@forgezero/agent 0.1.41 → 0.1.42

package/dist/platform-fleet-verification.js

@@ -0,0 +1,3873 @@
+// src/agent-update.ts
+import { createHash, timingSafeEqual, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readlinkSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
+var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
+var VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var REGISTRY = "registry.npmjs.org";
+var syncPath = (path) => {
+  const descriptor = openSync(path, "r");
+  try {
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+};
+var syncReleaseDirectory = (directory) => {
+  for (const path of [
+    join(directory, "package.json"),
+    join(directory, "dist", "fz-agent.js"),
+    join(directory, "dist", "fz.js"),
+    join(directory, "dist", "fz-git-ssh.js"),
+    join(directory, "dist"),
+    directory,
+    dirname(directory)
+  ])
+    syncPath(path);
+};
+function validateAgentRelease(release) {
+  if (release?.package !== "@forgezero/agent")
+    throw new Error("agent update package is fixed");
+  if (!VERSION.test(release.version))
+    throw new Error("agent update version must be exact semver");
+  const expectedTarball = `/@forgezero/agent/-/agent-${release.version}.tgz`;
+  let url;
+  try {
+    url = new URL(release.tarball);
+  } catch {
+    throw new Error("agent update tarball URL is malformed");
+  }
+  if (url.protocol !== "https:" || url.hostname !== REGISTRY || url.port || url.username || url.password || url.search || url.hash || url.pathname !== expectedTarball)
+    throw new Error("agent update tarball must be the exact official npm artifact");
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/.exec(release.integrity);
+  if (!match || Buffer.from(match[1], "base64").length !== 64) {
+    throw new Error("agent update requires one sha512 npm integrity");
+  }
+  return release;
+}
+function compareVersions(left, right) {
+  if (!VERSION.test(left) || !VERSION.test(right))
+    throw new Error("agent version must be exact semver");
+  const a = left.split(".").map(Number);
+  const b = right.split(".").map(Number);
+  for (let index = 0;index < 3; index += 1) {
+    if (a[index] > b[index])
+      return 1;
+    if (a[index] < b[index])
+      return -1;
+  }
+  return 0;
+}
+var command = async (input) => {
+  const child = Bun.spawn([input.command, ...input.args], {
+    cwd: input.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var checked = async (run, input, label) => {
+  const result = await run(input);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed: ${result.output.trim()}`);
+  return result;
+};
+async function validateReleaseDirectory(directory, release, run) {
+  chmodSync(directory, 493);
+  chmodSync(join(directory, "dist"), 493);
+  const manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+  if (manifest.name !== release.package || manifest.version !== release.version) {
+    throw new Error("agent update manifest does not match the selected release");
+  }
+  const agent = join(directory, "dist", "fz-agent.js");
+  const cli = join(directory, "dist", "fz.js");
+  const gitSsh = join(directory, "dist", "fz-git-ssh.js");
+  for (const binary of [agent, cli, gitSsh]) {
+    if (!readFileSync(binary, "utf8").startsWith(`#!/usr/bin/env bun
+`)) {
+      throw new Error("agent update artifact is not a self-contained Bun executable");
+    }
+    chmodSync(binary, 493);
+  }
+  const version = (await checked(run, { command: agent, args: ["--version"] }, "agent update smoke test")).output.trim();
+  if (version !== release.version)
+    throw new Error(`agent update binary reports ${version}`);
+}
+async function stageAgentRelease(releaseInput, options) {
+  const release = validateAgentRelease(releaseInput);
+  if (compareVersions(release.version, options.currentVersion) <= 0) {
+    throw new Error(`agent update ${release.version} is not newer than ${options.currentVersion}`);
+  }
+  const root = resolve(options.root ?? DEFAULT_AGENT_RELEASE_ROOT);
+  const versions = join(root, "versions");
+  const finalDirectory = join(versions, release.version);
+  const currentLink = join(root, "current");
+  const stage = join(versions, `.${release.version}.${randomUUID()}.staging`);
+  const archive = join(stage, "agent.tgz");
+  const unpacked = join(stage, "unpacked");
+  const run = options.run ?? command;
+  mkdirSync(unpacked, { recursive: true, mode: 448 });
+  try {
+    const response = await (options.fetch ?? globalThis.fetch)(release.tarball, {
+      redirect: "error",
+      signal: AbortSignal.timeout(30000)
+    });
+    if (!response.ok)
+      throw new Error(`npm returned HTTP ${response.status}`);
+    const declared = Number(response.headers.get("content-length") ?? "0");
+    if (declared > MAX_AGENT_TARBALL_BYTES)
+      throw new Error("agent update tarball exceeds the size limit");
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (bytes.length === 0 || bytes.length > MAX_AGENT_TARBALL_BYTES) {
+      throw new Error("agent update tarball is empty or exceeds the size limit");
+    }
+    const expected = Buffer.from(release.integrity.slice("sha512-".length), "base64");
+    const actual = createHash("sha512").update(bytes).digest();
+    if (!timingSafeEqual(actual, expected))
+      throw new Error("agent update integrity mismatch");
+    writeFileSync(archive, bytes, { mode: 384, flag: "wx" });
+    for (const [member, relative] of [
+      ["package/package.json", "package.json"],
+      ["package/dist/fz-agent.js", "dist/fz-agent.js"],
+      ["package/dist/fz.js", "dist/fz.js"],
+      ["package/dist/fz-git-ssh.js", "dist/fz-git-ssh.js"]
+    ]) {
+      const extracted = await checked(run, {
+        command: "/usr/bin/tar",
+        args: ["-xOzf", archive, member]
+      }, `agent update extraction of ${member}`);
+      const destination = join(unpacked, relative);
+      mkdirSync(dirname(destination), { recursive: true, mode: 448 });
+      writeFileSync(destination, extracted.output, { mode: 384, flag: "wx" });
+    }
+    await validateReleaseDirectory(unpacked, release, run);
+    if (!existsSync(finalDirectory)) {
+      renameSync(unpacked, finalDirectory);
+      syncReleaseDirectory(finalDirectory);
+    } else
+      await validateReleaseDirectory(finalDirectory, release, run);
+    if (!existsSync(currentLink)) {
+      throw new Error("agent update requires an active immutable release to roll back to");
+    }
+    const previousTarget = readlinkSync(currentLink);
+    if (previousTarget !== join("versions", options.currentVersion)) {
+      throw new Error("agent update current release does not match the running version");
+    }
+    if (!existsSync(join(root, previousTarget))) {
+      throw new Error("agent update rollback release is missing");
+    }
+    return {
+      version: release.version,
+      fromVersion: options.currentVersion,
+      directory: finalDirectory,
+      previousTarget,
+      nextTarget: join("versions", release.version),
+      currentLink
+    };
+  } finally {
+    rmSync(stage, { recursive: true, force: true });
+  }
+}
+function selectAgentRelease(staged) {
+  const next = join(dirname(staged.currentLink), `.current.${randomUUID()}.next`);
+  try {
+    symlinkSync(staged.nextTarget, next);
+    renameSync(next, staged.currentLink);
+    syncPath(dirname(staged.currentLink));
+  } finally {
+    rmSync(next, { force: true });
+  }
+}
+function restoreAgentRelease(staged) {
+  const next = join(dirname(staged.currentLink), `.current.${randomUUID()}.rollback`);
+  try {
+    symlinkSync(staged.previousTarget, next);
+    renameSync(next, staged.currentLink);
+    syncPath(dirname(staged.currentLink));
+  } finally {
+    rmSync(next, { force: true });
+  }
+}
+
+// src/agent-update-helper.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  closeSync as closeSync2,
+  existsSync as existsSync2,
+  fsyncSync as fsyncSync2,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { connect, createServer } from "node:net";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+import { DEFAULT_SOCKET } from "@forgezero/vault";
+var AGENT_UPDATE_GROUP = "forgezero-update";
+var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
+var AGENT_UPDATE_JOURNAL = "/var/lib/forgezero/agent-update.json";
+var AGENT_UPDATE_RECEIPT = "/var/lib/forgezero/agent-update-receipt.json";
+var MAX_REQUEST_BYTES = 8 * 1024;
+var COMPUTE_HELPER_UNITS = [
+  "forgezero-agent-egress.service",
+  "forgezero-deploy-runner.service",
+  "forgezero-lifecycle-helper.service",
+  "forgezero-software-helper.service"
+];
+var VERSION2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var ATTEMPT_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var REASON_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+var MAX_REASON_BYTES = 512;
+var UPDATE_RETRY_BASE_MS = 5 * 60000;
+var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
+var boundedMessage = (value) => {
+  let message = value.replace(/[\r\n]+/g, " ").trim();
+  while (Buffer.byteLength(message, "utf8") > MAX_REASON_BYTES)
+    message = message.slice(0, -1);
+  return message;
+};
+var reason = (code, message) => ({
+  code: REASON_CODE.test(code) ? code : "UPDATE_FAILED",
+  message: boundedMessage(message) || "Agent update failed"
+});
+var validTime = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+function validateReceipt(value) {
+  if (!value || typeof value !== "object")
+    throw new Error("Agent update receipt is malformed");
+  const receipt = value;
+  if (!receipt.attemptId || !ATTEMPT_ID.test(receipt.attemptId))
+    throw new Error("Agent update attempt ID is invalid");
+  if (!receipt.fromVersion || !VERSION2.test(receipt.fromVersion))
+    throw new Error("Agent update source version is invalid");
+  if (!receipt.targetVersion || !VERSION2.test(receipt.targetVersion))
+    throw new Error("Agent update target version is invalid");
+  if (!["activating", "active", "rolled-back", "failed"].includes(receipt.outcome ?? "")) {
+    throw new Error("Agent update outcome is invalid");
+  }
+  if (!validTime(receipt.startedAtTs) || !validTime(receipt.updatedAtTs)) {
+    throw new Error("Agent update timestamps are invalid");
+  }
+  if (receipt.retryAfterTs !== undefined && !validTime(receipt.retryAfterTs)) {
+    throw new Error("Agent update retry timestamp is invalid");
+  }
+  if (receipt.rollbackHealthy !== undefined && typeof receipt.rollbackHealthy !== "boolean") {
+    throw new Error("Agent update rollback health is invalid");
+  }
+  if (receipt.reason && (!REASON_CODE.test(receipt.reason.code) || typeof receipt.reason.message !== "string" || Buffer.byteLength(receipt.reason.message, "utf8") > MAX_REASON_BYTES))
+    throw new Error("Agent update failure reason is invalid");
+  return {
+    attemptId: receipt.attemptId,
+    fromVersion: receipt.fromVersion,
+    targetVersion: receipt.targetVersion,
+    outcome: receipt.outcome,
+    startedAtTs: receipt.startedAtTs,
+    updatedAtTs: receipt.updatedAtTs,
+    ...receipt.retryAfterTs === undefined ? {} : { retryAfterTs: receipt.retryAfterTs },
+    ...receipt.rollbackHealthy === undefined ? {} : { rollbackHealthy: receipt.rollbackHealthy },
+    ...receipt.reason === undefined ? {} : { reason: receipt.reason }
+  };
+}
+function validateJournal(value, root) {
+  if (!value || typeof value !== "object")
+    throw new Error("Agent update journal is malformed");
+  const legacy = value;
+  if (legacy.schemaVersion === undefined) {
+    if (typeof legacy.version === "string" && VERSION2.test(legacy.version) && legacy.outcome === "active" && validTime(legacy.updatedAtTs) && Object.keys(value).every((key) => ["version", "outcome", "updatedAtTs"].includes(key)))
+      return;
+    throw new Error("Agent update legacy receipt is malformed");
+  }
+  const journal = value;
+  const receipt = validateReceipt(journal);
+  if (journal.schemaVersion !== 1)
+    throw new Error("Agent update journal schema is unsupported");
+  if (journal.target !== "compute" && journal.target !== "metal")
+    throw new Error("Agent update target is invalid");
+  if (!Number.isSafeInteger(journal.failureCount) || (journal.failureCount ?? -1) < 0) {
+    throw new Error("Agent update failure count is invalid");
+  }
+  const releaseRoot = resolve2(root);
+  if (journal.currentLink !== join2(releaseRoot, "current"))
+    throw new Error("Agent update current link is invalid");
+  if (journal.previousTarget !== join2("versions", receipt.fromVersion)) {
+    throw new Error("Agent update rollback target is invalid");
+  }
+  if (journal.nextTarget !== join2("versions", receipt.targetVersion)) {
+    throw new Error("Agent update next target is invalid");
+  }
+  return journal;
+}
+function readJournal(path, root) {
+  if (!existsSync2(path))
+    return;
+  return validateJournal(JSON.parse(readFileSync2(path, "utf8")), root);
+}
+function writeAtomic(path, value, mode) {
+  mkdirSync2(dirname2(path), { recursive: true, mode: 493 });
+  const next = `${path}.${randomUUID2()}.next`;
+  let file;
+  try {
+    file = openSync2(next, "wx", mode);
+    writeFileSync2(file, `${JSON.stringify(value)}
+`);
+    fsyncSync2(file);
+    closeSync2(file);
+    file = undefined;
+    renameSync2(next, path);
+    const directory = openSync2(dirname2(path), "r");
+    try {
+      fsyncSync2(directory);
+    } finally {
+      closeSync2(directory);
+    }
+  } finally {
+    if (file !== undefined)
+      closeSync2(file);
+    rmSync2(next, { force: true });
+  }
+}
+var publicReceipt = (journal) => {
+  const {
+    attemptId,
+    fromVersion,
+    targetVersion,
+    outcome,
+    startedAtTs,
+    updatedAtTs,
+    retryAfterTs,
+    rollbackHealthy,
+    reason: failureReason
+  } = journal;
+  return {
+    attemptId,
+    fromVersion,
+    targetVersion,
+    outcome,
+    startedAtTs,
+    updatedAtTs,
+    ...retryAfterTs === undefined ? {} : { retryAfterTs },
+    ...rollbackHealthy === undefined ? {} : { rollbackHealthy },
+    ...failureReason === undefined ? {} : { reason: failureReason }
+  };
+};
+function writeUpdateState(journalPath, receiptPath, journal) {
+  writeAtomic(journalPath, journal, 384);
+  writeAtomic(receiptPath, publicReceipt(journal), 416);
+}
+function readAgentUpdateReceipt(path = AGENT_UPDATE_RECEIPT) {
+  try {
+    if (!existsSync2(path))
+      return;
+    return validateReceipt(JSON.parse(readFileSync2(path, "utf8")));
+  } catch {
+    return;
+  }
+}
+var runCommand = async (input) => {
+  const child = Bun.spawn([input.command, ...input.args], {
+    cwd: input.cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var runOk = async (run, command2, args) => (await run({ command: command2, args })).exitCode === 0;
+var retryAfter = (now, failures) => now + Math.min(UPDATE_RETRY_MAX_MS, UPDATE_RETRY_BASE_MS * 2 ** Math.min(16, Math.max(0, failures - 1)));
+var stagedFromJournal = (journal, root) => ({
+  version: journal.targetVersion,
+  fromVersion: journal.fromVersion,
+  directory: join2(resolve2(root), journal.nextTarget),
+  previousTarget: journal.previousTarget,
+  nextTarget: journal.nextTarget,
+  currentLink: journal.currentLink
+});
+var restartAgent = async (target, run) => {
+  const helpers = target === "compute" ? COMPUTE_HELPER_UNITS : ["forgezero-metal-helper.service"];
+  for (const unit of helpers)
+    await run({ command: "/usr/bin/systemctl", args: ["try-restart", unit] });
+  const service = target === "compute" ? "forgezero-agent.service" : "forgezero-metal-agent.service";
+  if (!await runOk(run, "/usr/bin/systemctl", ["restart", service])) {
+    throw new Error(`systemd could not restart ${service}`);
+  }
+};
+var targetProbe = (target, run) => target === "compute" ? () => probeAgentSocket() : async () => await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-agent.service"]) && await runOk(run, "/usr/bin/systemctl", ["is-active", "--quiet", "forgezero-metal-helper.service"]);
+function probeAgentSocket(socketPath = DEFAULT_SOCKET, timeoutMs = 5000) {
+  return new Promise((resolve3) => {
+    const socket = connect(socketPath);
+    let settled = false;
+    let buffer = "";
+    const finish = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve3(value);
+    };
+    const timer = setTimeout(() => finish(false), timeoutMs);
+    socket.on("connect", () => socket.write(`{"op":"identity"}
+`));
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        finish(response.ok === false && response.error?.code === "APP_OPERATION_REFUSED");
+      } catch {
+        finish(false);
+      }
+    });
+    socket.on("error", () => finish(false));
+  });
+}
+async function activateAgentRelease(staged, options = {}) {
+  const run = options.run ?? runCommand;
+  const target = options.target ?? "compute";
+  const probe = options.probe ?? targetProbe(target, run);
+  const now = options.now ?? Date.now;
+  const journalPath = options.journalPath ?? AGENT_UPDATE_JOURNAL;
+  const receiptPath = options.receiptPath ?? AGENT_UPDATE_RECEIPT;
+  const previous = readJournal(journalPath, dirname2(staged.currentLink));
+  const attemptId = options.attemptId ?? randomUUID2();
+  if (!ATTEMPT_ID.test(attemptId))
+    throw new Error("Agent update attempt ID is invalid");
+  const startedAtTs = now();
+  const failureCount = previous?.targetVersion === staged.version ? previous.failureCount : 0;
+  let journal = {
+    schemaVersion: 1,
+    attemptId,
+    target,
+    fromVersion: staged.fromVersion,
+    targetVersion: staged.version,
+    outcome: "activating",
+    startedAtTs,
+    updatedAtTs: startedAtTs,
+    currentLink: staged.currentLink,
+    previousTarget: staged.previousTarget,
+    nextTarget: staged.nextTarget,
+    failureCount
+  };
+  writeUpdateState(journalPath, receiptPath, journal);
+  let selectionAttempted = false;
+  try {
+    selectionAttempted = true;
+    selectAgentRelease(staged);
+    await restartAgent(target, run);
+    if (!await probe())
+      throw new Error("the replacement Agent did not answer its retained Vault socket");
+    journal = { ...journal, outcome: "active", updatedAtTs: now(), rollbackHealthy: undefined };
+    writeUpdateState(journalPath, receiptPath, journal);
+    run({
+      command: "/usr/bin/systemctl",
+      args: ["try-restart", "--no-block", "forgezero-agent-update-helper.service"]
+    });
+    return { ok: true, version: staged.version };
+  } catch (cause) {
+    const message = cause instanceof Error ? cause.message : String(cause);
+    let rollbackHealthy = false;
+    let restored = false;
+    if (selectionAttempted) {
+      try {
+        restoreAgentRelease(staged);
+        restored = true;
+        await restartAgent(target, run);
+        rollbackHealthy = await probe();
+      } catch {
+        rollbackHealthy = false;
+      }
+    }
+    const failures = failureCount + 1;
+    const updatedAtTs = now();
+    journal = {
+      ...journal,
+      outcome: rollbackHealthy ? "rolled-back" : "failed",
+      updatedAtTs,
+      retryAfterTs: retryAfter(updatedAtTs, failures),
+      rollbackHealthy,
+      reason: reason(rollbackHealthy ? "REPLACEMENT_UNHEALTHY" : "ROLLBACK_UNHEALTHY", rollbackHealthy ? message : `${message}; the restored Agent did not pass its health probe`),
+      failureCount: failures
+    };
+    writeUpdateState(journalPath, receiptPath, journal);
+    return { ok: false, rolledBack: restored, rollbackHealthy, reason: message };
+  }
+}
+async function recoverInterruptedAgentUpdate(options = {}) {
+  const root = resolve2(options.root ?? DEFAULT_AGENT_RELEASE_ROOT);
+  const journalPath = options.journalPath ?? AGENT_UPDATE_JOURNAL;
+  const receiptPath = options.receiptPath ?? AGENT_UPDATE_RECEIPT;
+  const journal = readJournal(journalPath, root);
+  if (!journal)
+    return;
+  if (journal.outcome !== "activating") {
+    writeAtomic(receiptPath, publicReceipt(journal), 416);
+    return publicReceipt(journal);
+  }
+  const staged = stagedFromJournal(journal, root);
+  if (!existsSync2(join2(root, journal.previousTarget))) {
+    throw new Error("Agent update rollback release is missing");
+  }
+  const run = options.run ?? runCommand;
+  const probe = options.probe ?? targetProbe(journal.target, run);
+  restoreAgentRelease(staged);
+  let rollbackHealthy = false;
+  let failureMessage = "activation was interrupted before its health verdict became durable";
+  try {
+    await restartAgent(journal.target, run);
+    rollbackHealthy = await probe();
+  } catch (cause) {
+    failureMessage = `${failureMessage}; ${cause instanceof Error ? cause.message : String(cause)}`;
+  }
+  const failures = journal.failureCount + 1;
+  const updatedAtTs = (options.now ?? Date.now)();
+  const recovered = {
+    ...journal,
+    outcome: rollbackHealthy ? "rolled-back" : "failed",
+    updatedAtTs,
+    retryAfterTs: retryAfter(updatedAtTs, failures),
+    rollbackHealthy,
+    reason: reason(rollbackHealthy ? "ACTIVATION_INTERRUPTED" : "ROLLBACK_UNHEALTHY", failureMessage),
+    failureCount: failures
+  };
+  writeUpdateState(journalPath, receiptPath, recovered);
+  return readAgentUpdateReceipt(receiptPath);
+}
+function startAgentUpdateHelper(options = {}) {
+  const socketPath = options.socketPath ?? DEFAULT_AGENT_UPDATE_SOCKET;
+  if (existsSync2(socketPath))
+    unlinkSync(socketPath);
+  mkdirSync2(dirname2(socketPath), { recursive: true, mode: 488 });
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const receiptPath = options.receiptPath ?? AGENT_UPDATE_RECEIPT;
+  const journalPath = options.journalPath ?? AGENT_UPDATE_JOURNAL;
+  const releaseRoot = options.root ?? DEFAULT_AGENT_RELEASE_ROOT;
+  const activate = options.activate ?? ((staged, target, attemptId) => activateAgentRelease(staged, { target, attemptId, journalPath, receiptPath, now: options.now }));
+  let busy = true;
+  let blocked;
+  (options.recover ?? (() => recoverInterruptedAgentUpdate({
+    root: releaseRoot,
+    journalPath,
+    receiptPath,
+    now: options.now
+  })))().catch((cause) => {
+    blocked = cause instanceof Error ? cause.message : String(cause);
+  }).finally(() => {
+    busy = false;
+  });
+  const server = createServer((socket) => {
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      if (Buffer.byteLength(buffer) > MAX_REQUEST_BYTES) {
+        socket.end(`${JSON.stringify({ ok: false, error: { code: "TOO_LARGE", message: "update request too large" } })}
+`);
+        return;
+      }
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      const line = buffer.slice(0, newline);
+      buffer = "";
+      let ownsBusy = false;
+      Promise.resolve().then(() => JSON.parse(line)).then(async (request) => {
+        if (blocked)
+          throw new Error(`update journal needs operator recovery: ${blocked}`);
+        if (busy)
+          throw new Error("another Agent update or recovery is already active");
+        if (request.op !== "apply")
+          throw new Error("unknown update operation");
+        if (request.target !== "compute" && request.target !== "metal") {
+          throw new Error("agent update target is invalid");
+        }
+        const attemptId = request.attemptId ?? randomUUID2();
+        if (!ATTEMPT_ID.test(attemptId))
+          throw new Error("Agent update attempt ID is invalid");
+        const prior = readJournal(journalPath, releaseRoot);
+        const now = (options.now ?? Date.now)();
+        if (prior?.targetVersion === request.release.version && (prior.outcome === "rolled-back" || prior.outcome === "failed") && (prior.retryAfterTs ?? 0) > now)
+          throw new Error(`Agent update ${request.release.version} is quarantined until ${prior.retryAfterTs}`);
+        busy = true;
+        ownsBusy = true;
+        const staged = await stageAgentRelease(request.release, {
+          currentVersion: request.currentVersion,
+          root: releaseRoot
+        });
+        const response = { ok: true, status: "staged", version: staged.version, attemptId };
+        socket.end(`${JSON.stringify(response)}
+`);
+        setTimer(() => void activate(staged, request.target, attemptId).catch((cause) => {
+          blocked = cause instanceof Error ? cause.message : String(cause);
+        }).finally(() => {
+          busy = false;
+        }), 100);
+        ownsBusy = false;
+      }).catch((cause) => {
+        if (ownsBusy)
+          busy = false;
+        const response = {
+          ok: false,
+          error: { code: "UPDATE_REFUSED", message: cause instanceof Error ? cause.message : String(cause) }
+        };
+        socket.end(`${JSON.stringify(response)}
+`);
+      });
+    });
+    socket.on("error", () => socket.destroy());
+  });
+  server.listen(socketPath, () => chmodSync2(socketPath, 432));
+  return server;
+}
+function requestAgentUpdate(request, socketPath = DEFAULT_AGENT_UPDATE_SOCKET, timeoutMs = 90000) {
+  return new Promise((resolve3, reject) => {
+    const socket = connect(socketPath, () => socket.write(`${JSON.stringify(request)}
+`));
+    let buffer = "";
+    socket.setTimeout(timeoutMs, () => {
+      socket.destroy();
+      reject(new Error("agent update helper did not answer before its deadline"));
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      socket.end();
+      try {
+        resolve3(JSON.parse(buffer.slice(0, newline)));
+      } catch (cause) {
+        reject(cause);
+      }
+    });
+    socket.on("error", reject);
+  });
+}
+
+// src/software.ts
+import { createHash as createHash2 } from "node:crypto";
+import {
+  accessSync,
+  chmodSync as chmodSync3,
+  copyFileSync,
+  mkdtempSync,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
+  symlinkSync as symlinkSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join3 } from "node:path";
+var PINNED_BUN_VERSION = "1.3.14";
+var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f";
+var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
+var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
+var OS_CATALOG = [
+  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+];
+var SOFTWARE_CATALOG = [
+  { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+];
+var UBUNTU_2604_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "nginx", version: "ubuntu-26.04" } },
+  { requirement: { id: "arangodb", version: "3.11.14" } },
+  { requirement: { id: "cloudflared", version: "2026.7.3" } },
+  { requirement: { id: "cloudflare-warp", version: "2026.6.822.0-min" } },
+  { requirement: { id: "ufw", version: "ubuntu-26.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
+];
+var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var run = async (argv, env = {}) => {
+  const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: path, LANG: "C", LC_ALL: "C", ...env } });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var download = async (url, destination, sha256) => {
+  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(120000) });
+  if (!response.ok)
+    throw new Error(`download failed with HTTP ${response.status}`);
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (createHash2("sha256").update(bytes).digest("hex") !== sha256)
+    throw new Error("download checksum mismatch");
+  writeFileSync3(destination, bytes, { mode: 384, flag: "wx" });
+};
+var successful = (result, pattern) => result.exitCode === 0 && (!pattern || pattern.test(result.output));
+var aptInstall = async (name) => {
+  const environment = { DEBIAN_FRONTEND: "noninteractive" };
+  const update = await run(["/usr/bin/apt-get", "update", "-qq"], environment);
+  return update.exitCode === 0 ? run(["/usr/bin/apt-get", "install", "-y", name], environment) : update;
+};
+async function executeSoftwareOperation(operation) {
+  const { software, version } = operation;
+  if (!UBUNTU_2604_X64.some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+    return { exitCode: 2, output: "unsupported software operation" };
+  }
+  if (operation.kind === "check") {
+    if (software === "bun")
+      return run(["/usr/local/bin/bun", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /^1\.3\.14\s*$/m) ? 0 : 1 }));
+    if (software === "nginx") {
+      const binary = await run(["/usr/sbin/nginx", "-v"]);
+      return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
+    }
+    if (software === "arangodb") {
+      const binary = await run(["/usr/bin/arangod", "--version"]);
+      if (!successful(binary, /3\.11\.14/))
+        return { ...binary, exitCode: 1 };
+      const [active, enabled] = await Promise.all([
+        run(["/usr/bin/systemctl", "is-active", "--quiet", "arangodb3.service"]),
+        run(["/usr/bin/systemctl", "is-enabled", "--quiet", "arangodb3.service"])
+      ]);
+      return active.exitCode !== 0 && enabled.exitCode !== 0 ? { exitCode: 0, output: binary.output } : { exitCode: 1, output: "vendor standalone unit remains active or enabled" };
+    }
+    if (software === "cloudflared")
+      return run(["/usr/local/bin/cloudflared", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /2026\.7\.3/) ? 0 : 1 }));
+    if (software === "cloudflare-warp")
+      return run(["/usr/bin/warp-cli", "--version"]).then((result) => {
+        const match = result.output.match(/(\d{4})\.(\d+)\.(\d+)\.(\d+)/);
+        const observed = match?.slice(1).map(Number);
+        const minimum = [2026, 6, 822, 0];
+        const supported = observed && observed.some((part, index) => part > minimum[index] && observed.slice(0, index).every((prior, priorIndex) => prior === minimum[priorIndex])) || observed?.every((part, index) => part === minimum[index]);
+        return { ...result, exitCode: result.exitCode === 0 && supported ? 0 : 1 };
+      });
+    const binaries = software === "ufw" ? ["/usr/sbin/ufw"] : ["/usr/bin/ssh", "/usr/bin/scp", "/usr/bin/ssh-keyscan", "/usr/bin/ssh-keygen"];
+    try {
+      binaries.forEach((binary) => accessSync(binary));
+      return { exitCode: 0, output: "" };
+    } catch (cause) {
+      return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
+    }
+  }
+  if (software === "nginx" || software === "ufw" || software === "openssh-client") {
+    const installed = await aptInstall(software === "openssh-client" ? "openssh-client" : software);
+    if (installed.exitCode !== 0 || software !== "nginx")
+      return installed;
+    return run(["/usr/bin/systemctl", "enable", "--now", "nginx.service"]);
+  }
+  const directory = mkdtempSync(join3(tmpdir(), "forgezero-software-"));
+  try {
+    if (software === "cloudflare-warp") {
+      const key = join3(directory, "cloudflare-warp-key.gpg");
+      await download("https://pkg.cloudflareclient.com/pubkey.gpg", key, "0f37fc298c98e88ee3c0ee68c95b69f1dba9eb477abe3167e13982105911264d");
+      mkdirSync3("/usr/share/keyrings", { recursive: true, mode: 493 });
+      const dearmored = await run([
+        "/usr/bin/gpg",
+        "--batch",
+        "--yes",
+        "--dearmor",
+        "-o",
+        "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg",
+        key
+      ]);
+      if (dearmored.exitCode !== 0)
+        return dearmored;
+      mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+      writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ resolute main
+`, { mode: 420 });
+      return aptInstall("cloudflare-warp");
+    }
+    if (software === "bun") {
+      const archive = join3(directory, "bun.zip");
+      await download("https://github.com/oven-sh/bun/releases/download/bun-v1.3.14/bun-linux-x64.zip", archive, BUN_RELEASE_SHA256);
+      const unpacked = join3(directory, "unpacked");
+      mkdirSync3(unpacked, { mode: 448 });
+      const unzipped = await run(["/usr/bin/unzip", "-q", archive, "-d", unpacked]);
+      if (unzipped.exitCode !== 0)
+        return unzipped;
+      mkdirSync3("/usr/local/lib/forgezero/runtime", { recursive: true, mode: 493 });
+      copyFileSync(join3(unpacked, "bun-linux-x64", "bun"), "/usr/local/lib/forgezero/runtime/bun.next");
+      chmodSync3("/usr/local/lib/forgezero/runtime/bun.next", 493);
+      renameSync3("/usr/local/lib/forgezero/runtime/bun.next", "/usr/local/lib/forgezero/runtime/bun");
+      try {
+        unlinkSync2("/usr/local/bin/bun");
+      } catch {}
+      symlinkSync2("/usr/local/lib/forgezero/runtime/bun", "/usr/local/bin/bun");
+      return { exitCode: 0, output: "" };
+    }
+    if (software === "cloudflared") {
+      const binary = join3(directory, "cloudflared");
+      await download("https://github.com/cloudflare/cloudflared/releases/download/2026.7.3/cloudflared-linux-amd64", binary, CLOUDFLARED_SHA256);
+      chmodSync3(binary, 493);
+      copyFileSync(binary, "/usr/local/bin/cloudflared");
+      chmodSync3("/usr/local/bin/cloudflared", 493);
+      return { exitCode: 0, output: "" };
+    }
+    const deb = join3(directory, "arangodb.deb");
+    await download("https://download.arangodb.com/arangodb311/DEBIAN/amd64/arangodb3_3.11.14-1_amd64.deb", deb, ARANGO_SHA256);
+    let installed = await run(["/usr/bin/dpkg", "-i", deb], { DEBIAN_FRONTEND: "noninteractive" });
+    if (installed.exitCode !== 0)
+      installed = await run(["/usr/bin/apt-get", "-y", "-f", "install"], { DEBIAN_FRONTEND: "noninteractive" });
+    if (installed.exitCode !== 0)
+      return installed;
+    await run(["/usr/bin/systemctl", "disable", "--now", "arangodb3.service"]);
+    return { exitCode: 0, output: "" };
+  } finally {
+    rmSync3(directory, { recursive: true, force: true });
+  }
+}
+function observeSoftwareHost(osRelease = readFileSync3("/etc/os-release", "utf8"), architecture = process.arch) {
+  const values = Object.fromEntries(osRelease.split(`
+`).flatMap((line) => {
+    const separator = line.indexOf("=");
+    return separator > 0 ? [[line.slice(0, separator), line.slice(separator + 1).replace(/^['"]|['"]$/g, "")]] : [];
+  }));
+  return {
+    os: { id: (values.ID ?? "unknown").toLowerCase(), versionId: values.VERSION_ID ?? "unknown" },
+    architecture
+  };
+}
+function validateSoftwareRequirements(value, _options = {}) {
+  if (!Array.isArray(value) || value.length > 32)
+    throw new Error("software requirements must be an array of at most 32 entries");
+  const seen = new Set;
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item))
+      throw new Error("software requirement must be an object");
+    const row = item;
+    if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
+      throw new Error("software requirement contains an unknown field");
+    }
+    if (!["bun", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+      throw new Error("software requirement coordinate is invalid");
+    }
+    const requirement = { id: row.id, version: row.version };
+    if (seen.has(requirement.id))
+      throw new Error(`duplicate software requirement: ${requirement.id}`);
+    seen.add(requirement.id);
+    const catalog = SOFTWARE_CATALOG.find((candidate) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!catalog || catalog.status !== "active") {
+      throw new Error(`software requirement is not active: ${requirement.id}@${requirement.version}`);
+    }
+    return requirement;
+  });
+}
+async function ensureSoftwareRequirements(requirementsInput, options) {
+  const requirements = validateSoftwareRequirements(requirementsInput);
+  const observation = options.observation ?? observeSoftwareHost();
+  const os = OS_CATALOG.find((candidate) => candidate.id === observation.os.id && candidate.version === observation.os.versionId && candidate.architecture === observation.architecture);
+  if (!os || os.status !== "active") {
+    throw new Error(`unsupported software strategy: ${observation.os.id} ${observation.os.versionId} ${observation.architecture}`);
+  }
+  const results = [];
+  for (const requirement of requirements) {
+    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    if (!strategy)
+      throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
+    const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
+    if (before.exitCode === 0) {
+      results.push({ ...requirement, changed: false });
+      continue;
+    }
+    const installed = await options.exec({ kind: "install", software: requirement.id, version: requirement.version });
+    if (installed.exitCode !== 0)
+      throw new Error(`could not install ${requirement.id}@${requirement.version}: ${installed.output.trim()}`);
+    const after = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
+    if (after.exitCode !== 0)
+      throw new Error(`${requirement.id}@${requirement.version} did not pass its post-install check`);
+    results.push({ ...requirement, changed: true });
+  }
+  return results;
+}
+
+// src/capacity-calibration.ts
+var percentile95 = (values) => {
+  if (values.length === 0)
+    return Number.POSITIVE_INFINITY;
+  const sorted = values.toSorted((left, right) => left - right);
+  return sorted[Math.min(sorted.length - 1, Math.ceil(sorted.length * 0.95) - 1)];
+};
+function localCalibrationEndpoint(value) {
+  const endpoint = new URL(value);
+  if (endpoint.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(endpoint.hostname) || !endpoint.port || endpoint.username || endpoint.password || endpoint.hash) {
+    throw new Error("Capacity calibration requires an explicit loopback HTTP endpoint and port.");
+  }
+  return endpoint;
+}
+function validateCapacityCalibrationOptions(options) {
+  const endpoint = localCalibrationEndpoint(options.endpoint);
+  const maxConcurrency = options.maxConcurrency ?? 256;
+  const requestsPerWorker = options.requestsPerWorker ?? 8;
+  const maxP95Ms = options.maxP95Ms ?? 250;
+  const maxErrorRate = options.maxErrorRate ?? 0.01;
+  const headroomRatio = options.headroomRatio ?? 0.8;
+  const requestTimeoutMs = options.requestTimeoutMs ?? 5000;
+  if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency < 1 || maxConcurrency > 4096 || !Number.isSafeInteger(requestsPerWorker) || requestsPerWorker < 2 || requestsPerWorker > 100 || !Number.isFinite(maxP95Ms) || maxP95Ms < 1 || !Number.isFinite(maxErrorRate) || maxErrorRate < 0 || maxErrorRate > 0.2 || !Number.isFinite(headroomRatio) || headroomRatio < 0.25 || headroomRatio > 0.95 || !Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 100 || requestTimeoutMs > 30000) {
+    throw new Error("Capacity calibration bounds are invalid.");
+  }
+  return {
+    endpoint,
+    maxConcurrency,
+    requestsPerWorker,
+    maxP95Ms,
+    maxErrorRate,
+    headroomRatio,
+    requestTimeoutMs
+  };
+}
+async function stage(endpoint, concurrency, requestsPerWorker, timeoutMs, fetcher) {
+  const latencies = [];
+  let succeeded = 0;
+  let failed = 0;
+  let overloaded = 0;
+  const started = performance.now();
+  await Promise.all(Array.from({ length: concurrency }, async () => {
+    for (let request = 0;request < requestsPerWorker; request += 1) {
+      const requestStarted = performance.now();
+      try {
+        const response = await fetcher(endpoint, {
+          method: "GET",
+          headers: { accept: "application/json", "user-agent": "forgezero-capacity-calibration/1" },
+          signal: AbortSignal.timeout(timeoutMs),
+          redirect: "error"
+        });
+        await response.body?.cancel();
+        if (response.ok)
+          succeeded += 1;
+        else {
+          failed += 1;
+          if (response.status === 503)
+            overloaded += 1;
+        }
+      } catch {
+        failed += 1;
+      } finally {
+        latencies.push(performance.now() - requestStarted);
+      }
+    }
+  }));
+  const elapsedSeconds = Math.max((performance.now() - started) / 1000, 0.001);
+  return {
+    concurrency,
+    requests: concurrency * requestsPerWorker,
+    succeeded,
+    failed,
+    overloaded,
+    throughputPerSecond: Number(((succeeded + failed) / elapsedSeconds).toFixed(2)),
+    p95Ms: Number(percentile95(latencies).toFixed(2))
+  };
+}
+async function calibrateHttpConcurrency(options, fetcher = fetch) {
+  const {
+    endpoint,
+    maxConcurrency,
+    requestsPerWorker,
+    maxP95Ms,
+    maxErrorRate,
+    headroomRatio,
+    requestTimeoutMs: timeoutMs
+  } = validateCapacityCalibrationOptions(options);
+  const stages = [];
+  let lastSafe = 1;
+  let stopReason = "maximum-tested";
+  for (let concurrency = 1;; concurrency = Math.min(maxConcurrency, concurrency * 2)) {
+    const measured = await stage(endpoint, concurrency, requestsPerWorker, timeoutMs, fetcher);
+    stages.push(measured);
+    const errorRate = measured.failed / measured.requests;
+    const previous = stages.at(-2);
+    const throughputRegressed = Boolean(previous && concurrency > 1 && measured.throughputPerSecond < previous.throughputPerSecond * 0.9);
+    if (measured.overloaded > 0 || errorRate > maxErrorRate)
+      stopReason = "errors";
+    else if (measured.p95Ms > maxP95Ms)
+      stopReason = "latency";
+    else if (throughputRegressed)
+      stopReason = "throughput-regression";
+    else
+      lastSafe = concurrency;
+    if (stopReason !== "maximum-tested" || concurrency === maxConcurrency)
+      break;
+  }
+  return {
+    endpoint: endpoint.toString(),
+    recommendedConcurrency: Math.max(1, Math.floor(lastSafe * headroomRatio)),
+    stopReason,
+    stages
+  };
+}
+
+// src/definition.ts
+var PIPELINE_VERSION = 3;
+var DEPLOY_SCHEMA_URL = "https://www.forgezero.net/schemas/deploy-v3.json";
+
+class DefinitionError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DefinitionError";
+  }
+}
+var record = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new DefinitionError(`${where} must be an object.`);
+  }
+  return value;
+};
+var text = (value, where) => {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new DefinitionError(`${where} must be a non-empty string.`);
+  }
+  return value;
+};
+var argv = (value, where) => {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 256) {
+    throw new DefinitionError(`${where} must contain from 1 to 256 arguments.`);
+  }
+  let bytes = 0;
+  const parsed = value.map((argument, index) => {
+    if (typeof argument !== "string" || argument.length === 0 || argument.length > 16384 || argument.includes("\x00")) {
+      throw new DefinitionError(`${where}[${index}] must be a non-empty bounded string without NUL.`);
+    }
+    if (argument.includes("${") && !/^\$\{FZ_[A-Z0-9_]+\}$/.test(argument)) {
+      throw new DefinitionError(`${where}[${index}] contains unsupported interpolation; only one exact FZ coordinate is allowed.`);
+    }
+    bytes += Buffer.byteLength(argument);
+    if (bytes > 64 * 1024)
+      throw new DefinitionError(`${where} is larger than 64 KiB.`);
+    return argument;
+  });
+  const executable = parsed[0].split("/").at(-1).toLowerCase();
+  if (new Set(["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"]).has(executable)) {
+    throw new DefinitionError(`${where}[0] may not invoke a shell or command dispatcher.`);
+  }
+  return parsed;
+};
+var exactKeys = (value, allowed, where) => {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length > 0)
+    throw new DefinitionError(`${where} contains unknown field(s): ${unknown.join(", ")}.`);
+};
+var NAME = /^[a-z][a-z0-9-]{0,62}$/;
+var RESERVED_STEP_ENV = new Set([
+  "PATH",
+  "HOME",
+  "SHELL",
+  "PWD",
+  "BUN_INSTALL",
+  "NODE_OPTIONS",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "GIT_SSH",
+  "GIT_SSH_COMMAND"
+]);
+function capacityCalibration(value, where) {
+  const calibration = record(value, where);
+  exactKeys(calibration, [
+    "endpoint",
+    "maxConcurrency",
+    "requestsPerWorker",
+    "maxP95Ms",
+    "maxErrorRate",
+    "headroomRatio",
+    "requestTimeoutMs"
+  ], where);
+  const endpoint = text(calibration.endpoint, `${where}.endpoint`);
+  try {
+    localCalibrationEndpoint(endpoint);
+  } catch (cause) {
+    throw new DefinitionError(cause instanceof Error ? cause.message : `${where}.endpoint is invalid.`);
+  }
+  const optionalNumber = (name) => {
+    const raw = calibration[name];
+    if (raw === undefined)
+      return;
+    if (typeof raw !== "number" || !Number.isFinite(raw)) {
+      throw new DefinitionError(`${where}.${name} must be a finite number.`);
+    }
+    return raw;
+  };
+  const parsed = {
+    endpoint,
+    ...Object.fromEntries([
+      "maxConcurrency",
+      "requestsPerWorker",
+      "maxP95Ms",
+      "maxErrorRate",
+      "headroomRatio",
+      "requestTimeoutMs"
+    ].flatMap((name) => {
+      const found = optionalNumber(name);
+      return found === undefined ? [] : [[name, found]];
+    }))
+  };
+  try {
+    validateCapacityCalibrationOptions(parsed);
+  } catch (cause) {
+    throw new DefinitionError(cause instanceof Error ? cause.message : `${where} bounds are invalid.`);
+  }
+  return parsed;
+}
+function validateDeploymentService(value, where = "service") {
+  const service = record(value, where);
+  exactKeys(service, [
+    "strategy",
+    "publicPort",
+    "applicationPorts",
+    "command",
+    "healthPath",
+    "maxConnections",
+    "websocket",
+    "drainMs"
+  ], where);
+  if (service.strategy !== "direct" && service.strategy !== "blue-green") {
+    throw new DefinitionError(`${where}.strategy must be direct or blue-green.`);
+  }
+  const publicPort = Number(service.publicPort);
+  if (!Number.isSafeInteger(publicPort) || publicPort < 1024 || publicPort > 65535) {
+    throw new DefinitionError(`${where}.publicPort must be an unprivileged TCP port.`);
+  }
+  const allocation = record(service.applicationPorts, `${where}.applicationPorts`);
+  let applicationPorts;
+  const required = service.strategy === "blue-green" ? 2 : 1;
+  if (allocation.mode === "fixed") {
+    exactKeys(allocation, ["mode", "ports"], `${where}.applicationPorts`);
+    if (!Array.isArray(allocation.ports) || allocation.ports.length !== required || allocation.ports.some((port) => !Number.isSafeInteger(port) || Number(port) < 1024 || Number(port) > 65535) || new Set(allocation.ports).size !== allocation.ports.length || allocation.ports.includes(publicPort)) {
+      throw new DefinitionError(`${where}.applicationPorts needs ${required} distinct unprivileged port(s), disjoint from publicPort.`);
+    }
+    applicationPorts = { mode: "fixed", ports: allocation.ports };
+  } else if (allocation.mode === "dynamic") {
+    exactKeys(allocation, ["mode", "from", "to"], `${where}.applicationPorts`);
+    const from = Number(allocation.from);
+    const to = Number(allocation.to);
+    if (!Number.isSafeInteger(from) || !Number.isSafeInteger(to) || from < 1024 || to > 65535 || to - from + 1 < required || publicPort >= from && publicPort <= to) {
+      throw new DefinitionError(`${where}.applicationPorts dynamic range is invalid or includes publicPort.`);
+    }
+    applicationPorts = { mode: "dynamic", from, to };
+  } else
+    throw new DefinitionError(`${where}.applicationPorts.mode must be fixed or dynamic.`);
+  const command2 = argv(service.command, `${where}.command`);
+  for (const argument of command2) {
+    const coordinate = argument.match(/^\$\{(FZ_[A-Z0-9_]+)\}$/)?.[1];
+    if (coordinate && !["FZ_APP_PORT", "FZ_RELEASE"].includes(coordinate)) {
+      throw new DefinitionError(`${where}.command uses unsupported coordinate ${coordinate}.`);
+    }
+  }
+  if (typeof service.healthPath !== "string" || !/^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/.test(service.healthPath) || service.healthPath.includes("..") || service.healthPath.includes("//")) {
+    throw new DefinitionError(`${where}.healthPath must be one bounded absolute path.`);
+  }
+  if (service.websocket !== undefined && typeof service.websocket !== "boolean") {
+    throw new DefinitionError(`${where}.websocket must be a boolean.`);
+  }
+  const maxConnections = service.maxConnections === undefined ? undefined : Number(service.maxConnections);
+  if (maxConnections !== undefined && (!Number.isSafeInteger(maxConnections) || maxConnections < 1 || maxConnections > 1e6)) {
+    throw new DefinitionError(`${where}.maxConnections must be from 1 to 1000000.`);
+  }
+  const drainMs = service.drainMs === undefined ? 30000 : Number(service.drainMs);
+  if (!Number.isSafeInteger(drainMs) || drainMs < 0 || drainMs > 300000) {
+    throw new DefinitionError(`${where}.drainMs must be from 0 to 300000.`);
+  }
+  return {
+    strategy: service.strategy,
+    publicPort,
+    applicationPorts,
+    command: command2,
+    healthPath: service.healthPath,
+    ...maxConnections === undefined ? {} : { maxConnections },
+    websocket: service.websocket === true,
+    drainMs
+  };
+}
+function parseDeployDefinition(value, options = {}) {
+  const root = record(value, "pipeline");
+  exactKeys(root, ["$schema", "version", "name", "requireAttestation", "profiles", "steps"], "pipeline");
+  if (root.$schema !== undefined && root.$schema !== DEPLOY_SCHEMA_URL) {
+    throw new DefinitionError(`pipeline.$schema must be ${DEPLOY_SCHEMA_URL}.`);
+  }
+  if (root.version !== PIPELINE_VERSION) {
+    throw new DefinitionError(`pipeline.version must be ${PIPELINE_VERSION}.`);
+  }
+  if (root.requireAttestation !== undefined && typeof root.requireAttestation !== "boolean") {
+    throw new DefinitionError("pipeline.requireAttestation must be a boolean.");
+  }
+  const rawProfiles = record(root.profiles, "pipeline.profiles");
+  const profileEntries = Object.entries(rawProfiles);
+  if (profileEntries.length === 0 || profileEntries.length > 32) {
+    throw new DefinitionError("pipeline.profiles must contain from 1 to 32 named profiles.");
+  }
+  if (!Array.isArray(root.steps) || root.steps.length === 0 || root.steps.length > 256) {
+    throw new DefinitionError("pipeline.steps must contain from 1 to 256 steps.");
+  }
+  const profiles = {};
+  for (const [name2, raw] of profileEntries) {
+    if (!NAME.test(name2))
+      throw new DefinitionError(`pipeline profile name is invalid: ${name2}.`);
+    const profile = record(raw, `profiles.${name2}`);
+    exactKeys(profile, ["software", "service", "capacityCalibration"], `profiles.${name2}`);
+    if (!Array.isArray(profile.software)) {
+      throw new DefinitionError(`profiles.${name2}.software must be an array.`);
+    }
+    const software = validateSoftwareRequirements(profile.software, options);
+    const service = profile.service === undefined ? undefined : validateDeploymentService(profile.service, `profiles.${name2}.service`);
+    if (service && !software.some(({ id }) => id === "nginx")) {
+      throw new DefinitionError(`profiles.${name2}.service requires the reviewed nginx software strategy.`);
+    }
+    profiles[name2] = {
+      software,
+      ...profile.service === undefined ? {} : {
+        service
+      },
+      ...profile.capacityCalibration === undefined ? {} : {
+        capacityCalibration: capacityCalibration(profile.capacityCalibration, `profiles.${name2}.capacityCalibration`)
+      }
+    };
+  }
+  const phases = new Set(["build", "release", "migrate", "health"]);
+  const steps = root.steps.map((raw, index) => {
+    const step = record(raw, `steps[${index}]`);
+    exactKeys(step, ["name", "exec", "phase", "scope", "profiles", "secrets", "always", "timeoutMs", "when"], `steps[${index}]`);
+    const phase = text(step.phase, `steps[${index}].phase`);
+    if (!phases.has(phase))
+      throw new DefinitionError(`steps[${index}].phase is not supported.`);
+    if (step.scope !== "target" && step.scope !== "release") {
+      throw new DefinitionError(`steps[${index}].scope must be target or release.`);
+    }
+    if (step.always !== undefined && typeof step.always !== "boolean") {
+      throw new DefinitionError(`steps[${index}].always must be a boolean.`);
+    }
+    let selectedProfiles;
+    if (step.profiles !== undefined) {
+      if (!Array.isArray(step.profiles) || step.profiles.length === 0 || step.profiles.some((name2) => typeof name2 !== "string" || !Object.hasOwn(profiles, name2))) {
+        throw new DefinitionError(`steps[${index}].profiles must name existing profiles.`);
+      }
+      selectedProfiles = [...step.profiles];
+      if (new Set(selectedProfiles).size !== selectedProfiles.length) {
+        throw new DefinitionError(`steps[${index}].profiles must not contain duplicates.`);
+      }
+    }
+    if (step.secrets !== undefined && (!Array.isArray(step.secrets) || step.secrets.some((name2) => typeof name2 !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(name2)))) {
+      throw new DefinitionError(`steps[${index}].secrets must contain names only.`);
+    }
+    if (Array.isArray(step.secrets) && new Set(step.secrets).size !== step.secrets.length) {
+      throw new DefinitionError(`steps[${index}].secrets must not contain duplicates.`);
+    }
+    if (Array.isArray(step.secrets) && step.secrets.some((name2) => RESERVED_STEP_ENV.has(String(name2)))) {
+      throw new DefinitionError(`steps[${index}].secrets may not replace process-control environment variables.`);
+    }
+    const timeoutMs = step.timeoutMs === undefined ? undefined : Number(step.timeoutMs);
+    if (timeoutMs !== undefined && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 86400000)) {
+      throw new DefinitionError(`steps[${index}].timeoutMs must be an integer from 1 to 86400000.`);
+    }
+    let when;
+    if (step.when !== undefined) {
+      const conditions = record(step.when, `steps[${index}].when`);
+      when = {};
+      for (const [name2, expected] of Object.entries(conditions)) {
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(name2) || typeof expected !== "string" || expected.length === 0) {
+          throw new DefinitionError(`steps[${index}].when must map environment names to non-empty strings.`);
+        }
+        when[name2] = expected;
+      }
+      if (Object.keys(when).length === 0)
+        throw new DefinitionError(`steps[${index}].when must not be empty.`);
+    }
+    return {
+      name: text(step.name, `steps[${index}].name`),
+      exec: argv(step.exec, `steps[${index}].exec`),
+      phase,
+      scope: step.scope,
+      profiles: selectedProfiles,
+      secrets: step.secrets,
+      always: step.always === true,
+      timeoutMs,
+      when
+    };
+  });
+  if (new Set(steps.map((step) => step.name)).size !== steps.length) {
+    throw new DefinitionError("pipeline.steps must have unique names.");
+  }
+  for (const [profile, selected] of Object.entries(profiles)) {
+    if (selected.capacityCalibration && !steps.some((step) => step.phase === "health" && step.scope === "target" && (!step.profiles || step.profiles.includes(profile)))) {
+      throw new DefinitionError(`profiles.${profile}.capacityCalibration requires a target-scoped health step.`);
+    }
+  }
+  const name = text(root.name, "pipeline.name");
+  if (name.length > 120)
+    throw new DefinitionError("pipeline.name must be at most 120 characters.");
+  return {
+    version: PIPELINE_VERSION,
+    name,
+    requireAttestation: root.requireAttestation === true,
+    profiles,
+    steps
+  };
+}
+function phasePipeline(definition, phase, profile, executeRelease = false) {
+  if (!Object.hasOwn(definition.profiles, profile)) {
+    throw new DefinitionError(`pipeline profile does not exist: ${profile}.`);
+  }
+  return {
+    name: `${definition.name}:${phase}`,
+    requireAttestation: definition.requireAttestation,
+    steps: definition.steps.filter((step) => step.phase === phase && (!step.profiles || step.profiles.includes(profile)) && (step.scope === "target" || executeRelease))
+  };
+}
+
+// src/software-helper.ts
+import { chmodSync as chmodSync4, existsSync as existsSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3 } from "node:fs";
+import { connect as connect2, createServer as createServer2 } from "node:net";
+import { dirname as dirname4 } from "node:path";
+
+// src/service-supervisor.ts
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync, realpathSync, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3, join as join4, resolve as resolve3, sep } from "node:path";
+var SERVICE_STATE_DIRECTORY = "/var/lib/forgezero/services";
+var SERVICE_CONFIG_DIRECTORY = "/etc/forgezero/services";
+var SERVICE_UNIT_DIRECTORY = "/etc/systemd/system";
+var SERVICE_NGINX_DIRECTORY = "/etc/nginx/conf.d";
+var idFor = (key) => createHash3("sha256").update(key).digest("hex").slice(0, 24);
+var statePath = (id) => `${SERVICE_STATE_DIRECTORY}/${id}.json`;
+var within = (root, path2) => path2 === root || path2.startsWith(`${root}${sep}`);
+var defaultHost = {
+  write(path2, content, mode) {
+    mkdirSync4(dirname3(path2), { recursive: true, mode: 493 });
+    const next = `${path2}.next`;
+    writeFileSync4(next, content, { mode });
+    renameSync4(next, path2);
+  },
+  read: (path2) => readFileSync4(path2, "utf8"),
+  exists: existsSync3,
+  list: (path2) => existsSync3(path2) ? readdirSync(path2) : [],
+  realpath: realpathSync,
+  mkdir: (path2, mode) => mkdirSync4(path2, { recursive: true, mode }),
+  remove: (path2) => rmSync4(path2, { force: true }),
+  async exec(argv2) {
+    const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: {
+      PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+      LANG: "C",
+      LC_ALL: "C"
+    } });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  async health(port, path2) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path2}`, {
+        signal: AbortSignal.timeout(2000),
+        redirect: "manual"
+      });
+      return response.status >= 200 && response.status < 300;
+    } catch {
+      return false;
+    }
+  },
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
+function readState(host, path2) {
+  if (!host.exists(path2))
+    return null;
+  try {
+    const value = JSON.parse(host.read(path2));
+    return value?.format === 1 && Array.isArray(value.applicationPorts) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function allStates(host) {
+  return host.list(SERVICE_STATE_DIRECTORY).filter((name) => /^[a-f0-9]{24}\.json$/.test(name)).flatMap((name) => {
+    const state = readState(host, join4(SERVICE_STATE_DIRECTORY, name));
+    return state ? [state] : [];
+  });
+}
+function allocatedPorts(request, id, previous, states) {
+  const required = request.service.strategy === "blue-green" ? 2 : 1;
+  const occupied = new Set(states.filter((state) => state.id !== id).flatMap((state) => [state.publicPort, ...state.applicationPorts]));
+  if (occupied.has(request.service.publicPort))
+    throw new Error("SERVICE_PUBLIC_PORT_CONFLICT");
+  const allocation = request.service.applicationPorts;
+  if (allocation.mode === "fixed") {
+    if (allocation.ports.some((port) => occupied.has(port)))
+      throw new Error("SERVICE_APPLICATION_PORT_CONFLICT");
+    return [...allocation.ports];
+  }
+  if (previous && previous.applicationPorts.length === required && previous.applicationPorts.every((port) => port >= allocation.from && port <= allocation.to && !occupied.has(port)))
+    return [...previous.applicationPorts];
+  const width = allocation.to - allocation.from + 1;
+  const start = Number.parseInt(createHash3("sha256").update(request.key).digest("hex").slice(0, 8), 16) % width;
+  for (let offset = 0;offset < width; offset += 1) {
+    const first = allocation.from + (start + offset) % width;
+    const candidate = Array.from({ length: required }, (_, index) => first + index);
+    if (candidate.at(-1) <= allocation.to && candidate.every((port) => !occupied.has(port) && port !== request.service.publicPort)) {
+      return candidate;
+    }
+  }
+  throw new Error("SERVICE_DYNAMIC_PORTS_EXHAUSTED");
+}
+var appConfig = (request, port) => `${JSON.stringify({
+  format: 1,
+  root: request.root,
+  release: request.release,
+  home: `${request.root}/app-home`,
+  argv: request.service.command.map((argument) => argument === "${FZ_APP_PORT}" ? String(port) : argument === "${FZ_RELEASE}" ? request.release : argument),
+  environment: { FZ_APP_PORT: String(port), FZ_RELEASE: request.release }
+}, null, 2)}
+`;
+var unit = (id, slot) => `[Unit]
+Description=ForgeZero supervised tenant application ${id} slot ${slot}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=forgezero-app
+Group=forgezero-vault
+ExecStart=/usr/local/lib/forgezero/agent/fz-agent supervised-app --config=${SERVICE_CONFIG_DIRECTORY}/${id}-slot${slot}.json
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+LimitCORE=0
+
+[Install]
+WantedBy=multi-user.target
+`;
+var nginx = (request, id, port) => `# ForgeZero ${id}
+${request.service.maxConnections ? `limit_conn_zone $server_name zone=fz_${id}:64k;
+` : ""}server {
+  listen 127.0.0.1:${request.service.publicPort};
+  server_name _;
+${request.service.maxConnections ? `  limit_conn fz_${id} ${request.service.maxConnections};
+  limit_conn_status 503;
+` : ""}  location / {
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+${request.service.websocket ? `    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+` : ""}    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+`;
+async function checked2(host, argv2, code) {
+  const result = await host.exec(argv2);
+  if (result.exitCode !== 0)
+    throw new Error(`${code}: ${result.output.slice(0, 512)}`);
+}
+async function activateSupervisedService(request, host = defaultHost) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/.test(request.key) || !/^[a-f0-9]{40}$/.test(request.revision)) {
+    throw new Error("SERVICE_IDENTITY_INVALID");
+  }
+  const root = host.realpath(resolve3(request.root));
+  const release = host.realpath(resolve3(request.release));
+  if (!within(root, release))
+    throw new Error("SERVICE_RELEASE_OUTSIDE_ROOT");
+  request = { ...request, root, release, service: validateDeploymentService(request.service) };
+  const id = idFor(request.key);
+  host.mkdir(SERVICE_STATE_DIRECTORY, 448);
+  host.mkdir(SERVICE_CONFIG_DIRECTORY, 457);
+  const previous = readState(host, statePath(id));
+  const ports = allocatedPorts(request, id, previous, allStates(host));
+  const nextSlot = request.service.strategy === "blue-green" ? previous?.activeSlot === 0 ? 1 : 0 : 0;
+  const port = ports[nextSlot] ?? ports[0];
+  const configPath = `${SERVICE_CONFIG_DIRECTORY}/${id}-slot${nextSlot}.json`;
+  const unitName = `forgezero-app-${id}-slot${nextSlot}.service`;
+  host.write(configPath, appConfig({ ...request, release }, port), 292);
+  host.write(`${SERVICE_UNIT_DIRECTORY}/${unitName}`, unit(id, nextSlot), 420);
+  await checked2(host, ["/usr/bin/systemctl", "daemon-reload"], "SERVICE_UNIT_RELOAD_FAILED");
+  if (request.service.strategy === "direct" && previous) {
+    await host.exec(["/usr/bin/systemctl", "stop", `forgezero-app-${id}-slot${previous.activeSlot}.service`]);
+  }
+  await checked2(host, ["/usr/bin/systemctl", "restart", unitName], "SERVICE_START_FAILED");
+  let healthy = false;
+  for (let attempt = 0;attempt < 30; attempt += 1) {
+    const active = await host.exec(["/usr/bin/systemctl", "is-active", "--quiet", unitName]);
+    if (active.exitCode === 0 && await host.health(port, request.service.healthPath)) {
+      healthy = true;
+      break;
+    }
+    await host.sleep(1000);
+  }
+  if (!healthy) {
+    await host.exec(["/usr/bin/systemctl", "stop", unitName]);
+    throw new Error("SERVICE_HEALTH_FAILED");
+  }
+  const nginxPath = `${SERVICE_NGINX_DIRECTORY}/forgezero-${id}.conf`;
+  const oldNginx = host.exists(nginxPath) ? host.read(nginxPath) : null;
+  try {
+    host.write(nginxPath, nginx(request, id, port), 420);
+    await checked2(host, ["/usr/sbin/nginx", "-t"], "SERVICE_NGINX_INVALID");
+    await checked2(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "SERVICE_NGINX_RELOAD_FAILED");
+  } catch (cause) {
+    if (oldNginx === null)
+      host.remove(nginxPath);
+    else
+      host.write(nginxPath, oldNginx, 420);
+    await host.exec(["/usr/bin/systemctl", "stop", unitName]);
+    throw cause;
+  }
+  const state = {
+    format: 1,
+    id,
+    key: request.key,
+    revision: request.revision,
+    strategy: request.service.strategy,
+    publicPort: request.service.publicPort,
+    applicationPorts: ports,
+    activeSlot: nextSlot,
+    healthPath: request.service.healthPath,
+    updatedAtTs: host.now()
+  };
+  host.write(statePath(id), `${JSON.stringify(state, null, 2)}
+`, 384);
+  if (request.service.strategy === "blue-green" && previous && previous.activeSlot !== nextSlot) {
+    await host.sleep(request.service.drainMs ?? 30000);
+    await host.exec(["/usr/bin/systemctl", "stop", `forgezero-app-${id}-slot${previous.activeSlot}.service`]);
+  }
+  return state;
+}
+
+// src/software-helper.ts
+var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
+var SOFTWARE_HELPER_GROUP = "forgezero-software";
+var SOFTWARE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-software-helper.service";
+var MAX_REQUEST_BYTES2 = 128 * 1024;
+var MAX_PENDING_REQUESTS = 128;
+function startSoftwareHelper(options = {}) {
+  const socketPath = options.socketPath ?? DEFAULT_SOFTWARE_HELPER_SOCKET;
+  if (existsSync4(socketPath))
+    unlinkSync3(socketPath);
+  mkdirSync5(dirname4(socketPath), { recursive: true, mode: 488 });
+  const ensure = options.ensure ?? ensureSoftwareRequirements;
+  const activate = options.activate ?? activateSupervisedService;
+  let tail = Promise.resolve();
+  let pending = 0;
+  const server = createServer2((socket) => {
+    let buffer = "";
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      if (Buffer.byteLength(buffer) > MAX_REQUEST_BYTES2)
+        return socket.destroy();
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      const line = buffer.slice(0, newline);
+      buffer = "";
+      if (pending >= MAX_PENDING_REQUESTS) {
+        socket.end(`${JSON.stringify({
+          ok: false,
+          error: { code: "SOFTWARE_BUSY", message: "software helper queue is full" }
+        })}
+`);
+        return;
+      }
+      pending += 1;
+      const work = tail.then(() => Promise.resolve().then(() => JSON.parse(line)).then(async (request) => {
+        if (request.op === "ensure") {
+          const requirements = validateSoftwareRequirements(request.requirements);
+          const results = await ensure(requirements, { exec: executeSoftwareOperation });
+          socket.end(`${JSON.stringify({ ok: true, results })}
+`);
+          return;
+        }
+        if (request.op === "activate-service" && request.request) {
+          if (!options.allowedRoot || request.request.root !== options.allowedRoot) {
+            throw new Error("service deployment root is not owned by this helper");
+          }
+          const state = await activate(request.request);
+          socket.end(`${JSON.stringify({ ok: true, state })}
+`);
+          return;
+        }
+        throw new Error("unknown software helper operation");
+      }).catch((cause) => socket.end(`${JSON.stringify({
+        ok: false,
+        error: { code: "SOFTWARE_REFUSED", message: cause instanceof Error ? cause.message : String(cause) }
+      })}
+`)).finally(() => {
+        pending -= 1;
+      }));
+      tail = work.then(() => {
+        return;
+      }, () => {
+        return;
+      });
+    });
+    socket.on("error", () => socket.destroy());
+  });
+  server.listen(socketPath, () => chmodSync4(socketPath, 432));
+  return server;
+}
+function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 10 * 60000) {
+  return new Promise((resolve4, reject) => {
+    const socket = connect2(socketPath, () => socket.write(`${JSON.stringify({ op: "activate-service", request })}
+`));
+    let buffer = "";
+    socket.setTimeout(timeoutMs, () => {
+      socket.destroy();
+      reject(new Error("service helper timed out"));
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      socket.end();
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        if (!response.ok || !response.state)
+          throw new Error(response.error?.message ?? "service helper refused activation");
+        resolve4(response.state);
+      } catch (cause) {
+        reject(cause);
+      }
+    });
+    socket.on("error", reject);
+  });
+}
+function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
+  validateSoftwareRequirements(requirements);
+  return new Promise((resolve4, reject) => {
+    const socket = connect2(socketPath, () => socket.write(`${JSON.stringify({ op: "ensure", requirements })}
+`));
+    let buffer = "";
+    socket.setTimeout(timeoutMs, () => {
+      socket.destroy();
+      reject(new Error("software helper did not answer before its deadline"));
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      socket.end();
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        if (!response.ok || !response.results)
+          throw new Error(response.error?.message ?? "software helper refused the request");
+        resolve4(response.results);
+      } catch (cause) {
+        reject(cause);
+      }
+    });
+    socket.on("error", reject);
+  });
+}
+
+// src/version.ts
+var VERSION3 = "0.1.42";
+
+// src/egress-policy.ts
+import { realpathSync as realpathSync2 } from "node:fs";
+var SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
+var BLOCKED_IPV4 = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "168.63.129.16/32",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.88.99.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4"
+];
+var BLOCKED_IPV6 = [
+  "::/128",
+  "::1/128",
+  "::ffff:0:0/96",
+  "64:ff9b::/96",
+  "64:ff9b:1::/48",
+  "100::/64",
+  "fc00::/7",
+  "fec0::/10",
+  "fe80::/10",
+  "ff00::/8",
+  "2001::/32",
+  "2001:2::/48",
+  "2001:10::/28",
+  "2001:20::/28",
+  "2001:db8::/32",
+  "2002::/16",
+  "3fff::/20"
+];
+var normalizeEgressTcpPorts = (ports) => {
+  for (const port of ports) {
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+      throw new Error("Agent egress policy refuses an invalid loopback TCP port.");
+    }
+  }
+  return [...new Set(ports)].sort((left, right) => left - right);
+};
+function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
+  const ports = normalizeEgressTcpPorts(loopbackTcpPorts);
+  return [
+    "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6",
+    `IPAddressAllow=${SYSTEMD_RESOLVED_ADDRESS}/32`,
+    ...ports.length > 0 ? ["IPAddressAllow=127.0.0.1/32", "IPAddressAllow=::1/128"] : [],
+    ...BLOCKED_IPV4.map((network) => `IPAddressDeny=${network}`),
+    ...BLOCKED_IPV6.map((network) => `IPAddressDeny=${network}`)
+  ].join(`
+`);
+}
+
+// src/provision.ts
+import { isIP } from "node:net";
+function atLeast(version, floor) {
+  const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
+  const got = parse(version);
+  const want = parse(floor);
+  if (got.length === 0)
+    return false;
+  for (let index = 0;index < want.length; index += 1) {
+    const a = got[index] ?? 0;
+    const b = want[index] ?? 0;
+    if (a > b)
+      return true;
+    if (a < b)
+      return false;
+  }
+  return true;
+}
+var CAPABILITY_CHECKS = {
+  snpGuest: {
+    command: "fz host check-device /dev/sev-guest",
+    operation: { kind: "path-exists", path: "/dev/sev-guest", nodeType: "file" },
+    satisfied: (stdout) => stdout.trim() === "yes",
+    remedy: "Not a confidential guest. The agent will run in `enrolled` mode, which is still stronger than an API key in the application."
+  },
+  systemd: {
+    command: "fz host check-directory /run/systemd/system",
+    operation: { kind: "path-exists", path: "/run/systemd/system", nodeType: "directory" },
+    satisfied: (stdout) => stdout.trim() === "yes",
+    remedy: "systemd is what supervises the agent. On a non-systemd host, run `fz-agent` under whatever supervises services there."
+  },
+  bun: {
+    command: "fz host check-version bun",
+    operation: { kind: "version", argv: ["/usr/local/bin/bun", "--version"] },
+    satisfied: (stdout) => atLeast(stdout, "1.1.0"),
+    remedy: "Install the pinned Bun release with `fz bootstrap`."
+  },
+  python: {
+    command: "fz host check-version python3",
+    operation: { kind: "version", argv: ["/usr/bin/python3", "--version"] },
+    satisfied: (stdout, exitCode) => exitCode === 0 && /^Python 3\./.test(stdout.trim()),
+    remedy: "Install Python 3. It supplies the standard-library ioctl boundary for SNP reports."
+  }
+};
+var modeFor = (capabilities) => capabilities.snpGuest ? "attested" : "enrolled";
+var reasonFor = (mode) => mode === "attested" ? "SEV-SNP guest device present, so the agent can prove what it is running and the platform can refuse it if the measurement is wrong." : "No SEV-SNP guest device. The agent authenticates with its enrolment token and hybrid Ed25519 + ML-DSA signature — weaker than attestation, stronger than an API key in the application.";
+var DEPLOYMENT_RUNNER_USER = "forgezero-runner";
+var APPLICATION_RUNTIME_USER = "forgezero-app";
+var DEPLOYMENT_GROUP = "forgezero-deploy";
+var VAULT_GROUP = "forgezero-vault";
+var LIFECYCLE_GROUP = "forgezero-lifecycle";
+var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
+var AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
+var AGENT_SOCKET_PROXY_UNIT_PATH = "/etc/systemd/system/forgezero-agent-proxy.service";
+var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
+var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
+var LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
+var LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
+var WARP_CONFIG_UNIT_PATH = "/etc/systemd/system/forgezero-warp-config.service";
+var WARP_SERVICE_DROP_IN_PATH = "/etc/systemd/system/warp-svc.service.d/forgezero.conf";
+var AGENT_EGRESS_UNIT_PATH = "/etc/systemd/system/forgezero-agent-egress.service";
+var DEFAULT_RUNNER_PUBLIC_TCP_PORTS = [443];
+function agentEgressUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  const user = options.user ?? "forgezero";
+  if (!/^[a-z_][a-z0-9_-]{0,30}$/.test(user))
+    throw new Error("invalid Agent service user");
+  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
+  if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
+    throw new Error("deployed project runner needs at least one vetted public TCP port");
+  }
+  if (deploymentEnabled)
+    systemdAgentEgressDirectives(runnerLoopbackPorts);
+  const users = [user, ...deploymentEnabled ? [DEPLOYMENT_RUNNER_USER] : []];
+  const runnerGrant = deploymentEnabled ? ` --loopback-user=${DEPLOYMENT_RUNNER_USER}` + runnerLoopbackPorts.map((port) => ` --loopback-tcp-port=${port}`).join("") + runnerPublicTcpPorts.map((port) => ` --public-tcp-port=${port}`).join("") : "";
+  const policyProof = `ExecStartPost=${bin} egress-policy-check ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}`;
+  return `[Unit]
+Description=ForgeZero Agent host egress policy
+Documentation=https://www.forgezero.net/docs/agent
+After=systemd-resolved.service nftables.service
+Requires=systemd-resolved.service
+Before=forgezero-agent-enrol.service forgezero-agent.service
+
+[Service]
+Type=notify
+NotifyAccess=all
+User=root
+Group=root
+ExecStart=${bin} egress-policy ${users.map((name) => `--user=${name}`).join(" ")}${runnerGrant}
+${policyProof}
+Restart=on-failure
+RestartSec=2
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+CapabilityBoundingSet=CAP_NET_ADMIN
+RestrictAddressFamilies=AF_UNIX AF_NETLINK
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function softwareHelperUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  const root = options.deployRoot ?? "/opt/forgezero";
+  return `[Unit]
+Description=ForgeZero declarative software strategy helper
+Documentation=https://www.forgezero.net/docs/agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=${SOFTWARE_HELPER_GROUP}
+Environment=FZ_SOFTWARE_HELPER_SOCKET=${DEFAULT_SOFTWARE_HELPER_SOCKET}
+Environment=FZ_DEPLOY_ROOT=${root}
+ExecStart=${bin} software-helper
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-software
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+PrivateTmp=true
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentUpdateHelperUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  return `[Unit]
+Description=ForgeZero verified Agent update helper
+Documentation=https://www.forgezero.net/docs/agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=${AGENT_UPDATE_GROUP}
+Environment=FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}
+ExecStart=${bin} update-helper
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-update
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+LockPersonality=true
+ReadWritePaths=${DEFAULT_AGENT_RELEASE_ROOT} /var/lib/forgezero
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentSocketUnit(options) {
+  const socket = systemdPath(options.socketPath, "agent socket");
+  return `[Unit]
+Description=ForgeZero application Vault socket
+Documentation=https://www.forgezero.net/docs/agent
+
+[Socket]
+ListenStream=${socket}
+SocketUser=root
+SocketGroup=${VAULT_GROUP}
+SocketMode=0660
+DirectoryMode=0750
+RemoveOnStop=true
+Service=forgezero-agent-proxy.service
+
+[Install]
+WantedBy=sockets.target
+`;
+}
+function agentSocketProxyUnit(options) {
+  const backend = agentBackendSocketPath(options.socketPath);
+  const user = options.user ?? "forgezero";
+  return `[Unit]
+Description=ForgeZero application Vault socket proxy
+Documentation=https://www.forgezero.net/docs/agent
+Requires=forgezero-agent.service
+After=forgezero-agent.service
+
+[Service]
+User=${user}
+Group=${VAULT_GROUP}
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd ${backend}
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX
+`;
+}
+function agentBackendSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
+var systemdPath = (value, label) => {
+  if (!value || !/^\/[A-Za-z0-9._@/-]+$/.test(value))
+    throw new Error(`invalid ${label} path`);
+  return value;
+};
+var validNodeHostname = (value) => !value || value.length <= 253 && value === value.toLowerCase() && value.split(".").length >= 3 && value.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label));
+function warpConfigUnit(options) {
+  if (!options.warpOrganization || !/^[a-z0-9][a-z0-9-]{0,62}$/i.test(options.warpOrganization)) {
+    throw new Error("WARP organization is invalid");
+  }
+  if (!options.warpClientIdCredentialPath || !options.warpClientSecretCredentialPath) {
+    throw new Error("WARP service-token credential paths are required");
+  }
+  const clientIdPath = systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential");
+  const clientSecretPath = systemdPath(options.warpClientSecretCredentialPath, "WARP client-secret credential");
+  const bin = options.binPath ?? "fz-agent";
+  return `[Unit]
+Description=Materialize Cloudflare One enrollment in tmpfs
+Documentation=https://www.forgezero.net/docs/agent
+Before=warp-svc.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+LoadCredentialEncrypted=warp-auth-client-id:${clientIdPath}
+LoadCredentialEncrypted=warp-auth-client-secret:${clientSecretPath}
+Environment=FZ_WARP_CLIENT_ID_CREDENTIAL=warp-auth-client-id
+Environment=FZ_WARP_CLIENT_SECRET_CREDENTIAL=warp-auth-client-secret
+ExecStart=${bin} warp-config --organization=${options.warpOrganization}
+RuntimeDirectory=forgezero-warp
+RuntimeDirectoryMode=0700
+RuntimeDirectoryPreserve=yes
+UMask=0077
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/cloudflare-warp
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function warpServiceDropIn() {
+  return `[Unit]
+Requires=forgezero-warp-config.service
+After=forgezero-warp-config.service
+`;
+}
+function lifecycleHelperUnit(options) {
+  if (!options.lifecycleProfilePath)
+    throw new Error("lifecycle helper needs a root-owned profile");
+  const bin = options.binPath ?? "fz-agent";
+  const profile = systemdPath(options.lifecycleProfilePath, "lifecycle profile");
+  const socket = systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket");
+  return `[Unit]
+Description=ForgeZero fixed-operation compute lifecycle helper
+Documentation=https://www.forgezero.net/docs/agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=${LIFECYCLE_GROUP}
+Environment=FZ_LIFECYCLE_HELPER_SOCKET=${socket}
+ExecStart=${bin} lifecycle-helper --profile=${profile}
+Restart=always
+RestartSec=2
+RuntimeDirectory=forgezero-lifecycle
+RuntimeDirectoryMode=0750
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentEnrolmentUnit(options) {
+  if (!options.apiUrl || !options.enrolTokenCredentialPath || !options.enrolStatePath) {
+    throw new Error("direct enrolment needs API, credential and state paths");
+  }
+  if (!validNodeHostname(options.nodeHostname))
+    throw new Error("node hostname is invalid");
+  const bin = options.binPath ?? "fz-agent";
+  const user = options.user ?? "forgezero";
+  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
+  const label = options.nodeLabel ? `Environment=FZ_NODE_LABEL=${options.nodeLabel}
+` : "";
+  const hostname = options.nodeHostname ? `Environment=FZ_NODE_HOSTNAME=${options.nodeHostname}
+` : "";
+  const gitPublicKey = options.gitPublicKeyPath ? `Environment=FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}
+` : "";
+  const bootstrapSshPublicKey = options.bootstrapSshPublicKeyPath ? `Environment=FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE=${options.bootstrapSshPublicKeyPath}
+` : "";
+  const networkAttachment = [
+    options.cloudflareAccountId ? `Environment=FZ_CF_ACCOUNT_ID=${options.cloudflareAccountId}
+` : "",
+    options.cloudflareTunnelId ? `Environment=FZ_CF_TUNNEL_ID=${options.cloudflareTunnelId}
+` : "",
+    options.cloudflareVirtualNetworkId ? `Environment=FZ_CF_VIRTUAL_NETWORK_ID=${options.cloudflareVirtualNetworkId}
+` : "",
+    options.cloudflareWarpPolicyId ? `Environment=FZ_CF_WARP_POLICY_ID=${options.cloudflareWarpPolicyId}
+` : ""
+  ].join("");
+  const stateDir = options.enrolStatePath.replace(/\/[^/]+$/, "");
+  const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
+Requires=forgezero-agent-egress.service
+BindsTo=forgezero-agent-egress.service
+` : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  return `[Unit]
+Description=Bind this machine to its ForgeZero compute
+After=network-online.target
+Wants=network-online.target
+${egressDependency}Before=forgezero-agent.service
+ConditionPathExists=!${options.enrolStatePath}
+
+[Service]
+Type=oneshot
+User=${user}
+Group=${user}
+LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
+LoadCredentialEncrypted=enrol-token:${options.enrolTokenCredentialPath}
+Environment=FZ_SEED_CREDENTIAL=agent-seed
+Environment=FZ_ENROL_TOKEN_CREDENTIAL=enrol-token
+Environment=FZ_ENROL_STATE_FILE=${options.enrolStatePath}
+Environment=FZ_API=${options.apiUrl}
+${label}${hostname}${gitPublicKey}${bootstrapSshPublicKey}${networkAttachment}ExecStart=${bin} enrol
+# A '+' fixed command runs as root solely to remove the host-bound one-time
+# ciphertext. Tenant code and the agent never receive a privilege boundary.
+ExecStartPost=+/usr/bin/rm -f ${options.enrolTokenCredentialPath}
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=${stateDir}
+LimitCORE=0
+${egressDirectives}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function deploymentRunnerUnit(options) {
+  const bin = options.binPath ?? "fz-agent";
+  const root = options.deployRoot ?? "/opt/forgezero";
+  const agentUser = options.user ?? "forgezero-agent";
+  const egressDependency = options.enforceEgress ? `After=forgezero-agent-egress.service
+Requires=forgezero-agent-egress.service
+BindsTo=forgezero-agent-egress.service
+` : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives(options.runnerLoopbackPorts ?? []) : "";
+  return `[Unit]
+Description=ForgeZero credential-free project command runner
+Documentation=https://www.forgezero.net/docs/agent
+${egressDependency}
+
+[Service]
+Type=notify
+NotifyAccess=all
+User=${DEPLOYMENT_RUNNER_USER}
+Group=${DEPLOYMENT_GROUP}
+Environment=FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}
+RuntimeDirectory=forgezero-deploy
+RuntimeDirectoryMode=0710
+ExecStartPre=+/usr/bin/install -d -o ${DEPLOYMENT_RUNNER_USER} -g ${DEPLOYMENT_GROUP} -m 0710 /run/forgezero-deploy
+ExecStartPre=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStart=${bin} deploy-runner --root=${root} --home=${root}/runner-home
+ExecStartPost=+/usr/bin/chown ${agentUser}:${agentUser} ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chmod 0600 ${DEPLOYMENT_RUNNER_SOCKET}
+ExecStartPost=+/usr/bin/chown root:${VAULT_GROUP} /run/forgezero-deploy
+ExecStopPost=+/usr/bin/rm -f ${DEPLOYMENT_RUNNER_SOCKET}
+Restart=always
+RestartSec=2
+UMask=0007
+LimitCORE=0
+NoNewPrivileges=false
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+${egressDirectives}
+ReadWritePaths=${root}/releases ${root}/runner-home
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function agentUnit(options) {
+  if (!validNodeHostname(options.nodeHostname))
+    throw new Error("node hostname is invalid");
+  if (!options.telemetryEndpoint) {
+    throw new Error("compute Agent provisioning requires OTEL_EXPORTER_OTLP_ENDPOINT as an explicit public HTTPS collector coordinate");
+  }
+  let telemetryEndpoint;
+  {
+    let endpoint;
+    try {
+      endpoint = new URL(options.telemetryEndpoint);
+    } catch {
+      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL");
+    }
+    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || isIP(endpoint.hostname) !== 0 || !endpoint.hostname.includes(".") || endpoint.hostname === "localhost" || endpoint.hostname.endsWith(".local"))
+      throw new Error("compute telemetry endpoint must be an absolute public HTTPS URL without credentials, query or fragment");
+    telemetryEndpoint = endpoint.toString().replace(/\/$/, "");
+  }
+  const bin = options.binPath ?? "fz-agent";
+  const user = options.user ?? "forgezero";
+  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
+  const controlSocketPath = options.controlSocketPath ?? "/run/forgezero/control.sock";
+  const deployRoot = options.deployRoot ?? "/opt/forgezero";
+  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
+  if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
+    throw new Error("migration pull and lifecycle profile must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([
+    options.pullBootstrap,
+    options.bootstrapSshCredentialPath,
+    options.bootstrapSshPublicKeyPath,
+    options.bootstrapTargetTelemetryEndpoint
+  ].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  }
+  const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
+  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const warpValues = [
+    options.warpOrganization,
+    options.warpClientIdCredentialPath,
+    options.warpClientSecretCredentialPath
+  ];
+  const warpEnabled = warpValues.every(Boolean);
+  if (warpValues.some(Boolean) && !warpEnabled)
+    throw new Error("WARP configuration must be supplied together");
+  const networkAttachmentValues = [
+    options.cloudflareAccountId,
+    options.cloudflareTunnelId,
+    options.cloudflareVirtualNetworkId,
+    options.cloudflareWarpPolicyId
+  ];
+  if (networkAttachmentValues.some(Boolean)) {
+    if (!options.cloudflareAccountId || !options.cloudflareTunnelId || !options.cloudflareWarpPolicyId) {
+      throw new Error("private-network attachment requires account, Tunnel and WARP policy ids");
+    }
+    const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    if (!/^[a-f0-9]{32}$/i.test(options.cloudflareAccountId) || !uuid.test(options.cloudflareTunnelId) || options.cloudflareVirtualNetworkId && !uuid.test(options.cloudflareVirtualNetworkId) || !/^[A-Za-z0-9-]{1,64}$/.test(options.cloudflareWarpPolicyId)) {
+      throw new Error("private-network attachment coordinates are invalid");
+    }
+  }
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  const deploymentEnvironment = options.deploymentEnvironment ?? {};
+  const deploymentCredentials = options.deploymentCredentials ?? {};
+  for (const [name, value] of Object.entries(deploymentEnvironment)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !/^[A-Za-z0-9._:\/@+-]+$/.test(value)) {
+      throw new Error(`invalid deployment environment entry: ${name}`);
+    }
+  }
+  for (const [name, path2] of Object.entries(deploymentCredentials)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/.test(name) || !path2.startsWith("/") || /[\r\n:]/.test(path2)) {
+      throw new Error(`invalid deployment credential entry: ${name}`);
+    }
+  }
+  const environment = [
+    "NODE_ENV=production",
+    `FZ_SOCKET_PATH=${agentBackendSocketPath(options.socketPath)}`,
+    `FZ_CONTROL_SOCKET=${controlSocketPath}`,
+    `FZ_SEED_CREDENTIAL=agent-seed`,
+    `FZ_AGENT_MODE=${options.mode}`,
+    options.apiUrl ? `FZ_API=${options.apiUrl}` : null,
+    options.project ? `FZ_PROJECT=${options.project}` : null,
+    options.environment ? `FZ_ENVIRONMENT=${options.environment}` : null,
+    options.enrolStatePath ? `FZ_ENROL_STATE_FILE=${options.enrolStatePath}` : null,
+    options.nodeLabel ? `FZ_NODE_LABEL=${options.nodeLabel}` : null,
+    options.nodeHostname ? `FZ_NODE_HOSTNAME=${options.nodeHostname}` : null,
+    `OTEL_EXPORTER_OTLP_ENDPOINT=${telemetryEndpoint}`,
+    "OTEL_SERVICE_NAME=forgezero-agent",
+    options.gitPublicKeyPath ? `FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}` : null,
+    options.repository ? `FZ_DEPLOY_REPO=${options.repository}` : null,
+    options.branch ? `FZ_DEPLOY_BRANCH=${options.branch}` : null,
+    options.profile ? `FZ_DEPLOY_PROFILE=${options.profile}` : null,
+    options.repository && options.branch ? `FZ_DEPLOY_KEY=${options.project ?? "platform"}:${options.environment ?? "production"}` : null,
+    deploymentEnabled ? `FZ_DEPLOY_ROOT=${deployRoot}` : null,
+    deploymentEnabled ? `FZ_CAPACITY_EVIDENCE_DIR=${deployRoot}/capacity` : null,
+    deploymentEnabled ? `FZ_DEPLOY_RUNNER_SOCKET=${DEPLOYMENT_RUNNER_SOCKET}` : null,
+    deploymentEnabled ? `FZ_SOFTWARE_HELPER_SOCKET=${DEFAULT_SOFTWARE_HELPER_SOCKET}` : null,
+    Object.keys(deploymentCredentials).length > 0 ? `FZ_DEPLOY_SYSTEMD_SECRETS=${Object.keys(deploymentCredentials).join(",")}` : null,
+    Object.keys(deploymentEnvironment).length > 0 ? `FZ_DEPLOY_ENV_NAMES=${Object.keys(deploymentEnvironment).join(",")}` : null,
+    ...Object.entries(deploymentEnvironment).map(([name, value]) => `${name}=${value}`),
+    options.publicApiUrl ? `FZ_PUBLIC_API_URL=${options.publicApiUrl}` : null,
+    options.pullDeployments ? "FZ_DEPLOY_PULL=true" : null,
+    options.pullMigrations ? "FZ_MIGRATION_PULL=true" : null,
+    options.pullBootstrap ? "FZ_BOOTSTRAP_PULL=true" : null,
+    options.pullBootstrap ? "FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL=bootstrap-ssh-key" : null,
+    options.pullBootstrap && options.bootstrapSshPublicKeyPath ? `FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE=${options.bootstrapSshPublicKeyPath}` : null,
+    options.pullBootstrap ? `FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT=${options.bootstrapTargetTelemetryEndpoint}` : null,
+    `FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}`,
+    options.pullMigrations ? `FZ_LIFECYCLE_HELPER_SOCKET=${lifecycleHelperSocketPath}` : null
+  ].filter((line) => line !== null);
+  if (deploymentEnabled) {
+    environment.push(`HOME=${deployRoot}/agent-home`, `XDG_CACHE_HOME=${deployRoot}/cache`);
+  }
+  const gitCredential = options.gitCredentialPath ? `LoadCredentialEncrypted=git-deploy-key:${options.gitCredentialPath}
+` : "";
+  const bootstrapCredential = bootstrapEnabled ? `LoadCredentialEncrypted=bootstrap-ssh-key:${bootstrapSshCredentialPath}
+` : "";
+  const projectCredentials = Object.entries(deploymentCredentials).map(([name, path2]) => `LoadCredentialEncrypted=${name}:${path2}`).join(`
+`);
+  const deploymentWrites = deploymentEnabled ? `ReadWritePaths=${deployRoot}/releases ${deployRoot}/agent-home ${deployRoot}/cache ${deployRoot}/capacity` : "";
+  const supplementaryGroups = [
+    AGENT_UPDATE_GROUP,
+    deploymentEnabled ? DEPLOYMENT_GROUP : null,
+    deploymentEnabled ? SOFTWARE_HELPER_GROUP : null,
+    lifecycleEnabled ? LIFECYCLE_GROUP : null
+  ].filter((value) => value !== null);
+  const deploymentGroup = supplementaryGroups.length > 0 ? `SupplementaryGroups=${supplementaryGroups.join(" ")}` : "";
+  const after = [
+    "network-online.target",
+    "forgezero-agent-update-helper.service",
+    options.enforceEgress ? "forgezero-agent-egress.service" : null,
+    deploymentEnabled ? "forgezero-deploy-runner.service" : null,
+    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
+    warpEnabled ? "warp-svc.service" : null,
+    enrolmentEnabled ? "forgezero-agent-enrol.service" : null
+  ].filter((value) => value !== null);
+  const requires = [
+    "forgezero-agent-update-helper.service",
+    options.enforceEgress ? "forgezero-agent-egress.service" : null,
+    deploymentEnabled ? "forgezero-deploy-runner.service" : null,
+    deploymentEnabled ? "forgezero-software-helper.service" : null,
+    lifecycleEnabled ? "forgezero-lifecycle-helper.service" : null,
+    warpEnabled ? "warp-svc.service" : null,
+    enrolmentEnabled ? "forgezero-agent-enrol.service" : null
+  ].filter((value) => value !== null);
+  const deploymentDependency = [
+    `After=${after.join(" ")}`,
+    "Wants=network-online.target",
+    requires.length > 0 ? `Requires=${requires.join(" ")}` : null,
+    options.enforceEgress ? "BindsTo=forgezero-agent-egress.service" : null
+  ].filter((value) => value !== null).join(`
+`);
+  const snpDevice = options.mode === "attested" ? `DevicePolicy=closed
+DeviceAllow=/dev/sev-guest rw` : "";
+  const snpPrepare = options.mode === "attested" ? `ExecStartPre=+/bin/chgrp ${VAULT_GROUP} /dev/sev-guest
+ExecStartPre=+/bin/chmod 0640 /dev/sev-guest
+` : "";
+  const egressDirectives = options.enforceEgress ? systemdAgentEgressDirectives() : "";
+  return `[Unit]
+Description=ForgeZero node agent (${options.mode})
+Documentation=https://www.forgezero.net/docs/agent
+${deploymentDependency}
+
+[Service]
+Type=simple
+User=${user}
+Group=${VAULT_GROUP}
+${deploymentGroup}
+LoadCredentialEncrypted=agent-seed:${seedCredentialPath}
+${gitCredential}${bootstrapCredential}${projectCredentials}${projectCredentials ? `
+` : ""}${snpPrepare}ExecStart=${bin}
+Restart=always
+RestartSec=2
+
+${environment.map((line) => `Environment=${line}`).join(`
+`)}
+
+# The node seed and the vault replica live in this process's memory. A core dump
+# writes both to disk, which is the one artefact this design exists to remove.
+LimitCORE=0
+
+# The socket is the entire interface: anything that can read it can read the
+# scope. So it lives in a directory systemd creates with a known owner rather
+# than wherever the process happened to have write access.
+RuntimeDirectory=forgezero
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+UMask=0007
+
+# Tenant-controlled commands execute in forgezero-deploy-runner.service. This
+# credential-bearing process never needs to cross a privilege boundary.
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+RestrictRealtime=true
+MemoryDenyWriteExecute=true
+LockPersonality=true
+${egressDirectives}
+${snpDevice}
+${deploymentWrites}
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+var renderOperation = (operation) => {
+  if (operation.kind === "commands")
+    return operation.commands.map(({ argv: argv2 }) => argv2.join(" ")).join(`
+`);
+  if (operation.kind === "directories")
+    return operation.directories.map((directory) => [
+      "/usr/bin/install",
+      "-d",
+      ...directory.owner ? ["-o", directory.owner] : [],
+      ...directory.group ? ["-g", directory.group] : [],
+      "-m",
+      directory.mode.toString(8).padStart(4, "0"),
+      directory.path
+    ].join(" ")).join(`
+`);
+  if (operation.kind === "install-runtime")
+    return `/usr/bin/install -m 0755 ${operation.source} /opt/forgezero/agent/versions/${operation.version}/dist/fz-agent.js`;
+  if (operation.kind === "ensure-seed")
+    return `/usr/bin/systemd-creds encrypt --name=agent-seed - ${operation.credential}`;
+  if (operation.kind === "ensure-git-identity")
+    return `/usr/bin/ssh-keygen -t ed25519
+/usr/bin/systemd-creds encrypt --name=git-deploy-key <private> ${operation.credential}
+fz host write-public-key ${operation.publicKey}`;
+  if (operation.kind === "ensure-bootstrap-ssh-identity")
+    return `/usr/bin/ssh-keygen -t ed25519
+/usr/bin/systemd-creds encrypt --name=bootstrap-ssh-key <private> ${operation.credential}
+fz host write-public-key ${operation.publicKey}`;
+  if (operation.kind === "ensure-enrolment")
+    return `/usr/bin/systemd-creds encrypt --name=enrol-token ${operation.source} ${operation.credential}
+/usr/bin/rm -f ${operation.source}`;
+  if (operation.kind === "wait-socket")
+    return `fz host wait-socket ${operation.path}`;
+  if (operation.kind === "verify-file")
+    return `fz host verify-file ${operation.path}`;
+  if (operation.kind === "verify-egress")
+    return `/usr/sbin/nft --numeric list table inet forgezero_agent_egress
+fz-agent egress-policy-check`;
+  if (operation.kind === "verify-resolved-stub")
+    return "fz host verify-resolved-stub /run/systemd/resolve/stub-resolv.conf";
+  if (operation.kind === "install-warp")
+    return "/usr/bin/apt-get install -y cloudflare-warp";
+  return "/usr/bin/warp-cli --accept-tos status";
+};
+var step = (label, operation, optional = false) => ({
+  label,
+  operation,
+  optional: optional || undefined,
+  command: renderOperation(operation)
+});
+var UNIT_PATH = "/etc/systemd/system/forgezero-agent.service";
+function planProvision(options) {
+  const mode = options.mode;
+  const user = options.user ?? "forgezero";
+  const seedCredentialPath = options.seedCredentialPath ?? "/etc/forgezero/creds/agent-seed.cred";
+  const credentialDir = seedCredentialPath.replace(/\/[^/]+$/, "");
+  const deployRoot = options.deployRoot ?? "/opt/forgezero";
+  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
+  const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
+  const lifecycleEnabled = Boolean(options.pullMigrations && options.lifecycleProfilePath);
+  if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
+    throw new Error("migration pull and lifecycle profile must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
+  if ([
+    options.pullBootstrap,
+    options.bootstrapSshCredentialPath,
+    options.bootstrapSshPublicKeyPath,
+    options.bootstrapSshSourcePath,
+    options.bootstrapTargetTelemetryEndpoint
+  ].some(Boolean) && !bootstrapEnabled) {
+    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  }
+  const warpValues = [
+    options.warpOrganization,
+    options.warpClientIdCredentialPath,
+    options.warpClientSecretCredentialPath
+  ];
+  const warpEnabled = warpValues.every(Boolean);
+  if (warpValues.some(Boolean) && !warpEnabled)
+    throw new Error("WARP configuration must be supplied together");
+  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
+    throw new Error("direct enrolment paths must be supplied together");
+  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
+  const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
+  const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
+  const sourceBinPath = options.sourceBinPath ? systemdPath(options.sourceBinPath, "agent source binary") : undefined;
+  const binPath = options.binPath ? systemdPath(options.binPath, "agent binary") : undefined;
+  const gitCredentialPath = options.gitCredentialPath ? systemdPath(options.gitCredentialPath, "Git credential") : undefined;
+  const gitPublicKeyPath = options.gitPublicKeyPath ? systemdPath(options.gitPublicKeyPath, "Git public key") : undefined;
+  if (options.generateGitIdentity && (!gitCredentialPath || !gitPublicKeyPath)) {
+    throw new Error("generated Git identity needs credential and public-key paths");
+  }
+  const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
+  const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
+  const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
+  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshPublicKeyPath = bootstrapEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
+  const bootstrapSshSourcePath = options.bootstrapSshSourcePath ? systemdPath(options.bootstrapSshSourcePath, "bootstrap SSH private-key source") : undefined;
+  const bootstrapSshPublicKeyDir = bootstrapSshPublicKeyPath?.replace(/\/[^/]+$/, "");
+  const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
+  const warpClientSecretCredentialPath = warpEnabled ? systemdPath(options.warpClientSecretCredentialPath, "WARP client-secret credential") : undefined;
+  const enabledUnits = [
+    "forgezero-agent.socket",
+    "forgezero-agent-update-helper.service",
+    ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
+    ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
+    ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : [],
+    "forgezero-agent.service"
+  ];
+  const restartedUnits = [
+    "forgezero-agent-update-helper.service",
+    ...options.enforceEgress ? ["forgezero-agent-egress.service"] : [],
+    ...deploymentEnabled ? ["forgezero-deploy-runner.service", "forgezero-software-helper.service"] : [],
+    ...lifecycleEnabled ? ["forgezero-lifecycle-helper.service"] : [],
+    ...warpEnabled ? ["forgezero-warp-config.service", "warp-svc.service"] : [],
+    ...enrolmentEnabled ? ["forgezero-agent-enrol.service"] : []
+  ];
+  return {
+    mode,
+    reason: reasonFor(mode),
+    unitPath: UNIT_PATH,
+    unit: agentUnit({
+      ...options,
+      mode,
+      lifecycleProfilePath,
+      lifecycleHelperSocketPath,
+      bootstrapSshCredentialPath
+    }),
+    auxiliaryUnits: [
+      { path: AGENT_SOCKET_UNIT_PATH, unit: agentSocketUnit(options) },
+      { path: AGENT_SOCKET_PROXY_UNIT_PATH, unit: agentSocketProxyUnit(options) },
+      { path: AGENT_UPDATE_HELPER_UNIT_PATH, unit: agentUpdateHelperUnit(options) },
+      ...options.enforceEgress ? [
+        { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
+      ] : [],
+      ...deploymentEnabled ? [
+        { path: DEPLOYMENT_RUNNER_UNIT_PATH, unit: deploymentRunnerUnit(options) },
+        { path: SOFTWARE_HELPER_UNIT_PATH, unit: softwareHelperUnit(options) }
+      ] : [],
+      ...enrolmentEnabled ? [
+        { path: ENROLMENT_UNIT_PATH, unit: agentEnrolmentUnit(options) }
+      ] : [],
+      ...lifecycleEnabled ? [
+        { path: LIFECYCLE_HELPER_UNIT_PATH, unit: lifecycleHelperUnit({
+          ...options,
+          lifecycleProfilePath,
+          lifecycleHelperSocketPath
+        }) }
+      ] : [],
+      ...warpEnabled ? [
+        { path: WARP_CONFIG_UNIT_PATH, unit: warpConfigUnit({
+          ...options,
+          warpClientIdCredentialPath,
+          warpClientSecretCredentialPath
+        }) },
+        { path: WARP_SERVICE_DROP_IN_PATH, unit: warpServiceDropIn() }
+      ] : []
+    ],
+    socketPath: options.socketPath,
+    user,
+    steps: [
+      ...options.enforceEgress ? [step("Ubuntu Agent egress prerequisites", { kind: "commands", commands: [
+        { argv: ["/usr/bin/apt-get", "update", "-qq"] },
+        { argv: ["/usr/bin/apt-get", "install", "-y", "nftables"] },
+        { argv: ["/usr/bin/systemctl", "enable", "--now", "systemd-resolved.service"] }
+      ] }), step("prove systemd-resolved stub ownership", { kind: "verify-resolved-stub" })] : [],
+      step("vault socket access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", VAULT_GROUP], acceptedExitCodes: [0, 9] }] }),
+      step("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
+      ...sourceBinPath && binPath ? [step("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION3 })] : [],
+      ...warpEnabled ? [step("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
+      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
+        { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
+      ] })] : [],
+      ...lifecycleEnabled ? [step("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
+      step("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
+      step("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
+      step("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      ...lifecycleEnabled ? [step("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
+      ...deploymentEnabled ? [step("credential-free deployment account", { kind: "commands", commands: [
+        { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
+        { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
+        { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
+        { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
+      ] })] : [],
+      step("credential and state directories", { kind: "directories", directories: [
+        { path: credentialDir, mode: 448, owner: "root", group: "root" },
+        { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
+      ] }),
+      step("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
+      ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
+        step("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
+        step("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
+      ] : [],
+      ...bootstrapEnabled ? [
+        step("bootstrap SSH public identity directory", { kind: "directories", directories: [
+          { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
+        ] }),
+        step("unique encrypted bootstrap SSH identity", {
+          kind: "ensure-bootstrap-ssh-identity",
+          credential: bootstrapSshCredentialPath,
+          publicKey: bootstrapSshPublicKeyPath,
+          ...bootstrapSshSourcePath ? { source: bootstrapSshSourcePath } : {}
+        })
+      ] : [],
+      ...enrolmentEnabled ? [
+        step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
+        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+      ] : [],
+      ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
+        { path: deployRoot, mode: 493, owner: "root", group: "root" },
+        { path: `${deployRoot}/releases`, mode: 2040, owner: "root", group: DEPLOYMENT_GROUP },
+        { path: `${deployRoot}/cache`, mode: 488, owner: user, group: user },
+        { path: `${deployRoot}/capacity`, mode: 448, owner: user, group: user },
+        { path: `${deployRoot}/agent-home`, mode: 448, owner: user, group: user },
+        { path: `${deployRoot}/runner-home`, mode: 448, owner: DEPLOYMENT_RUNNER_USER, group: DEPLOYMENT_GROUP },
+        { path: `${deployRoot}/runner-home/cache`, mode: 448, owner: DEPLOYMENT_RUNNER_USER, group: DEPLOYMENT_GROUP },
+        { path: `${deployRoot}/app-home`, mode: 448, owner: APPLICATION_RUNTIME_USER, group: VAULT_GROUP }
+      ] })] : [],
+      step("reload units", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "daemon-reload"] }] }),
+      ...deploymentEnabled ? [step("remove unsupported deployment socket activation", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-deploy-runner.socket"], acceptedExitCodes: [0, 1, 5] },
+        { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
+        { argv: ["/usr/bin/systemctl", "daemon-reload"] }
+      ] })] : [],
+      step("enable and converge services", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
+        { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
+        ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
+        { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.socket"] },
+        { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
+        { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
+      ] }),
+      ...enrolmentEnabled ? [step("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
+      ...options.enforceEgress ? [step("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      step("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
+      step("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
+      step("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
+      step("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      ...deploymentEnabled ? [
+        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
+        step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+      ] : [],
+      ...lifecycleEnabled ? [step("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
+      ...warpEnabled ? [step("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
+      ...options.repository ? [step("prove the deployment control socket exists", { kind: "wait-socket", path: options.controlSocketPath ?? "/run/forgezero/control.sock", attempts: 100, intervalMs: 100 })] : []
+    ]
+  };
+}
+
+// src/platform-bootstrap-runtime.ts
+import {
+  chmodSync as chmodSync5,
+  chownSync,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync5,
+  lstatSync,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync2,
+  realpathSync as realpathSync3,
+  renameSync as renameSync5,
+  rmSync as rmSync5,
+  statSync,
+  symlinkSync as symlinkSync3,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { join as join5 } from "node:path";
+var safeAtom = (name, value) => {
+  if (!value || /[\0\r\n]/.test(value))
+    throw new Error(`${name} must be non-empty and single-line.`);
+  return value;
+};
+var boundedInteger = (name, value, minimum, maximum) => {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new Error(`${name} must be an integer from ${minimum} through ${maximum}.`);
+  }
+  return value;
+};
+var privateCoordinator = (raw) => {
+  const url = new URL(raw);
+  if (url.protocol !== "http:" || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error("ArangoDB coordinator URLs must be credential-free private HTTP origins.");
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  const privateHost = host === "localhost" || host === "::1" || host.startsWith("fd") || host.startsWith("fc") || /^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+  if (!privateHost || url.port && url.port !== "8529") {
+    throw new Error("ArangoDB coordinators must use private addresses and port 8529.");
+  }
+  return url.origin;
+};
+var httpsOrigin = (name, raw) => {
+  const value = new URL(raw);
+  if (value.protocol !== "https:" || value.username || value.password || value.search || value.hash || value.pathname !== "/") {
+    throw new Error(`${name} must be a credential-free HTTPS origin.`);
+  }
+  return value.origin;
+};
+var systemdValue = (name, raw) => {
+  if (/[\0\r\n]/.test(raw))
+    throw new Error(`${name} must be single-line.`);
+  const value = raw;
+  return `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("$", "\\$")}"`;
+};
+function validatePlatformSharedEnvironment(input) {
+  if (input.softwareProfile === "platform-api" !== (input.databaseRole === "none")) {
+    throw new Error("platform-api requires database role none; platform-db-api requires master or joiner.");
+  }
+  if (input.databaseCoordinators.length < 1 || input.databaseCoordinators.length > 16) {
+    throw new Error("databaseCoordinators must contain 1 through 16 endpoints.");
+  }
+  const coordinators = input.databaseCoordinators.map(privateCoordinator);
+  if (new Set(coordinators).size !== coordinators.length)
+    throw new Error("databaseCoordinators must be unique.");
+  if (input.databaseNetworkMode !== "private-lan") {
+    throw new Error("Attended platform bootstrap supports only private-lan database networking.");
+  }
+  boundedInteger("databaseReplicationFactor", input.databaseReplicationFactor, 1, 16);
+  boundedInteger("databaseWriteConcern", input.databaseWriteConcern, 1, 16);
+  if (input.databaseWriteConcern > input.databaseReplicationFactor) {
+    throw new Error("databaseWriteConcern cannot exceed databaseReplicationFactor.");
+  }
+  if (input.email?.provider === "smtp") {
+    safeAtom("email.host", input.email.host);
+    boundedInteger("email.port", input.email.port, 1, 65535);
+    safeAtom("email.user", input.email.user);
+    safeAtom("email.from", input.email.from);
+  } else if (input.email?.provider === "jetemail") {
+    safeAtom("email.from", input.email.from);
+    if (typeof input.email.eu !== "boolean")
+      throw new Error("JetEmail eu must be boolean.");
+  } else if (input.email !== undefined) {
+    throw new Error("Bootstrap email provider must be smtp or jetemail.");
+  }
+  boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
+  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
+  boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
+  boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
+  if (!Number.isFinite(input.otlpTraceSampleRatio) || input.otlpTraceSampleRatio < 0 || input.otlpTraceSampleRatio > 1) {
+    throw new Error("otlpTraceSampleRatio must be from 0 through 1.");
+  }
+  if (input.otlpEndpoint !== "http://127.0.0.1:4318")
+    throw new Error("OTLP must use the exact local collector endpoint.");
+  validateCollectorUnit(input.otlpCollectorUnit);
+  httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint);
+  for (const [name, value] of Object.entries({
+    nodeHostname: input.nodeHostname,
+    nodeRegion: input.nodeRegion,
+    databaseUser: input.databaseUser,
+    sharedDirectory: input.sharedDirectory,
+    seedSyncEpoch: input.seedSyncEpoch,
+    repository: input.repository,
+    branch: input.branch,
+    deployProfile: input.deployProfile
+  }))
+    safeAtom(name, value);
+  if (!input.sharedDirectory.startsWith("/"))
+    throw new Error("sharedDirectory must be absolute.");
+  for (const peer of input.seedSyncPeers) {
+    const url = new URL(peer);
+    if (url.protocol !== "ws:" && url.protocol !== "wss:")
+      throw new Error("Seed peers must be WebSocket URLs.");
+    if (url.username || url.password || url.hash)
+      throw new Error("Seed peers cannot contain credentials or fragments.");
+  }
+  if (input.backup) {
+    httpsOrigin("backup.endpoint", input.backup.endpoint);
+    for (const [name, value] of Object.entries(input.backup))
+      safeAtom(`backup.${name}`, value);
+  }
+  if (input.cloudflare) {
+    if (![input.cloudflare.accountId, input.cloudflare.zoneId, input.cloudflare.kvNamespaceId].every((item) => /^[a-f0-9]{32}$/i.test(item)) || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(input.cloudflare.tunnelId)) {
+      throw new Error("Cloudflare account, zone, KV and Tunnel ids are malformed.");
+    }
+    const service = new URL(input.cloudflare.tunnelService);
+    if (service.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(service.hostname) || service.username || service.password || service.search || service.hash)
+      throw new Error("Cloudflare Tunnel service must be loopback HTTP.");
+  }
+  if (input.realtime) {
+    input.realtime.endpoint = httpsOrigin("realtime.endpoint", input.realtime.endpoint);
+    if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(input.realtime.workerScriptName) || !/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,127}$/.test(input.realtime.producer)) {
+      throw new Error("realtime.producer is invalid.");
+    }
+  }
+  return {
+    ...input,
+    databaseCoordinators: coordinators,
+    appOrigin: httpsOrigin("appOrigin", input.appOrigin),
+    apiOrigin: httpsOrigin("apiOrigin", input.apiOrigin),
+    agentOtlpEndpoint: httpsOrigin("agentOtlpEndpoint", input.agentOtlpEndpoint)
+  };
+}
+function renderPlatformSharedEnvironment(input) {
+  const value = validatePlatformSharedEnvironment(input);
+  const appHost = new URL(value.appOrigin).hostname.split(".").slice(-2).join(".");
+  const apiHost = new URL(value.apiOrigin).hostname.split(".").slice(-2).join(".");
+  const entries = {
+    ARANGO_URL: value.databaseCoordinators[0],
+    ARANGO_URLS: value.databaseCoordinators.join(","),
+    ARANGO_DB: "fz",
+    FZ_DATABASE_MODE: "platform",
+    ARANGO_USER: value.databaseUser,
+    ARANGO_REPLICATION_FACTOR: String(value.databaseReplicationFactor),
+    ARANGO_WRITE_CONCERN: String(value.databaseWriteConcern),
+    FZ_DB_ROLE: value.databaseRole,
+    FZ_SOFTWARE_PROFILE: value.softwareProfile,
+    FZ_ROLE: value.nodeRole,
+    FZ_DB_ADDRESS: value.databaseAddress ?? "",
+    FZ_DB_MASTER: value.databaseMaster ?? "",
+    FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
+    FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
+    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
+    FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
+    FZ_SHARED_DIR: value.sharedDirectory,
+    FZ_PUBLIC_API_PORT: String(value.publicApiPort),
+    ORIGIN: value.appOrigin,
+    API_ORIGIN: value.apiOrigin,
+    HOST: "127.0.0.1",
+    APP_ORIGINS: value.appOrigin,
+    TRUST_CLOUDFLARE_IP: "1",
+    SESSION_COOKIE_SAMESITE: appHost === apiHost ? "lax" : "none",
+    SESSION_COOKIE_DOMAIN: "",
+    FZ_NODE_HOSTNAME: value.nodeHostname,
+    FZ_NODE_REGION: value.nodeRegion,
+    FZ_CONCURRENCY_LIMIT: String(value.concurrencyLimit),
+    FZ_DRAIN_DEADLINE_MS: String(value.drainDeadlineMs),
+    OTEL_EXPORTER_OTLP_ENDPOINT: value.otlpEndpoint,
+    FZ_OTLP_COLLECTOR_UNIT: value.otlpCollectorUnit,
+    OTEL_SERVICE_NAME: "forgezero-api",
+    FZ_OTLP_FLUSH_INTERVAL_MS: String(value.otlpFlushIntervalMs),
+    FZ_OTLP_TRACE_SAMPLE_RATIO: String(value.otlpTraceSampleRatio),
+    FZ_AGENT_OTLP_ENDPOINT: value.agentOtlpEndpoint,
+    FZ_CUSTODIAN_EMAIL: value.custodianEmail ?? "",
+    FZ_PROFILE: value.deployProfile,
+    FZ_REPO: value.repository,
+    FZ_BRANCH: value.branch,
+    FZ_EMAIL_PROVIDER: value.email?.provider ?? "",
+    FZ_SMTP_HOST: value.email?.provider === "smtp" ? value.email.host : "",
+    FZ_SMTP_PORT: value.email?.provider === "smtp" ? String(value.email.port) : "",
+    FZ_SMTP_USER: value.email?.provider === "smtp" ? value.email.user : "",
+    FZ_EMAIL_FROM: value.email?.from ?? "",
+    FZ_JETEMAIL_EU: value.email?.provider === "jetemail" ? String(value.email.eu) : "",
+    BACKUP_S3_ENDPOINT: value.backup?.endpoint ?? "",
+    BACKUP_S3_REGION: value.backup?.region ?? "",
+    BACKUP_S3_BUCKET: value.backup?.bucket ?? "",
+    BACKUP_S3_ACCESS_KEY_ID: value.backup?.accessKeyId ?? "",
+    FZ_CF_ACCOUNT_ID: value.cloudflare?.accountId ?? "",
+    FZ_CF_ZONE_ID: value.cloudflare?.zoneId ?? "",
+    FZ_CF_KV_NAMESPACE_ID: value.cloudflare?.kvNamespaceId ?? "",
+    FZ_CF_TUNNEL_ID: value.cloudflare?.tunnelId ?? "",
+    FZ_CF_TUNNEL_SERVICE: value.cloudflare?.tunnelService ?? "",
+    FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
+    FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
+    FZ_REALTIME_PRODUCER: value.realtime?.producer ?? ""
+  };
+  return `# Generated by fz bootstrap platform. Non-secret coordinates only.
+` + Object.entries(entries).map(([key, entry]) => `${key}=${systemdValue(key, entry)}`).join(`
+`) + `
+`;
+}
+function platformApiCredentialSpecs(options) {
+  const optional = [
+    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
+    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["CF_API_TOKEN", options.cloudflareKv],
+    ["REALTIME_PUBLISH_SECRET", options.realtime],
+    ["REALTIME_TICKET_SECRET", options.realtime]
+  ];
+  return [
+    { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
+    { name: "seed-sync-root", encryptedPath: "/etc/forgezero/creds/seed-sync-root.cred", required: true },
+    ...optional.filter(([, present]) => present).map(([name]) => ({
+      name,
+      encryptedPath: `/etc/forgezero/creds/${name}.cred`,
+      required: false
+    }))
+  ];
+}
+function renderPlatformApiUnits(input) {
+  for (const path2 of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+    if (!path2.startsWith("/") || /[\r\n]/.test(path2))
+      throw new Error("Runtime paths must be absolute and single-line.");
+  }
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
+    throw new Error("Invalid service user.");
+  validateCollectorUnit(input.collectorUnit);
+  boundedInteger("bluePort", input.bluePort, 1024, 65535);
+  boundedInteger("greenPort", input.greenPort, 1024, 65535);
+  if (input.bluePort === input.greenPort)
+    throw new Error("Blue and green ports must differ.");
+  const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
+`);
+  const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const template = `[Unit]
+Description=ForgeZero (%i slot)
+After=network-online.target ${input.collectorUnit}
+Wants=network-online.target ${input.collectorUnit}
+
+[Service]
+Type=simple
+User=${input.serviceUser}
+WorkingDirectory=${input.slotsDirectory}/%i
+Environment=NODE_ENV=production
+Environment=FZ_SLOT=%i
+EnvironmentFile=${input.sharedEnvironmentFile}
+${capacityEnvironment}${credentials}
+ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
+Restart=always
+RestartSec=2
+TimeoutStopSec=35s
+LimitCORE=0
+UMask=0077
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ReadOnlyPaths=${input.sharedDirectory}
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+LockPersonality=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+
+[Install]
+WantedBy=multi-user.target
+`;
+  return { template, dropIns: {
+    blue: `[Service]
+Environment=PORT=${input.bluePort}
+`,
+    green: `[Service]
+Environment=PORT=${input.greenPort}
+`
+  } };
+}
+function renderPlatformNginx(input) {
+  boundedInteger("publicPort", input.publicPort, 1024, 65535);
+  boundedInteger("initialSlotPort", input.initialSlotPort, 1024, 65535);
+  const concurrencyLimit = boundedInteger("concurrencyLimit", input.concurrencyLimit ?? 256, 1, 1e6);
+  boundedInteger("workerDrainSeconds", input.workerDrainSeconds ?? 35, 1, 300);
+  if (input.publicPort === input.initialSlotPort)
+    throw new Error("Edge and slot ports must differ.");
+  return {
+    upstream: `upstream forgezero { server 127.0.0.1:${input.initialSlotPort}; }
+`,
+    site: `limit_conn_zone $server_name zone=forgezero_admission:10m;
+map $http_upgrade $forgezero_connection { default upgrade; '' close; }
+map $limit_conn_status $forgezero_retry_after { default ''; REJECTED 1; REJECTED_DRY_RUN 1; }
+server {
+  listen 127.0.0.1:${input.publicPort};
+  server_name _;
+  limit_conn forgezero_admission ${concurrencyLimit};
+  limit_conn_status 503;
+  add_header Retry-After $forgezero_retry_after always;
+  location ^~ /api/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
+  location ^~ /v1/ { proxy_pass http://forgezero; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $forgezero_connection; proxy_read_timeout 3600s; }
+  location / { return 404; }
+}
+`
+  };
+}
+function planPlatformActivation(releasesDirectory, releasePath) {
+  if (!releasesDirectory.startsWith("/") || !releasePath.startsWith("/") || /[\0\r\n]/.test(releasePath)) {
+    throw new Error("Activation paths must be absolute and single-line.");
+  }
+  const root = releasesDirectory.replace(/\/+$/, "");
+  if (!releasePath.startsWith(`${root}/`) || releasePath === root || releasePath.includes("/../")) {
+    throw new Error("Release must be an immutable child of the releases directory.");
+  }
+  return {
+    command: "/usr/local/lib/forgezero/agent/fz-agent",
+    argv: ["platform-activate", "--config=/etc/forgezero/deploy-activation.json", releasePath],
+    runAs: "root",
+    invoker: "forgezero-runner"
+  };
+}
+function renderPlatformActivationFiles(input) {
+  if (!input.root.startsWith("/") || /[\0\r\n]/.test(input.root))
+    throw new Error("Activation root must be absolute and single-line.");
+  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(input.serviceUser))
+    throw new Error("Invalid activation service user.");
+  boundedInteger("bluePort", input.bluePort, 1024, 65535);
+  boundedInteger("greenPort", input.greenPort, 1024, 65535);
+  if (input.bluePort === input.greenPort)
+    throw new Error("Activation slot ports must differ.");
+  boundedInteger("keepReleases", input.keepReleases, 2, 100);
+  const drainDeadlineMs = boundedInteger("drainDeadlineMs", input.drainDeadlineMs ?? 35000, 1000, 300000);
+  if (!/^\/[A-Za-z0-9/_-]{1,128}$/.test(input.healthPath) || input.healthPath.includes("..")) {
+    throw new Error("Activation health path is malformed.");
+  }
+  const environment = [
+    `FZ_DIR=${input.root}`,
+    `FZ_USER=${input.serviceUser}`,
+    `FZ_BLUE_PORT=${input.bluePort}`,
+    `FZ_GREEN_PORT=${input.greenPort}`,
+    `FZ_HEALTH_PATH=${input.healthPath}`,
+    `FZ_KEEP_RELEASES=${input.keepReleases}`,
+    `FZ_DRAIN_DEADLINE_MS=${drainDeadlineMs}`
+  ].join(`
+`) + `
+`;
+  const helper = `${JSON.stringify({ ...input, drainDeadlineMs }, null, 2)}
+`;
+  return {
+    environment,
+    helper,
+    sudoers: `forgezero-runner ALL=(root) NOPASSWD: /usr/local/lib/forgezero/agent/fz-agent platform-activate --config=/etc/forgezero/deploy-activation.json *
+`
+  };
+}
+var platformExec = async (argv2) => {
+  const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" } });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}` };
+};
+var replaceLink = (path2, target) => {
+  const pending = `${path2}.next`;
+  rmSync5(pending, { force: true });
+  if (!target) {
+    rmSync5(path2, { force: true });
+    return;
+  }
+  symlinkSync3(target, pending);
+  renameSync5(pending, path2);
+};
+var secureRelease = (path2, uid, gid) => {
+  const visit = (current) => {
+    const metadata = lstatSync(current);
+    if (metadata.isSymbolicLink())
+      throw new Error("release contains a symbolic link");
+    chownSync(current, uid, gid);
+    chmodSync5(current, metadata.isDirectory() ? 365 : 292);
+    if (metadata.isDirectory())
+      for (const name of readdirSync2(current))
+        visit(join5(current, name));
+  };
+  visit(path2);
+};
+async function activatePlatformRelease(config, requestedRelease, options = {}) {
+  const rendered = renderPlatformActivationFiles(config);
+  const normalized = JSON.parse(rendered.helper);
+  const releases = realpathSync3(join5(normalized.root, "releases"));
+  const release = realpathSync3(requestedRelease);
+  if (!release.startsWith(`${releases}/`) || release === releases)
+    throw new Error("release is outside configured releases directory");
+  for (const required of [".fz/deploy.json", "src/index.ts", "bun.lock"]) {
+    const metadata = statSync(join5(release, required));
+    if (!metadata.isFile() || metadata.size < 1)
+      throw new Error(`release is incomplete: ${required}`);
+  }
+  const exec = options.exec ?? platformExec;
+  const request = options.fetch ?? fetch;
+  const sleep = options.sleep ?? Bun.sleep;
+  const slots = join5(normalized.root, "slots");
+  mkdirSync6(slots, { recursive: true, mode: 493 });
+  const slotFile = join5(normalized.root, ".forge-slot");
+  const previousSlot = existsSync5(slotFile) ? readFileSync5(slotFile, "utf8").trim() : undefined;
+  const target = previousSlot === "blue" ? "green" : "blue";
+  const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
+  const targetLink = join5(slots, target);
+  let previousTarget;
+  try {
+    previousTarget = realpathSync3(targetLink);
+  } catch {}
+  const user = await exec(["/usr/bin/id", "-u", normalized.serviceUser]);
+  const group = await exec(["/usr/bin/id", "-g", normalized.serviceUser]);
+  if (user.exitCode !== 0 || group.exitCode !== 0)
+    throw new Error("activation service identity does not exist");
+  secureRelease(release, Number(user.output.trim()), Number(group.output.trim()));
+  replaceLink(targetLink, release);
+  const service = `forgezero@${target}.service`;
+  const restart = await exec(["/usr/bin/systemctl", "restart", service]);
+  if (restart.exitCode !== 0) {
+    replaceLink(targetLink, previousTarget);
+    throw new Error("target slot failed to start");
+  }
+  let healthy = false;
+  for (let attempt = 0;attempt < 30; attempt += 1) {
+    try {
+      const response = await request(`http://127.0.0.1:${port}${normalized.healthPath}`, { signal: AbortSignal.timeout(2000) });
+      healthy = response.ok;
+    } catch {}
+    if (healthy)
+      break;
+    await sleep(1000);
+  }
+  const stopTarget = async () => {
+    await exec(["/usr/bin/systemctl", "stop", service]);
+    replaceLink(targetLink, previousTarget);
+  };
+  if (!healthy) {
+    await stopTarget();
+    throw new Error("target slot failed its health deadline");
+  }
+  const upstream = "/etc/nginx/conf.d/forgezero-upstream.conf";
+  const backup = `${upstream}.forgezero-backup`;
+  if (existsSync5(upstream))
+    copyFileSync2(upstream, backup);
+  else
+    rmSync5(backup, { force: true });
+  writeFileSync5(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
+`, { mode: 420 });
+  const test = await exec(["/usr/sbin/nginx", "-t"]);
+  const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
+  if (reload.exitCode !== 0) {
+    if (existsSync5(backup))
+      renameSync5(backup, upstream);
+    else
+      rmSync5(upstream, { force: true });
+    await exec(["/usr/sbin/nginx", "-t"]);
+    await exec(["/usr/sbin/nginx", "-s", "reload"]);
+    await stopTarget();
+    throw new Error("nginx refused the promoted upstream");
+  }
+  rmSync5(backup, { force: true });
+  writeFileSync5(slotFile, `${target}
+`, { mode: 420 });
+  if (previousSlot && previousSlot !== target) {
+    await sleep(normalized.drainDeadlineMs);
+    await exec(["/usr/bin/systemctl", "stop", `forgezero@${previousSlot}.service`]);
+  }
+  const old = readdirSync2(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join5(releases, entry.name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs).slice(normalized.keepReleases);
+  for (const path2 of old)
+    if (path2 !== release)
+      rmSync5(path2, { recursive: true, force: true });
+  return { release, slot: target };
+}
+function validateCollectorUnit(unit2) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,127}\.service$/.test(unit2))
+    throw new Error("Invalid OTLP collector service unit.");
+  if (/^(forgezero@.*|forgezero-agent|forgezero-metal-agent|forgezero-db)\.service$/.test(unit2)) {
+    throw new Error("OTLP collector must be independently supervised.");
+  }
+}
+function planLocalOtlpProof(endpoint, collectorUnit) {
+  if (endpoint !== "http://127.0.0.1:4318")
+    throw new Error("OTLP proof requires exact loopback endpoint http://127.0.0.1:4318.");
+  validateCollectorUnit(collectorUnit);
+  return {
+    unitCheck: { command: "systemctl", argv: ["is-active", "--quiet", collectorUnit] },
+    receiverCheck: {
+      command: "curl",
+      acceptedStatus: "2xx",
+      argv: [
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "5",
+        "--output",
+        "/dev/null",
+        "--write-out",
+        "%{http_code}",
+        "--request",
+        "POST",
+        "--header",
+        "Content-Type: application/json",
+        "--data-binary",
+        "{}",
+        `${endpoint}/v1/metrics`
+      ]
+    }
+  };
+}
+
+// src/platform-fleet-verification.ts
+import { lstatSync as lstatSync4 } from "node:fs";
+
+// src/bootstrap.ts
+import { createHash as createHash4, createHmac, randomBytes as randomBytes3 } from "node:crypto";
+import {
+  chmodSync as chmodSync7,
+  existsSync as existsSync7,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync7,
+  renameSync as renameSync7,
+  rmSync as rmSync7,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { dirname as dirname7 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/cli/agent-install.ts
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync as chmodSync6,
+  copyFileSync as copyFileSync3,
+  existsSync as existsSync6,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync6,
+  realpathSync as realpathSync4,
+  renameSync as renameSync6,
+  rmSync as rmSync6,
+  symlinkSync as symlinkSync4,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { dirname as dirname5 } from "node:path";
+async function readCapabilities(run2) {
+  const answers = {};
+  const checks = Object.entries(CAPABILITY_CHECKS);
+  for (const [id, check] of checks) {
+    try {
+      const result = await run2(check.operation);
+      answers[id] = check.satisfied(result.stdout, result.exitCode);
+    } catch {
+      answers[id] = false;
+    }
+  }
+  return answers;
+}
+var fixed = async (argv2, stdin) => {
+  const child = Bun.spawn([...argv2], {
+    stdin: stdin === undefined ? "ignore" : "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C", DEBIAN_FRONTEND: "noninteractive" }
+  });
+  if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
+    child.stdin.write(stdin);
+    child.stdin.end();
+  }
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { stdout: `${stdout}${stderr}`, exitCode };
+};
+var runProvisionOperation = async (operation) => {
+  if (operation.kind === "commands") {
+    let output = "";
+    for (const command2 of operation.commands) {
+      const result = await fixed(command2.argv);
+      output += result.stdout;
+      if (!(command2.acceptedExitCodes ?? [0]).includes(result.exitCode))
+        return { stdout: output, exitCode: result.exitCode };
+    }
+    return { stdout: output, exitCode: 0 };
+  }
+  if (operation.kind === "directories") {
+    for (const directory of operation.directories) {
+      const argv2 = ["/usr/bin/install", "-d", "-m", directory.mode.toString(8).padStart(4, "0")];
+      if (directory.owner)
+        argv2.push("-o", directory.owner);
+      if (directory.group)
+        argv2.push("-g", directory.group);
+      argv2.push(directory.path);
+      const result = await fixed(argv2);
+      if (result.exitCode !== 0)
+        return result;
+    }
+    return { stdout: "", exitCode: 0 };
+  }
+  if (operation.kind === "install-runtime") {
+    const release = `/opt/forgezero/agent/versions/${operation.version}`;
+    mkdirSync7(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync7(dirname5(operation.binary), { recursive: true, mode: 493 });
+    copyFileSync3(operation.source, `${release}/dist/fz-agent.js`);
+    chmodSync6(`${release}/dist/fz-agent.js`, 493);
+    const gitSshSource = `${dirname5(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync6(gitSshSource))
+      return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
+    copyFileSync3(gitSshSource, `${release}/dist/fz-git-ssh.js`);
+    chmodSync6(`${release}/dist/fz-git-ssh.js`, 493);
+    const pending = "/opt/forgezero/agent/current.next";
+    rmSync6(pending, { force: true });
+    symlinkSync4(`versions/${operation.version}`, pending);
+    renameSync6(pending, "/opt/forgezero/agent/current");
+    rmSync6(operation.binary, { force: true });
+    symlinkSync4("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
+    const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
+    rmSync6(gitSshBinary, { force: true });
+    symlinkSync4("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
+    return { stdout: "", exitCode: 0 };
+  }
+  if (operation.kind === "ensure-seed") {
+    if (existsSync6(operation.credential) && lstatSync2(operation.credential).size > 0)
+      return { stdout: "", exitCode: 0 };
+    const seed = randomBytes(32).toString("base64url");
+    const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
+    if (result.exitCode === 0)
+      chmodSync6(operation.credential, 256);
+    return result;
+  }
+  if (operation.kind === "ensure-git-identity") {
+    const key = "/run/forgezero-git-deploy-key";
+    const publicKey = `${key}.pub`;
+    try {
+      if (!existsSync6(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync6(key, { force: true });
+        rmSync6(publicKey, { force: true });
+        let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
+        if (result.exitCode !== 0)
+          return result;
+        result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=git-deploy-key", key, operation.credential]);
+        if (result.exitCode !== 0)
+          return result;
+        chmodSync6(operation.credential, 256);
+      }
+      if (!existsSync6(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync6(key)) {
+          const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
+          if (decrypted.exitCode !== 0)
+            return decrypted;
+        }
+        const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
+        if (derived.exitCode !== 0)
+          return derived;
+        writeFileSync6(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+`, { mode: 292 });
+      }
+      return { stdout: "", exitCode: 0 };
+    } finally {
+      rmSync6(key, { force: true });
+      rmSync6(publicKey, { force: true });
+    }
+  }
+  if (operation.kind === "ensure-bootstrap-ssh-identity") {
+    const key = "/run/forgezero-bootstrap-ssh-key";
+    const generatedPublicKey = `${key}.pub`;
+    try {
+      if (!existsSync6(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync6(key, { force: true });
+        rmSync6(generatedPublicKey, { force: true });
+        let result;
+        if (operation.source) {
+          const source = existsSync6(operation.source) ? lstatSync2(operation.source) : undefined;
+          if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
+            return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
+          }
+          copyFileSync3(operation.source, key);
+          chmodSync6(key, 384);
+        } else {
+          result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-bootstrap-runner", "-f", key]);
+          if (result.exitCode !== 0)
+            return result;
+        }
+        result = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
+        if (result.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(result.stdout)) {
+          return { stdout: "bootstrap SSH private key is not a valid Ed25519 OpenSSH key", exitCode: 1 };
+        }
+        result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
+        if (result.exitCode !== 0)
+          return result;
+        chmodSync6(operation.credential, 256);
+      }
+      if (!existsSync6(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync6(key)) {
+          const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
+          if (decrypted.exitCode !== 0)
+            return decrypted;
+          chmodSync6(key, 384);
+        }
+        const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
+        if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
+          return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
+        }
+        mkdirSync7(dirname5(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync6(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+`, { mode: 292 });
+        chmodSync6(operation.publicKey, 292);
+      }
+      if (operation.source)
+        rmSync6(operation.source, { force: true });
+      return { stdout: "", exitCode: 0 };
+    } finally {
+      rmSync6(key, { force: true });
+      rmSync6(generatedPublicKey, { force: true });
+    }
+  }
+  if (operation.kind === "ensure-enrolment") {
+    if (existsSync6(operation.state) && lstatSync2(operation.state).size > 0 || existsSync6(operation.credential) && lstatSync2(operation.credential).size > 0)
+      return { stdout: "", exitCode: 0 };
+    if (!existsSync6(operation.source))
+      return { stdout: "enrolment source is missing", exitCode: 1 };
+    const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
+    if (result.exitCode === 0) {
+      chmodSync6(operation.credential, 256);
+      rmSync6(operation.source, { force: true });
+    }
+    return result;
+  }
+  if (operation.kind === "wait-socket") {
+    for (let attempt = 0;attempt < operation.attempts; attempt += 1) {
+      try {
+        if (lstatSync2(operation.path).isSocket())
+          return { stdout: "", exitCode: 0 };
+      } catch {}
+      await Bun.sleep(operation.intervalMs);
+    }
+    return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
+  }
+  if (operation.kind === "verify-file")
+    return existsSync6(operation.path) && lstatSync2(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+  if (operation.kind === "verify-egress") {
+    const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
+    if (active.exitCode !== 0)
+      return active;
+    const policy = await fixed(["/usr/sbin/nft", "--numeric", "list", "table", "inet", "forgezero_agent_egress"]);
+    const required = [
+      "forgezero-agent-egress-v1",
+      `public-tcp=${operation.runnerPublicTcpPorts.join(",")}`,
+      ...operation.runnerLoopbackPorts.length ? [`:${operation.runnerLoopbackPorts.join(",")}`] : []
+    ];
+    return policy.exitCode === 0 && required.every((part) => policy.stdout.includes(part)) ? { stdout: policy.stdout, exitCode: 0 } : { stdout: policy.stdout, exitCode: 1 };
+  }
+  if (operation.kind === "verify-resolved-stub") {
+    try {
+      const expected = "/run/systemd/resolve/stub-resolv.conf";
+      return realpathSync4("/etc/resolv.conf") === expected && realpathSync4(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+    } catch {
+      return { stdout: "resolver stub missing", exitCode: 1 };
+    }
+  }
+  if (operation.kind === "install-warp") {
+    const os = readFileSync6("/etc/os-release", "utf8");
+    if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
+      return { stdout: "unsupported WARP host OS", exitCode: 1 };
+    const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
+    if (!response.ok)
+      return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
+    mkdirSync7("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync7("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync7("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    const key = "/run/cloudflare-warp-key.gpg";
+    writeFileSync6(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
+    rmSync6(key, { force: true });
+    if (result.exitCode !== 0)
+      return result;
+    const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
+    if (!codename)
+      return { stdout: "Ubuntu codename missing", exitCode: 1 };
+    writeFileSync6("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+`, { mode: 420 });
+    result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
+    return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
+  }
+  const status = await fixed(["/usr/bin/warp-cli", "--accept-tos", "status"]);
+  return status.exitCode === 0 && /(^|\s)Connected(\s|$)/i.test(status.stdout) ? status : { ...status, exitCode: 1 };
+};
+async function localRunner(operation) {
+  if (!["path-exists", "version"].includes(operation.kind))
+    return runProvisionOperation(operation);
+  const capability = operation;
+  if (capability.kind === "version")
+    return fixed(capability.argv);
+  try {
+    const metadata = lstatSync2(capability.path);
+    const present = capability.nodeType === "directory" ? metadata.isDirectory() : true;
+    return { stdout: present ? `yes
+` : `no
+`, exitCode: present ? 0 : 1 };
+  } catch {
+    return { stdout: `no
+`, exitCode: 1 };
+  }
+}
+function planInstall(options) {
+  const { capabilities, ...unit2 } = options;
+  return planProvision({ ...unit2, mode: modeFor(capabilities) });
+}
+async function applyPlan(plan, run2) {
+  const transcript = [];
+  for (const step2 of plan.steps) {
+    const result = await run2(step2.operation);
+    transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
+    if (result.exitCode !== 0 && !step2.optional) {
+      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
+    }
+  }
+  return transcript;
+}
+
+// src/cloudflare-bootstrap.ts
+import { constants } from "node:fs";
+import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
+import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "node:fs/promises";
+import { dirname as dirname6, join as join6, resolve as resolve4 } from "node:path";
+import { isIP as isIP3 } from "node:net";
+
+// src/cloudflare-edge.ts
+import { isIP as isIP2 } from "node:net";
+
+// src/otel-collector.ts
+var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
+var UNIT = `/etc/systemd/system/${FORGEZERO_OTEL_COLLECTOR_UNIT}`;
+
+// src/bootstrap.ts
+import { DEFAULT_SOCKET as DEFAULT_SOCKET2 } from "@forgezero/vault";
+var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
+var BOOTSTRAP_STATE_PATH = "/var/lib/forgezero/bootstrap.json";
+var STATE_PATH = BOOTSTRAP_STATE_PATH;
+var CREDS = "/etc/forgezero/creds";
+var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
+var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
+var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
+var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
+var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
+var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
+var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
+var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
+var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
+var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
+var CONTROL_SOCKET = "/run/forgezero/control.sock";
+var CLOUDFLARED_METRICS_ADDRESS = "127.0.0.1:20241";
+var CLOUDFLARED_DIAGNOSTICS_URL = `http://${CLOUDFLARED_METRICS_ADDRESS}/diag/tunnel`;
+var PACKAGED_AGENT_BIN = fileURLToPath(new URL("./fz-agent.js", import.meta.url));
+function parseCloudflaredTunnelDiagnostics(raw, expectedTunnelId) {
+  if (raw.length > 64 * 1024)
+    throw new Error("cloudflared tunnel diagnostics exceed 64 KiB");
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("cloudflared tunnel diagnostics are not JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("cloudflared tunnel diagnostics are malformed");
+  }
+  const diagnostics = value;
+  if (diagnostics.tunnelID !== expectedTunnelId)
+    throw new Error("cloudflared is connected to the wrong tunnel");
+  if (!/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(diagnostics.connectorID ?? "")) {
+    throw new Error("cloudflared connector identity is missing");
+  }
+  if (!Array.isArray(diagnostics.connections) || diagnostics.connections.length !== 4 || diagnostics.connections.some((connection) => !connection || typeof connection !== "object" || connection.isConnected !== true)) {
+    throw new Error("cloudflared does not have four connected edge sessions");
+  }
+  return diagnostics;
+}
+async function inspectCloudflaredTunnel(host, expectedTunnelId) {
+  const result = await host.exec([
+    "curl",
+    "--fail",
+    "--silent",
+    "--show-error",
+    "--max-time",
+    "5",
+    CLOUDFLARED_DIAGNOSTICS_URL
+  ]);
+  if (result.exitCode !== 0)
+    return { healthy: false, problem: "cloudflared diagnostics endpoint is unreachable" };
+  try {
+    parseCloudflaredTunnelDiagnostics(result.output, expectedTunnelId);
+    return { healthy: true };
+  } catch (cause) {
+    return { healthy: false, problem: cause.message };
+  }
+}
+function parseStoredState(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    throw new Error("bootstrap state is malformed");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap state is malformed");
+  const state = value;
+  if (state.format !== 2 || !["platform", "enrolled-compute"].includes(state.kind ?? "") || !/^[a-f0-9]{64}$/.test(state.identityDigest ?? "") || typeof state.profile !== "string" || typeof state.nodeHostname !== "string" || typeof state.apiUrl !== "string" || state.kind === "platform" && !["member", "none"].includes(state.databaseAgency ?? "")) {
+    throw new Error("bootstrap state is legacy or incomplete; refusing an unbound repair");
+  }
+  return state;
+}
+async function bootstrapStatus(host = localBootstrapHost()) {
+  if (!host.exists(STATE_PATH))
+    return { initialized: false, services: {}, problems: ["bootstrap state is missing"] };
+  let state;
+  try {
+    state = parseStoredState(host.read(STATE_PATH));
+  } catch (cause) {
+    return { initialized: false, services: {}, problems: [cause.message] };
+  }
+  const units = ["forgezero-agent.service", "forgezero-agent.socket"];
+  if (state.kind === "platform")
+    units.push("nginx.service");
+  if (state.kind === "platform" && state.collectorUnit)
+    units.push(state.collectorUnit);
+  if (state.cloudflared)
+    units.push("cloudflared.service");
+  if (state.warp)
+    units.push("warp-svc.service", "forgezero-mesh-config.service");
+  if (state.kind === "platform" && state.databaseRole !== "none")
+    units.push("forgezero-db.service", "forgezero-db-verify.service");
+  const services = {};
+  const problems = [];
+  for (const unit2 of units) {
+    const result = await host.exec(["systemctl", "is-active", "--quiet", unit2]);
+    services[unit2] = result.exitCode === 0;
+    if (result.exitCode !== 0)
+      problems.push(`${unit2} is not active`);
+  }
+  for (const socket of [DEFAULT_SOCKET2, CONTROL_SOCKET]) {
+    services[socket] = host.exists(socket);
+    if (!services[socket])
+      problems.push(`${socket} is missing`);
+  }
+  if (state.cloudflared) {
+    for (const credential of [TUNNEL_CREDENTIAL, CF_API_CREDENTIAL]) {
+      services[credential] = host.exists(credential);
+      if (!services[credential])
+        problems.push(`${credential} is missing`);
+    }
+    const tunnelId = state.cloudflare?.tunnelId ?? state.cloudflareTunnelId;
+    if (!tunnelId) {
+      services["cloudflared-tunnel"] = false;
+      problems.push("Cloudflare tunnel identity is missing from bootstrap state");
+    } else {
+      const evidence = await inspectCloudflaredTunnel(host, tunnelId);
+      services["cloudflared-tunnel"] = evidence.healthy;
+      if (!evidence.healthy)
+        problems.push(evidence.problem);
+    }
+  }
+  if (state.warp) {
+    services[WARP_CONNECTOR_CREDENTIAL] = host.exists(WARP_CONNECTOR_CREDENTIAL);
+    if (!services[WARP_CONNECTOR_CREDENTIAL])
+      problems.push(`${WARP_CONNECTOR_CREDENTIAL} is missing`);
+    const status = await host.exec(["/usr/bin/warp-cli", "--accept-tos", "status"]);
+    services["cloudflare-mesh"] = status.exitCode === 0 && /\bconnected\b/i.test(status.output) && !/\bdisconnected\b/i.test(status.output);
+    if (!services["cloudflare-mesh"])
+      problems.push("Cloudflare Mesh/WARP is not connected");
+  }
+  if (state.kind === "platform") {
+    const [blue, green] = await Promise.all([
+      host.exec(["systemctl", "is-active", "--quiet", "forgezero@blue.service"]),
+      host.exec(["systemctl", "is-active", "--quiet", "forgezero@green.service"])
+    ]);
+    services["forgezero@active.service"] = blue.exitCode === 0 || green.exitCode === 0;
+    if (!services["forgezero@active.service"])
+      problems.push("neither API slot is active");
+    if (!Number.isSafeInteger(state.publicApiPort) || !state.healthPath) {
+      problems.push("platform health coordinates are missing from bootstrap state");
+    } else {
+      const health = await host.exec([
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "5",
+        `http://127.0.0.1:${state.publicApiPort}${state.healthPath}`
+      ]);
+      services["platform-api-health"] = health.exitCode === 0;
+      if (health.exitCode !== 0)
+        problems.push("platform API health check failed");
+    }
+    const nginx2 = await host.exec(["nginx", "-t"]);
+    services["nginx-config"] = nginx2.exitCode === 0;
+    if (nginx2.exitCode !== 0)
+      problems.push("nginx configuration is invalid");
+    if (state.databaseRole !== "none") {
+      const unitPath = "/etc/systemd/system/forgezero-db.service";
+      const expectsNoAgency = state.databaseAgency === "none";
+      const unitHasNoAgency = host.exists(unitPath) && host.read(unitPath).includes("--cluster.start-agent=false");
+      services["database-agency-profile"] = expectsNoAgency === unitHasNoAgency;
+      if (!services["database-agency-profile"])
+        problems.push("database Agency participation disagrees with the installed unit");
+      if (!state.databaseModeEvidence || !host.exists(state.databaseModeEvidence)) {
+        problems.push("database Coordinator-mode evidence is missing");
+      } else {
+        try {
+          const evidence = JSON.parse(host.read(state.databaseModeEvidence));
+          if (evidence.expectedMode !== "default" || evidence.role !== "COORDINATOR" || evidence.agency !== state.databaseAgency || evidence.unit !== "forgezero-db-verify.service" || Number.isNaN(Date.parse(String(evidence.verifiedAt)))) {
+            throw new Error("invalid evidence");
+          }
+          services["database-mode-evidence"] = true;
+        } catch {
+          services["database-mode-evidence"] = false;
+          problems.push("database Coordinator-mode evidence is malformed");
+        }
+      }
+    }
+  }
+  if (!host.exists("/var/lib/forgezero/enrolment.json"))
+    problems.push("durable Agent enrolment state is missing");
+  return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
+}
+function localBootstrapHost() {
+  const execute = async (argv2, options = {}) => {
+    const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
+    if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
+      child.stdin.write(options.stdin);
+      child.stdin.end();
+    }
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  };
+  return {
+    uid: () => process.getuid?.() ?? -1,
+    exists: existsSync7,
+    read: (path2) => readFileSync7(path2, "utf8"),
+    write(path2, content, mode) {
+      mkdirSync8(dirname7(path2), { recursive: true, mode: 493 });
+      const temporary = `${path2}.next.${process.pid}`;
+      writeFileSync7(temporary, content, { mode });
+      chmodSync7(temporary, mode);
+      renameSync7(temporary, path2);
+    },
+    mkdir: (path2, mode) => mkdirSync8(path2, { recursive: true, mode }),
+    remove: (path2) => rmSync7(path2, { force: true }),
+    inspect(path2) {
+      const value = lstatSync3(path2);
+      return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
+    },
+    exec: execute,
+    sleep: (milliseconds) => Bun.sleep(milliseconds),
+    async ensureSoftware(requirements) {
+      const result = await execute([
+        "runuser",
+        "-u",
+        "forgezero-agent",
+        "--",
+        "/usr/local/bin/fz-agent",
+        "software-ensure",
+        ...requirements.map(({ id, version }) => `--require=${id}@${version}`)
+      ]);
+      if (result.exitCode !== 0)
+        throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
+      return result;
+    },
+    async installAgent(config, enrolTokenSourcePath) {
+      const capabilities = await readCapabilities(localRunner);
+      const deployRoot = config.deployRoot ?? "/opt/forgezero";
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync7("/var/lib/forgezero/enrolment.json");
+      if (config.kind === "platform") {
+        const lifecycle = config.database.role === "none" ? {
+          apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
+          apiHealthUrl: "http://127.0.0.1:3000/api/health"
+        } : {
+          apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
+          databaseUnit: "forgezero-db.service",
+          apiHealthUrl: "http://127.0.0.1:3000/api/health",
+          databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
+          databasePorts: [8529]
+        };
+        mkdirSync8(dirname7(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync7(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+`, { mode: 256 });
+      }
+      const plan = planInstall({
+        capabilities,
+        socketPath: DEFAULT_SOCKET2,
+        seedPath: "/var/lib/forgezero/node.seed",
+        controlSocketPath: "/run/forgezero/control.sock",
+        repository: config.repository,
+        branch: config.branch,
+        profile: config.kind === "platform" ? config.profile : config.profile,
+        deployRoot,
+        deploymentCredentials: config.deploymentCredentials,
+        publicApiUrl: config.apiUrl,
+        gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
+        gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
+        generateGitIdentity: true,
+        pullDeployments: hasBinding,
+        pullMigrations: config.kind === "platform" && hasBinding,
+        pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
+        bootstrapSshCredentialPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+        bootstrapSshSourcePath: config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
+        bootstrapSshPublicKeyPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
+        bootstrapTargetTelemetryEndpoint: platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
+        lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
+        enforceEgress: true,
+        nodeHostname: config.nodeHostname,
+        telemetryEndpoint: config.telemetryEndpoint,
+        binPath: "/usr/local/lib/forgezero/agent/fz-agent",
+        sourceBinPath: PACKAGED_AGENT_BIN,
+        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
+          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
+          enrolTokenCredentialPath: ENROL_CREDENTIAL,
+          enrolStatePath: "/var/lib/forgezero/enrolment.json",
+          apiUrl: config.apiUrl,
+          project: config.kind === "enrolled-compute" ? config.realm : "platform",
+          environment: config.kind === "enrolled-compute" ? undefined : config.environment,
+          nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
+        } : {}
+      });
+      for (const unit2 of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
+        mkdirSync8(dirname7(unit2.path), { recursive: true, mode: 493 });
+        writeFileSync7(unit2.path, unit2.unit, { mode: 420 });
+      }
+      await applyPlan(plan, localRunner);
+      return plan;
+    }
+  };
+}
+
+// src/platform-fleet-verification.ts
+var localRuntime = () => ({
+  uid: () => process.getuid?.() ?? -1,
+  bootstrapStatus: () => bootstrapStatus(),
+  characterDevice(path2) {
+    try {
+      return lstatSync4(path2).isCharacterDevice();
+    } catch {
+      return false;
+    }
+  },
+  async exec(argv2) {
+    const child = Bun.spawn([...argv2], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(child.stdout).text(),
+      new Response(child.stderr).text(),
+      child.exited
+    ]);
+    return { exitCode, output: `${stdout}${stderr}`.slice(0, 256 * 1024) };
+  }
+});
+async function verifyPlatformFleetHost(expectedVersion, runtime = localRuntime()) {
+  if (!/^\d+\.\d+\.\d+$/.test(expectedVersion))
+    throw new Error("expected Agent version is invalid");
+  if (runtime.uid() !== 0)
+    throw new Error("platform-fleet-verify must run as root");
+  if (expectedVersion !== VERSION3) {
+    throw new Error(`Agent version ${VERSION3} does not match expected ${expectedVersion}`);
+  }
+  const status = await runtime.bootstrapStatus();
+  if (!status.initialized || status.problems.length > 0) {
+    throw new Error(`platform bootstrap is not healthy: ${status.problems.join("; ") || "not initialized"}`);
+  }
+  if (!runtime.characterDevice("/dev/sev-guest"))
+    throw new Error("/dev/sev-guest is not a character device");
+  const failed = await runtime.exec(["/usr/bin/systemctl", "--failed", "--no-legend", "--plain"]);
+  if (failed.exitCode !== 0)
+    throw new Error("could not inspect failed systemd units");
+  if (failed.output.trim())
+    throw new Error(`failed systemd units are present: ${failed.output.trim()}`);
+  return { ok: true, agentVersion: VERSION3, bootstrap: status, sevGuest: true, failedUnits: [] };
+}
+export {
+  verifyPlatformFleetHost
+};