") : undefined
+  } : undefined;
+  if (config.kind === "enrolled-compute" && config.bootstrapRunner?.sshPrivateKeyFile && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
+    privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key");
+  }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
-  if (config.kind === "tenant" && config.bootstrapRunner && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
-    await seal(host, "bootstrap-ssh-key", BOOTSTRAP_SSH_CREDENTIAL, privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key"));
-    host.remove(config.bootstrapRunner.sshPrivateKeyFile);
+  if (cloudflare && !host.exists(CF_API_CREDENTIAL)) {
+    await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflare.apiToken);
   }
-  if (cloudflare?.warp) {
-    await seal(host, "warp-auth-client-id", WARP_CLIENT_ID_CREDENTIAL, cloudflare.warp.clientId);
-    await seal(host, "warp-auth-client-secret", WARP_CLIENT_SECRET_CREDENTIAL, cloudflare.warp.clientSecret);
+  if (cloudflare?.realtime && !host.exists(REALTIME_PUBLISH_CREDENTIAL)) {
+    await seal(host, "REALTIME_PUBLISH_SECRET", REALTIME_PUBLISH_CREDENTIAL, cloudflare.realtime.publishSecret);
   }
-  if (cloudflare && !host.exists(`${CREDS}/cloudflare-kv-token.cred`)) {
-    await seal(host, "cloudflare-kv-token", `${CREDS}/cloudflare-kv-token.cred`, cloudflare.kvRuntimeToken);
+  if (cloudflare?.realtime && !host.exists(REALTIME_TICKET_CREDENTIAL)) {
+    await seal(host, "REALTIME_TICKET_SECRET", REALTIME_TICKET_CREDENTIAL, cloudflare.realtime.ticketSecret);
+  }
+  if (cloudflare?.mesh && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
+    await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, cloudflare.mesh.connectorToken);
   }
   await host.installAgent(config);
   if (config.kind === "platform" && config.firewall.enabled) {
@@ -2853,50 +3831,52 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   } else
     await host.ensureSoftware(plan.software);
   if (config.kind === "platform" && config.firewall.enabled) {
-    await checked(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
-    await checked(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
-    await checked(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
+    await checked2(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
+    await checked2(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
+    await checked2(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
     for (const cidr of config.firewall.privateCidrs) {
       if (config.database.role !== "none")
-        await checked(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
+        await checked2(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
       for (const port of [config.runtime.bluePort, config.runtime.greenPort])
-        await checked(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
+        await checked2(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
     }
-    await checked(host, ["ufw", "--force", "enable"], "firewall activation");
+    await checked2(host, ["ufw", "--force", "enable"], "firewall activation");
     await host.ensureSoftware(plan.software.filter(({ id }) => id !== "ufw"));
   }
   if (config.kind === "platform") {
-    const root = privateFile(host, config.database.bootstrapSecretFile, "database bootstrap secret");
+    const root = platformPrivate.root;
     if (!host.exists(JWT_CREDENTIAL)) {
       await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
     }
     await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
     await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const credentialFiles = config.runtime.credentialFiles ?? {};
+    const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "bootstrap-smtp-password" : config.runtime.environment.email?.provider === "jetemail" ? "bootstrap-jetemail-api-key" : undefined;
+    if (Boolean(config.runtime.environment.email) !== Boolean(credentialFiles.emailSecret)) {
+      throw new Error("Bootstrap email configuration and its owner-only credential file must be supplied together");
+    }
     for (const [name, source] of Object.entries({
-      "bootstrap-smtp-password": credentialFiles.smtpPassword,
-      "backup-s3-secret": credentialFiles.backupS3Secret
+      ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
+      "backup-s3-secret": platformPrivate.backup
     })) {
       if (source) {
-        const destination = `${CREDS}/${name}.cred`;
-        if (!host.exists(destination)) {
-          await seal(host, name, destination, privateFile(host, source, name));
-          host.remove(source);
+        const destination2 = `${CREDS}/${name}.cred`;
+        if (!host.exists(destination2)) {
+          await seal(host, name, destination2, source);
+          const sourcePath = name === "backup-s3-secret" ? credentialFiles.backupS3Secret : credentialFiles.emailSecret;
+          if (sourcePath)
+            host.remove(sourcePath);
         }
       }
     }
-    if (cloudflare) {
-      if (cloudflare.privateNetworkRuntimeToken)
-        await seal(host, "cloudflare-network-token", `${CREDS}/cloudflare-network-token.cred`, cloudflare.privateNetworkRuntimeToken);
-    }
     const runtime = config.runtime;
+    await ensureForgeZeroOtelCollector(host, config.telemetryEndpoint);
     const cloudflareConfigured = Boolean(runtime.environment.cloudflare);
-    const cloudflareNetworkConfigured = Boolean(runtime.environment.cloudflare?.warp);
     const envPath = `${runtime.environment.sharedDirectory}/.env`;
     const credentials = platformApiCredentialSpecs({
-      smtp: Boolean(credentialFiles.smtpPassword),
+      emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      cloudflareNetwork: cloudflareNetworkConfigured
+      realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
       serviceUser: runtime.serviceUser,
@@ -2924,8 +3904,8 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       keepReleases: runtime.keepReleases,
       drainDeadlineMs: runtime.environment.drainDeadlineMs
     });
-    await checked(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
-      await checked(host, ["id", runtime.serviceUser], "existing API service account");
+    await checked2(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
+      await checked2(host, ["id", runtime.serviceUser], "existing API service account");
     });
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
@@ -2934,39 +3914,39 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       host.write("/etc/forgezero/capacity.env", `FZ_CONCURRENCY_LIMIT=${runtime.environment.concurrencyLimit}
 `, 420);
     }
-    await checked(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
+    await checked2(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
     host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
     host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
     host.write("/etc/systemd/system/forgezero@green.service.d/port.conf", units.dropIns.green, 420);
     host.write("/etc/nginx/conf.d/forgezero-upstream.conf", edge.upstream, 420);
     host.write("/etc/nginx/conf.d/forgezero.conf", edge.site, 420);
     host.write("/etc/forgezero/deploy.env", activation.environment, 420);
-    host.write("/usr/local/libexec/forgezero-activate", activation.helper, 493);
+    host.write("/etc/forgezero/deploy-activation.json", activation.helper, 384);
     host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
-    await checked(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
+    await checked2(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
     const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
-    await checked(host, telemetry.unitCheck.argv, "OTLP collector supervision");
-    const otlpStatus = (await checked(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
+    await checked2(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    const otlpStatus = (await checked2(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
     if (!/^2\d\d$/.test(otlpStatus))
       throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
-    await checked(host, ["nginx", "-t"], "nginx configuration");
-    await checked(host, ["systemctl", "daemon-reload"], "systemd reload");
-    await checked(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    await checked2(host, ["nginx", "-t"], "nginx configuration");
+    await checked2(host, ["systemctl", "daemon-reload"], "systemd reload");
+    await checked2(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
-        host.write(invite, `plt_${randomBytes(24).toString("hex")}
+        host.write(invite, `plt_${randomBytes3(24).toString("hex")}
 `, 384);
-        await checked(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
+        await checked2(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
       }
     }
     if (config.database.role !== "none") {
       host.mkdir("/var/lib/forgezero-cluster", 448);
-      await checked(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
+      await checked2(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
       host.write("/etc/systemd/system/forgezero-db.service", databaseUnit(config), 420);
       host.write("/etc/systemd/system/forgezero-db-verify.service", databaseVerifyUnit(config), 420);
-      await checked(host, ["systemctl", "daemon-reload"], "database unit reload");
-      await checked(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
+      await checked2(host, ["systemctl", "daemon-reload"], "database unit reload");
+      await checked2(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
       const evidence = {
         expectedMode: "default",
         role: "COORDINATOR",
@@ -2984,7 +3964,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       host.write(PLATFORM_ENROL_SOURCE, `${enrolToken}
 `, 384);
     }
-    await checked(host, [
+    await checked2(host, [
       "runuser",
       "-u",
       "forgezero-agent",
@@ -3001,18 +3981,25 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   }
   if (config.cloudflareHandoff) {
     if (!host.exists(TUNNEL_CREDENTIAL) && cloudflare) {
-      await seal(host, "cloudflared-token", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
+      await seal(host, "CF_TUNNEL_CONNECTOR_TOKEN", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
     }
     if (!host.exists(TUNNEL_CREDENTIAL))
       throw new Error("sealed cloudflared connector credential is missing");
     host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
-    await checked(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
-    await checked(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
+    await checked2(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
+    await checked2(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
     const tunnelId = cloudflare?.tunnelId ?? installed?.cloudflareTunnelId ?? (config.kind === "platform" ? config.runtime.environment.cloudflare?.tunnelId : undefined);
     if (!tunnelId)
       throw new Error("Cloudflare tunnel identity is missing after handoff validation");
     await waitForCloudflaredTunnel(host, tunnelId);
   }
+  if (config.installWarp) {
+    if (!host.exists(WARP_CONNECTOR_CREDENTIAL))
+      throw new Error("sealed Cloudflare Mesh connector credential is missing");
+    host.write("/etc/systemd/system/forgezero-mesh-config.service", meshConnectorUnit(), 420);
+    await checked2(host, ["systemctl", "daemon-reload"], "Cloudflare Mesh unit reload");
+    await checked2(host, ["systemctl", "enable", "--now", "warp-svc.service", "forgezero-mesh-config.service"], "Cloudflare Mesh connector supervision");
+  }
   host.write(STATE_PATH, stateFor(config, cloudflare, installed?.cloudflareTunnelId), 384);
   const status = await bootstrapStatus(host);
   if (!status.initialized)
@@ -3030,7 +4017,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     if (!/^plt_[a-f0-9]{48}$/.test(token))
       throw new Error("platform invite is malformed");
     launch = {
-      command: `sudo -u ${shellQuote(config.runtime.serviceUser)} env FZ_SHARED_DIR=${shellQuote(config.runtime.environment.sharedDirectory)} /usr/local/bin/fz genesis --mode 2-of-3 --api ${shellQuote(config.apiUrl)} --app ${shellQuote(config.runtime.environment.appOrigin)}`,
+      executable: "/usr/local/bin/fz",
+      argv: ["genesis", "--mode", "1-of-1", "--api", config.apiUrl, "--app", config.runtime.environment.appOrigin],
+      environment: { FZ_SHARED_DIR: config.runtime.environment.sharedDirectory },
+      runAs: config.runtime.serviceUser,
       inviteUrl: `${config.runtime.environment.appOrigin}/invite?token=${encodeURIComponent(token)}`
     };
   }
@@ -3062,6 +4052,7 @@ function strictBootstrapDocument(value) {
     "runtime",
     "firewall",
     "installCloudflared",
+    "installWarp",
     "cloudflareHandoff",
     "realm",
     "enrolTokenFile",
@@ -3111,46 +4102,53 @@ function strictBootstrapDocument(value) {
       "otlpCollectorUnit",
       "agentOtlpEndpoint",
       "custodianEmail",
-      "smtp",
+      "email",
       "repository",
       "branch",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
       "backup",
-      "cloudflare"
+      "cloudflare",
+      "realtime"
     ], "runtime environment");
     if (runtime.credentialFiles !== undefined)
-      exactKeys(runtime.credentialFiles, ["smtpPassword", "backupS3Secret"], "runtime credential files");
+      exactKeys(runtime.credentialFiles, ["emailSecret", "backupS3Secret"], "runtime credential files");
     const environment = runtime.environment;
-    if (environment.smtp !== undefined)
-      exactKeys(environment.smtp, ["host", "port", "user", "from"], "SMTP config");
+    if (environment.email !== undefined) {
+      const email = exactKeys(environment.email, ["provider", "host", "port", "user", "from", "eu"], "email config");
+      if (email.provider === "smtp")
+        exactKeys(email, ["provider", "host", "port", "user", "from"], "SMTP config");
+      else if (email.provider === "jetemail")
+        exactKeys(email, ["provider", "from", "eu"], "JetEmail config");
+      else
+        throw new Error("email provider must be smtp or jetemail");
+    }
     if (environment.backup !== undefined)
       exactKeys(environment.backup, ["endpoint", "region", "bucket", "accessKeyId"], "backup config");
     if (environment.cloudflare !== undefined)
-      exactKeys(environment.cloudflare, ["accountId", "zoneId", "kvNamespaceId", "tunnelId", "tunnelService", "warp"], "Cloudflare runtime config");
-    if (environment.cloudflare && typeof environment.cloudflare === "object" && environment.cloudflare.warp !== undefined) {
-      exactKeys(environment.cloudflare.warp, ["organization", "virtualNetworkId", "deviceProfileId"], "Cloudflare WARP runtime config");
-    }
-  } else if (root.kind === "tenant") {
+      exactKeys(environment.cloudflare, ["accountId", "zoneId", "kvNamespaceId", "tunnelId", "tunnelService"], "Cloudflare runtime config");
+    if (environment.realtime !== undefined)
+      exactKeys(environment.realtime, ["workerScriptName", "endpoint", "producer"], "realtime runtime config");
+  } else if (root.kind === "enrolled-compute") {
     if (root.cloudflareHandoff !== undefined)
       exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
     if (root.bootstrapRunner !== undefined)
       exactKeys(root.bootstrapRunner, ["sshPrivateKeyFile", "targetTelemetryEndpoint"], "bootstrap runner config");
     for (const key of ["environment", "profile", "computeReference", "database", "enrolment", "runtime"]) {
       if (root[key] !== undefined && key !== "profile")
-        throw new Error(`tenant bootstrap cannot contain ${key}`);
+        throw new Error(`enrolled-compute activation cannot contain ${key}`);
     }
   } else
-    throw new Error("bootstrap config kind must be platform or tenant");
+    throw new Error("bootstrap config kind must be platform or enrolled-compute");
   return value;
 }
 function readBootstrapConfig(path) {
-  const metadata = lstatSync(path);
+  const metadata = lstatSync2(path);
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
     throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
   }
-  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync(path, "utf8"))));
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync3(path, "utf8"))));
 }
 function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
@@ -3168,19 +4166,19 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync,
-    read: (path) => readFileSync(path, "utf8"),
+    exists: existsSync3,
+    read: (path) => readFileSync3(path, "utf8"),
     write(path, content, mode) {
-      mkdirSync(dirname2(path), { recursive: true, mode: 493 });
+      mkdirSync3(dirname4(path), { recursive: true, mode: 493 });
       const temporary = `${path}.next.${process.pid}`;
-      writeFileSync(temporary, content, { mode });
-      chmodSync(temporary, mode);
-      renameSync(temporary, path);
+      writeFileSync3(temporary, content, { mode });
+      chmodSync2(temporary, mode);
+      renameSync3(temporary, path);
     },
-    mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
-    remove: (path) => rmSync(path, { force: true }),
+    mkdir: (path, mode) => mkdirSync3(path, { recursive: true, mode }),
+    remove: (path) => rmSync3(path, { force: true }),
     inspect(path) {
-      const value = lstatSync(path);
+      const value = lstatSync2(path);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
     },
     exec: execute,
@@ -3202,6 +4200,7 @@ function localBootstrapHost() {
     async installAgent(config, enrolTokenSourcePath) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync3("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -3213,8 +4212,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync(dirname2(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync3(dirname4(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync3(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -3231,39 +4230,32 @@ function localBootstrapHost() {
         gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
         gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
         generateGitIdentity: true,
-        pullDeployments: true,
-        pullMigrations: config.kind === "platform",
-        pullBootstrap: config.kind === "tenant" && Boolean(config.bootstrapRunner),
-        bootstrapSshCredentialPath: config.kind === "tenant" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
-        bootstrapTargetTelemetryEndpoint: config.kind === "tenant" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
+        pullDeployments: hasBinding,
+        pullMigrations: config.kind === "platform" && hasBinding,
+        pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
+        bootstrapSshCredentialPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+        bootstrapSshSourcePath: config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
+        bootstrapSshPublicKeyPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
+        bootstrapTargetTelemetryEndpoint: platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
         lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
-        ...config.kind === "platform" && config.runtime.environment.cloudflare?.warp ? {
-          warpOrganization: config.runtime.environment.cloudflare.warp.organization,
-          warpClientIdCredentialPath: WARP_CLIENT_ID_CREDENTIAL,
-          warpClientSecretCredentialPath: WARP_CLIENT_SECRET_CREDENTIAL,
-          cloudflareAccountId: config.runtime.environment.cloudflare.accountId,
-          cloudflareTunnelId: config.runtime.environment.cloudflare.tunnelId,
-          cloudflareVirtualNetworkId: config.runtime.environment.cloudflare.warp.virtualNetworkId,
-          cloudflareWarpPolicyId: config.runtime.environment.cloudflare.warp.deviceProfileId
-        } : {},
         enforceEgress: true,
         nodeHostname: config.nodeHostname,
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
-        ...config.kind === "tenant" || enrolTokenSourcePath ? {
-          enrolTokenSourcePath: config.kind === "tenant" ? config.enrolTokenFile : enrolTokenSourcePath,
+        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
+          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
           enrolTokenCredentialPath: ENROL_CREDENTIAL,
           enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,
-          project: config.kind === "tenant" ? config.realm : "platform",
-          environment: config.kind === "tenant" ? undefined : config.environment,
-          nodeLabel: config.kind === "tenant" ? config.nodeHostname : config.computeReference
+          project: config.kind === "enrolled-compute" ? config.realm : "platform",
+          environment: config.kind === "enrolled-compute" ? undefined : config.environment,
+          nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
         } : {}
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync(dirname2(unit.path), { recursive: true, mode: 493 });
-        writeFileSync(unit.path, unit.unit, { mode: 420 });
+        mkdirSync3(dirname4(unit.path), { recursive: true, mode: 493 });
+        writeFileSync3(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;