@forgezero/agent 0.1.52 → 0.1.55

package/dist/fz.js

@@ -4811,9 +4811,9 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 
 // src/cli/index.ts
 init_dist();
-import { existsSync as existsSync9, lstatSync as lstatSync8, mkdirSync as mkdirSync9, readFileSync as readFileSync12, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync11, lstatSync as lstatSync9, mkdirSync as mkdirSync11, readFileSync as readFileSync14, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync12 } from "fs";
 import { randomBytes as randomBytes10 } from "crypto";
-import { dirname as dirname10, isAbsolute as isAbsolute4, resolve as resolve7 } from "path";
+import { basename as basename3, dirname as dirname12, isAbsolute as isAbsolute5, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { hostname } from "os";
 
@@ -4830,7 +4830,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.52";
+var VERSION2 = "0.1.55";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4840,6 +4840,7 @@ var OS_CATALOG = [
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4847,6 +4848,14 @@ var SOFTWARE_CATALOG = [
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
 function validateSoftwareRequirements(value, _options = {}) {
   if (!Array.isArray(value) || value.length > 32)
     throw new Error("software requirements must be an array of at most 32 entries");
@@ -4858,7 +4867,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -5254,6 +5263,39 @@ var defaultHost = {
   now: Date.now
 };
 
+// src/container-supervisor.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve2, sep as sep2 } from "path";
+var defaultHost2 = {
+  realpath: realpathSync2,
+  exists: existsSync2,
+  read: (path) => readFileSync2(path, "utf8"),
+  write(path, content, mode) {
+    mkdirSync2(dirname2(path), { recursive: true, mode: 493 });
+    const next = `${path}.next`;
+    writeFileSync2(next, content, { mode });
+    renameSync2(next, path);
+  },
+  remove: (path) => rmSync2(path, { force: true }),
+  list: (path) => existsSync2(path) ? readdirSync2(path) : [],
+  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  async exec(argv2) {
+    const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  async health(port, path, timeoutMs, method, expectedStatus) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path}`, { method, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return expectedStatus.includes(response.status);
+    } catch {
+      return false;
+    }
+  },
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -6236,17 +6278,17 @@ import { randomBytes as randomBytes5 } from "crypto";
 import {
   chmodSync,
   copyFileSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   lstatSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  realpathSync as realpathSync2,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync3,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
   symlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname3 } from "path";
 function parseAssignments(value) {
   if (!value?.trim())
     return;
@@ -6338,28 +6380,28 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync2(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync2(dirname2(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync3(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync3(dirname3(operation.binary), { recursive: true, mode: 493 });
     copyFileSync(operation.source, `${release}/dist/fz-agent.js`);
     chmodSync(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname2(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync2(gitSshSource))
+    const gitSshSource = `${dirname3(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync3(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync(gitSshSource, `${release}/dist/fz-git-ssh.js`);
     chmodSync(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync2(pending, { force: true });
+    rmSync3(pending, { force: true });
     symlinkSync(`versions/${operation.version}`, pending);
-    renameSync2(pending, "/opt/forgezero/agent/current");
-    rmSync2(operation.binary, { force: true });
+    renameSync3(pending, "/opt/forgezero/agent/current");
+    rmSync3(operation.binary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync2(gitSshBinary, { force: true });
+    rmSync3(gitSshBinary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
     const seed = randomBytes5(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
@@ -6371,9 +6413,9 @@ var runProvisionOperation = async (operation) => {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync2(key, { force: true });
-        rmSync2(publicKey, { force: true });
+      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync3(key, { force: true });
+        rmSync3(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
@@ -6382,8 +6424,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync(operation.credential, 256);
       }
-      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync2(key)) {
+      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync3(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -6391,25 +6433,25 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync2(key, { force: true });
-      rmSync2(publicKey, { force: true });
+      rmSync3(key, { force: true });
+      rmSync3(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync2(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync2(key, { force: true });
-        rmSync2(generatedPublicKey, { force: true });
+      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
+        rmSync3(key, { force: true });
+        rmSync3(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync2(operation.source) ? lstatSync(operation.source) : undefined;
+          const source = existsSync3(operation.source) ? lstatSync(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
@@ -6429,8 +6471,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync(operation.credential, 256);
       }
-      if (!existsSync2(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync2(key)) {
+      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
+        if (!existsSync3(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -6440,28 +6482,28 @@ var runProvisionOperation = async (operation) => {
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync2(dirname2(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync2(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync3(dirname3(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync2(operation.source, { force: true });
+        rmSync3(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync2(key, { force: true });
-      rmSync2(generatedPublicKey, { force: true });
+      rmSync3(key, { force: true });
+      rmSync3(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync2(operation.state) && lstatSync(operation.state).size > 0 || existsSync2(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync3(operation.state) && lstatSync(operation.state).size > 0 || existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync2(operation.source))
+    if (!existsSync3(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
       chmodSync(operation.credential, 256);
-      rmSync2(operation.source, { force: true });
+      rmSync3(operation.source, { force: true });
     }
     return result;
   }
@@ -6476,7 +6518,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync2(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync3(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -6492,31 +6534,31 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "verify-resolved-stub") {
     try {
       const expected = "/run/systemd/resolve/stub-resolv.conf";
-      return realpathSync2("/etc/resolv.conf") === expected && realpathSync2(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+      return realpathSync3("/etc/resolv.conf") === expected && realpathSync3(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
     } catch {
       return { stdout: "resolver stub missing", exitCode: 1 };
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync2("/etc/os-release", "utf8");
+    const os = readFileSync3("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync2("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync2("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync2("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync3("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync3("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync2(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync3(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync2(key, { force: true });
+    rmSync3(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync2("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -9901,8 +9943,8 @@ async function runUnlock(args) {
 }
 
 // src/project-context.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join3, resolve as resolve3 } from "path";
 var PROJECT_CONTEXT_VERSION = 1;
 var GENERATED = "<!-- Generated by @forgezero/agent project context. Edit .forgezero/project.json, then run `fz project sync`. -->";
 
@@ -9981,14 +10023,14 @@ function defaultProjectContext(root = process.cwd()) {
   let name = root.split("/").filter(Boolean).at(-1) ?? "project";
   let verify = ["npm test"];
   const manifestPath = join3(root, "package.json");
-  if (existsSync3(manifestPath)) {
+  if (existsSync4(manifestPath)) {
     try {
-      const pkg = JSON.parse(readFileSync3(manifestPath, "utf8"));
+      const pkg = JSON.parse(readFileSync4(manifestPath, "utf8"));
       name = pkg.name ?? name;
-      const runner = existsSync3(join3(root, "bun.lock")) ? "bun run" : "npm run";
+      const runner = existsSync4(join3(root, "bun.lock")) ? "bun run" : "npm run";
       verify = ["check", "test", "build"].filter((script) => pkg.scripts?.[script]).map((script) => `${runner} ${script}`);
       if (verify.length === 0)
-        verify = [existsSync3(join3(root, "bun.lock")) ? "bun test" : "npm test"];
+        verify = [existsSync4(join3(root, "bun.lock")) ? "bun test" : "npm test"];
     } catch {}
   }
   return {
@@ -10083,22 +10125,22 @@ ${adapter("Cursor").replace(`${GENERATED}
   ];
 }
 var atomicWrite = (path, content) => {
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync4(dirname4(path), { recursive: true });
   const next = `${path}.${process.pid}.next`;
-  writeFileSync3(next, content, { mode: 420 });
-  renameSync3(next, path);
+  writeFileSync4(next, content, { mode: 420 });
+  renameSync4(next, path);
 };
 function initializeProjectContext(rootInput, manifestInput = defaultProjectContext(rootInput), options = {}) {
-  const root = resolve2(rootInput);
+  const root = resolve3(rootInput);
   const manifest = parseProjectContext(manifestInput);
   const manifestPath = join3(root, ".forgezero", "project.json");
   const files = projectContextFiles(manifest);
   const collisions = [manifestPath, ...files.map((file) => join3(root, file.path))].filter((path) => {
-    if (!existsSync3(path))
+    if (!existsSync4(path))
       return false;
     if (path === manifestPath)
       return true;
-    return !readFileSync3(path, "utf8").startsWith(GENERATED);
+    return !readFileSync4(path, "utf8").startsWith(GENERATED);
   });
   if (collisions.length && !options.force) {
     throw new ProjectContextError(`refusing to replace existing project context: ${collisions.join(", ")}`);
@@ -10110,15 +10152,15 @@ function initializeProjectContext(rootInput, manifestInput = defaultProjectConte
   return files;
 }
 function syncProjectContext(rootInput) {
-  const root = resolve2(rootInput);
+  const root = resolve3(rootInput);
   const manifestPath = join3(root, ".forgezero", "project.json");
-  if (!existsSync3(manifestPath))
+  if (!existsSync4(manifestPath))
     throw new ProjectContextError("No .forgezero/project.json. Run `fz project init`.");
-  const manifest = parseProjectContext(JSON.parse(readFileSync3(manifestPath, "utf8")));
+  const manifest = parseProjectContext(JSON.parse(readFileSync4(manifestPath, "utf8")));
   const files = projectContextFiles(manifest);
   for (const file of files) {
     const path = join3(root, file.path);
-    if (existsSync3(path) && !readFileSync3(path, "utf8").startsWith(GENERATED)) {
+    if (existsSync4(path) && !readFileSync4(path, "utf8").startsWith(GENERATED)) {
       throw new ProjectContextError(`refusing to replace non-generated adapter: ${file.path}`);
     }
     atomicWrite(path, file.content);
@@ -10126,30 +10168,30 @@ function syncProjectContext(rootInput) {
   return files;
 }
 function checkProjectContext(rootInput) {
-  const root = resolve2(rootInput);
+  const root = resolve3(rootInput);
   const manifestPath = join3(root, ".forgezero", "project.json");
-  if (!existsSync3(manifestPath))
+  if (!existsSync4(manifestPath))
     return { ok: false, problems: ["missing .forgezero/project.json"] };
   let manifest;
   try {
-    manifest = parseProjectContext(JSON.parse(readFileSync3(manifestPath, "utf8")));
+    manifest = parseProjectContext(JSON.parse(readFileSync4(manifestPath, "utf8")));
   } catch (cause) {
     return { ok: false, problems: [cause instanceof Error ? cause.message : String(cause)] };
   }
   const problems = [];
   for (const source of manifest.truth) {
-    if (!existsSync3(join3(root, source.path)))
+    if (!existsSync4(join3(root, source.path)))
       problems.push(`missing truth source: ${source.path}`);
   }
   for (const path of manifest.readFirst) {
-    if (!existsSync3(join3(root, path)))
+    if (!existsSync4(join3(root, path)))
       problems.push(`missing read-first file: ${path}`);
   }
   for (const file of projectContextFiles(manifest)) {
     const path = join3(root, file.path);
-    if (!existsSync3(path))
+    if (!existsSync4(path))
       problems.push(`missing generated adapter: ${file.path}`);
-    else if (readFileSync3(path, "utf8") !== file.content)
+    else if (readFileSync4(path, "utf8") !== file.content)
       problems.push(`drifted generated adapter: ${file.path}`);
   }
   return { ok: problems.length === 0, problems };
@@ -10157,7 +10199,7 @@ function checkProjectContext(rootInput) {
 
 // src/deploy-file.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
 import { basename, join as join4 } from "path";
 var DEPLOY_FILE = ".fz/deploy.json";
 var DEPLOY_TODO_PREFIX = "ForgeZero pipeline TODO:";
@@ -10178,17 +10220,17 @@ var safeName = (value) => {
 };
 function packageHints(root) {
   const packagePath = join4(root, "package.json");
-  if (!existsSync4(packagePath))
-    return { bun: existsSync4(join4(root, "bun.lock")) };
+  if (!existsSync5(packagePath))
+    return { bun: existsSync5(join4(root, "bun.lock")) };
   try {
-    const manifest = JSON.parse(readFileSync4(packagePath, "utf8"));
+    const manifest = JSON.parse(readFileSync5(packagePath, "utf8"));
     return {
       name: typeof manifest.name === "string" ? manifest.name : undefined,
       build: typeof manifest.scripts?.build === "string" ? ["bun", "run", "build"] : undefined,
-      bun: existsSync4(join4(root, "bun.lock")) || existsSync4(join4(root, "bun.lockb"))
+      bun: existsSync5(join4(root, "bun.lock")) || existsSync5(join4(root, "bun.lockb"))
     };
   } catch {
-    return { bun: existsSync4(join4(root, "bun.lock")) };
+    return { bun: existsSync5(join4(root, "bun.lock")) };
   }
 }
 var blocker = (instruction) => ["fz-agent", "pipeline-todo", `${DEPLOY_TODO_PREFIX} ${instruction}`];
@@ -10225,9 +10267,9 @@ function defaultDeployFile(root, options = {}) {
 }
 function inspectDeployFile(root, options = {}) {
   const path = join4(root, DEPLOY_FILE);
-  if (!existsSync4(path))
+  if (!existsSync5(path))
     throw new Error(`${DEPLOY_FILE} does not exist; run \`fz deploy init\`.`);
-  const raw = JSON.parse(readFileSync4(path, "utf8"));
+  const raw = JSON.parse(readFileSync5(path, "utf8"));
   const definition = parseDeployDefinition(raw, options);
   const problems = definition.steps.filter((step2) => step2.exec.some((argument) => argument.includes(DEPLOY_TODO_PREFIX))).map((step2) => `${step2.name} still contains the safe initialization blocker`);
   const profiles = Object.keys(definition.profiles).sort();
@@ -10251,17 +10293,1060 @@ function inspectDeployFile(root, options = {}) {
 }
 function initializeDeployFile(root, options = {}) {
   const path = join4(root, DEPLOY_FILE);
-  if (existsSync4(path) && !options.force) {
+  if (existsSync5(path) && !options.force) {
     throw new Error(`${DEPLOY_FILE} already exists; use --force only when replacing it deliberately.`);
   }
   const raw = defaultDeployFile(root, options);
   parseDeployDefinition(raw, { channel: options.channel });
-  mkdirSync4(join4(root, ".fz"), { recursive: true });
-  writeFileSync4(path, `${JSON.stringify(raw, null, 2)}
+  mkdirSync5(join4(root, ".fz"), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(raw, null, 2)}
 `, { mode: 420 });
   return inspectDeployFile(root, { channel: options.channel });
 }
 
+// src/deploy-compiler.ts
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync6, readFileSync as readFileSync6, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, isAbsolute, relative, resolve as resolve4, sep as sep3 } from "path";
+import { pathToFileURL } from "url";
+
+// src/deploy-plan.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/deploy-actions.ts
+var row = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${where} must be an object`);
+  return value;
+};
+var exact = (value, keys, where) => {
+  const unknown = Object.keys(value).filter((key) => !keys.includes(key));
+  if (unknown.length)
+    throw new Error(`${where} contains unknown field(s): ${unknown.join(", ")}`);
+  for (const key of keys)
+    if (value[key] === undefined)
+      throw new Error(`${where} requires ${key}`);
+};
+var component = (value, components, where) => {
+  if (typeof value !== "string" || !components[value])
+    throw new Error(`${where}.component must name an existing component`);
+  return components[value];
+};
+var exactArgv = (value, where) => {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 256 || value.some((entry) => typeof entry !== "string" || entry.length < 1 || entry.length > 16384 || entry.includes("\x00")))
+    throw new Error(`${where} requires a bounded exact argv array`);
+  const executable = value[0].split("/").at(-1).toLowerCase();
+  if (["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"].includes(executable))
+    throw new Error(`${where} cannot invoke a command dispatcher`);
+};
+function validateBuiltInAction(definition, context, where) {
+  if (!definition.uses.startsWith("forgezero."))
+    return;
+  const withValue = row(definition.with, `${where}.with`);
+  if (definition.uses === "forgezero.software/ensure@1") {
+    exact(withValue, ["requirements"], `${where}.with`);
+    if (!Array.isArray(withValue.requirements) || withValue.requirements.length < 1 || withValue.requirements.length > 64 || withValue.requirements.some((name) => typeof name !== "string" || !context.requirements[name]))
+      throw new Error(`${where}.with.requirements must name existing requirements`);
+    return;
+  }
+  if (definition.uses === "forgezero.exec/argv@1") {
+    const allowed = ["component", "argv", "credentials"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    component(withValue.component, context.components, `${where}.with`);
+    exactArgv(withValue.argv, `${where}.with.argv`);
+    if (withValue.credentials !== undefined) {
+      const bindings = row(withValue.credentials, `${where}.with.credentials`);
+      for (const [environment, credentialName] of Object.entries(bindings))
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(environment) || typeof credentialName !== "string" || !context.credentials[credentialName])
+          throw new Error(`${where}.with.credentials contains an invalid binding`);
+    }
+    return;
+  }
+  if (["forgezero.oci/build@1", "forgezero.oci/pull@1"].includes(definition.uses)) {
+    const allowed = definition.uses.endsWith("/build@1") ? ["component", "noCache"] : ["component"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    const selected = component(withValue.component, context.components, `${where}.with`);
+    if (selected.kind !== "application" || selected.runtime.kind !== "container")
+      throw new Error(`${where}.with.component must use a container runtime`);
+    if (withValue.noCache !== undefined && typeof withValue.noCache !== "boolean")
+      throw new Error(`${where}.with.noCache must be a boolean`);
+    return;
+  }
+  if (["forgezero.service/deploy@1", "forgezero.service/promote@1", "forgezero.health/http@1", "forgezero.storage/verify@1"].includes(definition.uses)) {
+    const allowed = definition.uses === "forgezero.service/deploy@1" || definition.uses === "forgezero.service/promote@1" ? ["component", "imageDigest"] : ["component"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    component(withValue.component, context.components, `${where}.with`);
+    return;
+  }
+  throw new Error(`${where}.uses is an unknown ForgeZero action`);
+}
+// src/deploy-providers.ts
+var plain = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var exact2 = (row2, keys, provider) => {
+  const unknown = Object.keys(row2).filter((key) => !keys.includes(key));
+  if (unknown.length)
+    throw new Error(`${provider} config contains unknown field(s): ${unknown.join(", ")}`);
+  for (const key of keys)
+    if (row2[key] === undefined)
+      throw new Error(`${provider} config requires ${key}`);
+};
+var absolute = (value) => typeof value === "string" && /^\/(?:[A-Za-z0-9._-]+\/?)*$/.test(value) && !value.includes("..");
+function validateBuiltInProvider(requirement2, where) {
+  const row2 = plain(requirement2.config);
+  if (!requirement2.provider.startsWith("forgezero."))
+    return;
+  const expected = {
+    "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
+    "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
+    "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
+  };
+  const contract = expected[requirement2.provider];
+  if (!contract)
+    throw new Error(`${where} uses unknown built-in provider ${requirement2.provider}`);
+  if (requirement2.contract !== 1 || requirement2.capability !== contract.capability || !contract.versions.includes(requirement2.version))
+    throw new Error(`${where} provider coordinate is unsupported`);
+  exact2(row2, contract.keys, requirement2.provider);
+  if (row2.installScope !== "host")
+    throw new Error(`${where}.config.installScope must be host`);
+  if (requirement2.provider === "forgezero.docker") {
+    if (row2.storageDriver !== "overlay2" || row2.dataRoot !== "/var/lib/docker" || row2.liveRestore !== true || row2.logDriver !== "local" || row2.defaultNetwork !== "bridge" || row2.rootless !== false)
+      throw new Error(`${where} Docker config is unsupported by the fixed host strategy`);
+  }
+  if (requirement2.provider === "forgezero.nginx" && (typeof row2.websocket !== "boolean" || !Number.isInteger(row2.maximumBodyMiB) || Number(row2.maximumBodyMiB) < 1 || Number(row2.maximumBodyMiB) > 1024 || !(row2.workerProcesses === "auto" || Number.isInteger(row2.workerProcesses)) || !Number.isInteger(row2.workerConnections)))
+    throw new Error(`${where} Nginx config is invalid`);
+  if (requirement2.provider === "forgezero.arangodb" && (row2.runtime !== "native" || !absolute(row2.dataPath) || row2.bind !== "private"))
+    throw new Error(`${where} ArangoDB config is invalid`);
+}
+
+// src/deploy-plan.ts
+var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
+var DEPLOY_PLAN_VERSION = 1;
+
+class DeploymentPlanError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeploymentPlanError";
+  }
+}
+var NAME3 = /^[a-z][A-Za-z0-9-]{0,62}$/;
+var COORDINATE = /^[a-z][a-z0-9.-]{0,127}$/;
+var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
+var VERSION3 = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
+var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
+var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+var fail2 = (where, message) => {
+  throw new DeploymentPlanError(`${where} ${message}`);
+};
+var object = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail2(where, "must be an object.");
+  return value;
+};
+var exact3 = (value, allowed, where) => {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    fail2(where, `contains unknown field(s): ${unknown.join(", ")}.`);
+};
+var named = (value, where) => {
+  if (typeof value !== "string" || !NAME3.test(value))
+    fail2(where, "must be a lowercase typed name.");
+  return value;
+};
+var boundedString = (value, where, maximum = 256) => {
+  if (typeof value !== "string" || value.length < 1 || value.length > maximum || value.includes("\x00"))
+    fail2(where, `must be a non-empty string of at most ${maximum} characters.`);
+  return value;
+};
+var integer = (value, where, minimum, maximum) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum)
+    fail2(where, `must be an integer from ${minimum} to ${maximum}.`);
+  return value;
+};
+var number = (value, where, minimum, maximum) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < minimum || value > maximum)
+    fail2(where, `must be a finite number from ${minimum} to ${maximum}.`);
+  return value;
+};
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new DeploymentPlanError("deployment data contains a non-finite number.");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+  }
+  throw new DeploymentPlanError("deployment data must contain only plain JSON values.");
+}
+function deploymentSourceDigest(source) {
+  return `sha256:${createHash2("sha256").update(canonicalJson(source)).digest("hex")}`;
+}
+function reference(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["$ref"], where);
+  const coordinate = boundedString(row2.$ref, `${where}.$ref`, 256);
+  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62})$/.test(coordinate)) {
+    fail2(where, "contains an unsupported reference.");
+  }
+  return { $ref: coordinate };
+}
+function operand(value, where) {
+  if (value === null || ["string", "number", "boolean"].includes(typeof value)) {
+    if (typeof value === "number" && !Number.isFinite(value))
+      fail2(where, "must be finite.");
+    return value;
+  }
+  return reference(value, where);
+}
+function condition(value, where, depth = 0) {
+  if (depth > 16)
+    fail2(where, "is nested too deeply.");
+  const row2 = object(value, where);
+  if (Object.keys(row2).length !== 1)
+    fail2(where, "must contain exactly one operator.");
+  const [operator, body] = Object.entries(row2)[0];
+  if (operator === "all" || operator === "any") {
+    if (!Array.isArray(body) || body.length < 1 || body.length > 32)
+      fail2(where, `${operator} must contain 1 to 32 conditions.`);
+    const entries = body;
+    return { [operator]: entries.map((entry, index) => condition(entry, `${where}.${operator}[${index}]`, depth + 1)) };
+  }
+  if (operator === "not")
+    return { not: condition(body, `${where}.not`, depth + 1) };
+  if (["equals", "notEquals", "greaterThan", "greaterThanOrEqual", "lessThan", "lessThanOrEqual", "contains", "startsWith"].includes(operator)) {
+    if (!Array.isArray(body) || body.length !== 2)
+      fail2(where, `${operator} must contain two operands.`);
+    const entries = body;
+    return { [operator]: [operand(entries[0], `${where}.${operator}[0]`), operand(entries[1], `${where}.${operator}[1]`)] };
+  }
+  if (operator === "exists")
+    return { exists: reference(body, `${where}.exists`) };
+  if (["succeeded", "failed", "changed"].includes(operator))
+    return { [operator]: named(body, `${where}.${operator}`) };
+  return fail2(where, `uses unsupported operator ${operator}.`);
+}
+function jsonValue(value, where, depth = 0) {
+  if (depth > 16)
+    fail2(where, "is nested too deeply.");
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      fail2(where, "must be finite.");
+    return value;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 1000)
+      fail2(where, "contains more than 1000 entries.");
+    return value.map((entry, index) => jsonValue(entry, `${where}[${index}]`, depth + 1));
+  }
+  const row2 = object(value, where);
+  if (Object.keys(row2).length > 1000)
+    fail2(where, "contains more than 1000 fields.");
+  return Object.fromEntries(Object.entries(row2).map(([key, entry]) => [key, jsonValue(entry, `${where}.${key}`, depth + 1)]));
+}
+function validateInput(value, where) {
+  const row2 = object(value, where);
+  const type = row2.type;
+  const common = ["type", "required", "default"];
+  if (row2.required !== undefined && typeof row2.required !== "boolean")
+    fail2(`${where}.required`, "must be a boolean.");
+  if (type === "string") {
+    exact3(row2, [...common, "minimumLength", "maximumLength", "pattern"], where);
+    if (row2.default !== undefined)
+      boundedString(row2.default, `${where}.default`, 16384);
+    if (row2.minimumLength !== undefined)
+      integer(row2.minimumLength, `${where}.minimumLength`, 0, 16384);
+    if (row2.maximumLength !== undefined)
+      integer(row2.maximumLength, `${where}.maximumLength`, 1, 16384);
+    if (row2.pattern !== undefined) {
+      const pattern = boundedString(row2.pattern, `${where}.pattern`, 512);
+      try {
+        new RegExp(pattern);
+      } catch {
+        fail2(`${where}.pattern`, "must be a valid regular expression.");
+      }
+    }
+  } else if (type === "integer" || type === "number") {
+    exact3(row2, [...common, "minimum", "maximum"], where);
+    if (row2.default !== undefined)
+      number(row2.default, `${where}.default`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (row2.minimum !== undefined)
+      number(row2.minimum, `${where}.minimum`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (row2.maximum !== undefined)
+      number(row2.maximum, `${where}.maximum`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (type === "integer" && row2.default !== undefined && !Number.isInteger(row2.default))
+      fail2(`${where}.default`, "must be an integer.");
+  } else if (type === "boolean") {
+    exact3(row2, common, where);
+    if (row2.default !== undefined && typeof row2.default !== "boolean")
+      fail2(`${where}.default`, "must be a boolean.");
+  } else if (type === "enum") {
+    exact3(row2, [...common, "values"], where);
+    if (!Array.isArray(row2.values) || row2.values.length < 1 || row2.values.length > 64)
+      fail2(`${where}.values`, "must contain 1 to 64 values.");
+    const values = row2.values.map((entry, index) => boundedString(entry, `${where}.values[${index}]`, 128));
+    if (new Set(values).size !== values.length)
+      fail2(`${where}.values`, "must be unique.");
+    if (row2.default !== undefined && !values.includes(row2.default))
+      fail2(`${where}.default`, "must be an enum value.");
+  } else if (type === "hostname") {
+    exact3(row2, common, where);
+    if (row2.default !== undefined && !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(String(row2.default)))
+      fail2(`${where}.default`, "must be a hostname.");
+  } else
+    fail2(`${where}.type`, "is unsupported.");
+  return row2;
+}
+function validateRequirement(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["capability", "provider", "contract", "version", "config", "when"], where);
+  if (!COORDINATE.test(String(row2.capability)))
+    fail2(`${where}.capability`, "is invalid.");
+  if (!COORDINATE.test(String(row2.provider)))
+    fail2(`${where}.provider`, "is invalid.");
+  integer(row2.contract, `${where}.contract`, 1, 65535);
+  if (typeof row2.version !== "string" || !VERSION3.test(row2.version))
+    fail2(`${where}.version`, "is invalid.");
+  jsonValue(row2.config, `${where}.config`);
+  if (row2.when !== undefined)
+    condition(row2.when, `${where}.when`);
+  const requirement2 = row2;
+  validateBuiltInProvider(requirement2, where);
+  return requirement2;
+}
+function validateArgv(value, where) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 256)
+    fail2(where, "must contain 1 to 256 arguments.");
+  let bytes = 0;
+  const values = value.map((entry, index) => {
+    const result = boundedString(entry, `${where}[${index}]`, 16384);
+    bytes += Buffer.byteLength(result);
+    return result;
+  });
+  if (bytes > 64 * 1024)
+    fail2(where, "is larger than 64 KiB.");
+  const executable = values[0].split("/").at(-1).toLowerCase();
+  if (["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"].includes(executable))
+    fail2(`${where}[0]`, "may not invoke a command dispatcher.");
+  return values;
+}
+function validateResources(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["cpu", "memory", "pids", "io"], where);
+  if (row2.cpu !== undefined) {
+    const cpu = object(row2.cpu, `${where}.cpu`);
+    exact3(cpu, ["limit", "weight", "pinning"], `${where}.cpu`);
+    number(cpu.limit, `${where}.cpu.limit`, 0.01, 1024);
+    if (cpu.weight !== undefined)
+      integer(cpu.weight, `${where}.cpu.weight`, 1, 1e4);
+    if (cpu.pinning !== undefined && !["automatic", "dedicated"].includes(String(cpu.pinning)))
+      fail2(`${where}.cpu.pinning`, "is unsupported.");
+  }
+  if (row2.memory !== undefined) {
+    const memory = object(row2.memory, `${where}.memory`);
+    exact3(memory, ["limitMiB", "reservationMiB", "swap"], `${where}.memory`);
+    integer(memory.limitMiB, `${where}.memory.limitMiB`, 16, 16777216);
+    if (memory.reservationMiB !== undefined && integer(memory.reservationMiB, `${where}.memory.reservationMiB`, 1, memory.limitMiB) > memory.limitMiB)
+      fail2(`${where}.memory.reservationMiB`, "must not exceed limitMiB.");
+    if (memory.swap !== undefined && !["disabled", "bounded"].includes(String(memory.swap)))
+      fail2(`${where}.memory.swap`, "is unsupported.");
+  }
+  if (row2.pids !== undefined) {
+    const pids = object(row2.pids, `${where}.pids`);
+    exact3(pids, ["limit"], `${where}.pids`);
+    integer(pids.limit, `${where}.pids.limit`, 1, 1048576);
+  }
+  if (row2.io !== undefined) {
+    const io = object(row2.io, `${where}.io`);
+    exact3(io, ["weight", "readBps", "writeBps", "readIops", "writeIops"], `${where}.io`);
+    for (const key of Object.keys(io))
+      integer(io[key], `${where}.io.${key}`, 1, Number.MAX_SAFE_INTEGER);
+  }
+}
+function validateStorage(value, where) {
+  const row2 = object(value, where);
+  if (row2.class === "ephemeral") {
+    exact3(row2, ["class", "path", "type", "sizeMiB"], where);
+    if (row2.type !== "tmpfs")
+      fail2(`${where}.type`, "must be tmpfs.");
+    integer(row2.sizeMiB, `${where}.sizeMiB`, 1, 1048576);
+  } else if (row2.class === "persistent") {
+    exact3(row2, ["class", "name", "path", "minimumFreePercent"], where);
+    named(row2.name, `${where}.name`);
+    if (row2.minimumFreePercent !== undefined)
+      integer(row2.minimumFreePercent, `${where}.minimumFreePercent`, 1, 95);
+  } else if (row2.class === "database") {
+    exact3(row2, ["class", "name", "path", "minimumFreePercent", "minimumIops", "latencyTargetMs"], where);
+    named(row2.name, `${where}.name`);
+    integer(row2.minimumFreePercent, `${where}.minimumFreePercent`, 1, 95);
+    if (row2.minimumIops !== undefined)
+      integer(row2.minimumIops, `${where}.minimumIops`, 1, 1e8);
+    if (row2.latencyTargetMs !== undefined)
+      number(row2.latencyTargetMs, `${where}.latencyTargetMs`, 0.01, 60000);
+  } else
+    fail2(`${where}.class`, "is unsupported.");
+  if (typeof row2.path !== "string" || !ABSOLUTE_PATH.test(row2.path) || row2.path.includes(".."))
+    fail2(`${where}.path`, "must be a normalized absolute path.");
+}
+function validateNetwork(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["ingress", "private", "public", "container"], where);
+  if (row2.ingress !== undefined) {
+    const ingress = object(row2.ingress, `${where}.ingress`);
+    exact3(ingress, ["exposure", "stablePort"], `${where}.ingress`);
+    if (!["loopback", "private", "public"].includes(String(ingress.exposure)))
+      fail2(`${where}.ingress.exposure`, "is unsupported.");
+    if (ingress.stablePort !== undefined)
+      integer(ingress.stablePort, `${where}.ingress.stablePort`, 1, 65535);
+  }
+  if (row2.private !== undefined) {
+    const privateNetwork = object(row2.private, `${where}.private`);
+    exact3(privateNetwork, ["mode", "preferences"], `${where}.private`);
+    if (!["private-lan", "cloudflare-warp", "auto"].includes(String(privateNetwork.mode)))
+      fail2(`${where}.private.mode`, "is unsupported.");
+    if (privateNetwork.preferences !== undefined && (!Array.isArray(privateNetwork.preferences) || privateNetwork.preferences.length < 1 || privateNetwork.preferences.length > 2 || privateNetwork.preferences.some((entry) => !["private-lan", "cloudflare-warp"].includes(String(entry))) || new Set(privateNetwork.preferences).size !== privateNetwork.preferences.length))
+      fail2(`${where}.private.preferences`, "is invalid.");
+  }
+  if (row2.public !== undefined) {
+    const publicNetwork = object(row2.public, `${where}.public`);
+    exact3(publicNetwork, ["mode", "optional"], `${where}.public`);
+    if (!["disabled", "cloudflare-tunnel"].includes(String(publicNetwork.mode)))
+      fail2(`${where}.public.mode`, "is unsupported.");
+    if (publicNetwork.optional !== undefined && typeof publicNetwork.optional !== "boolean")
+      fail2(`${where}.public.optional`, "must be a boolean.");
+  }
+  if (row2.container !== undefined) {
+    const container = object(row2.container, `${where}.container`);
+    exact3(container, ["mode", "network"], `${where}.container`);
+    if (!["bridge", "host"].includes(String(container.mode)))
+      fail2(`${where}.container.mode`, "is unsupported.");
+    if (container.network !== undefined)
+      named(container.network, `${where}.container.network`);
+  }
+}
+function validateComponent(value, where, targetNames, requirements) {
+  const row2 = object(value, where);
+  if (!targetNames.has(String(row2.target)))
+    fail2(`${where}.target`, "must name an existing target.");
+  if (row2.kind === "application") {
+    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    const runtime = object(row2.runtime, `${where}.runtime`);
+    const runtimeRequirement = requirements.get(String(runtime.requirement));
+    if (!runtimeRequirement)
+      fail2(`${where}.runtime.requirement`, "must name an existing requirement.");
+    if (runtime.kind === "native") {
+      exact3(runtime, ["kind", "provider", "requirement", "argv"], `${where}.runtime`);
+      validateArgv(runtime.argv, `${where}.runtime.argv`);
+    } else if (runtime.kind === "container") {
+      exact3(runtime, ["kind", "provider", "requirement", "image", "entrypoint", "security"], `${where}.runtime`);
+      const image = object(runtime.image, `${where}.runtime.image`);
+      exact3(image, ["source"], `${where}.runtime.image`);
+      const source = object(image.source, `${where}.runtime.image.source`);
+      if (source.kind === "build") {
+        exact3(source, ["kind", "context", "dockerfile"], `${where}.runtime.image.source`);
+        boundedString(source.context, `${where}.runtime.image.source.context`, 512);
+        boundedString(source.dockerfile, `${where}.runtime.image.source.dockerfile`, 512);
+      } else if (source.kind === "registry") {
+        exact3(source, ["kind", "reference"], `${where}.runtime.image.source`);
+        if (!/^[-a-zA-Z0-9./:_@]+$/.test(boundedString(source.reference, `${where}.runtime.image.source.reference`, 512)))
+          fail2(`${where}.runtime.image.source.reference`, "is invalid.");
+      } else
+        fail2(`${where}.runtime.image.source.kind`, "is unsupported.");
+      if (runtime.entrypoint !== undefined)
+        validateArgv(runtime.entrypoint, `${where}.runtime.entrypoint`);
+      const security = object(runtime.security, `${where}.runtime.security`);
+      exact3(security, ["privileged", "noNewPrivileges", "root", "dropCapabilities"], `${where}.runtime.security`);
+      if (security.privileged !== false || security.noNewPrivileges !== true)
+        fail2(`${where}.runtime.security`, "must disable privileged mode and enable noNewPrivileges.");
+      if (!["read-only", "writable"].includes(String(security.root)))
+        fail2(`${where}.runtime.security.root`, "is unsupported.");
+      if (!Array.isArray(security.dropCapabilities) || !security.dropCapabilities.includes("ALL"))
+        fail2(`${where}.runtime.security.dropCapabilities`, "must include ALL.");
+    } else
+      fail2(`${where}.runtime.kind`, "is unsupported.");
+    if (!COORDINATE.test(String(runtime.provider)))
+      fail2(`${where}.runtime.provider`, "is invalid.");
+    if (runtimeRequirement && runtime.provider !== runtimeRequirement.provider)
+      fail2(`${where}.runtime.provider`, "must match its requirement provider.");
+    if (runtimeRequirement && runtime.kind === "container" && runtimeRequirement.capability !== "runtime.container")
+      fail2(`${where}.runtime.requirement`, "must provide runtime.container.");
+    if (runtimeRequirement && runtime.kind === "native" && !runtimeRequirement.capability.startsWith("runtime."))
+      fail2(`${where}.runtime.requirement`, "must provide a runtime capability.");
+    const service = object(row2.service, `${where}.service`);
+    exact3(service, ["protocol", "port", "health", "websocket", "maximumConnections"], `${where}.service`);
+    if (service.protocol !== "http")
+      fail2(`${where}.service.protocol`, "must be http.");
+    integer(service.port, `${where}.service.port`, 1, 65535);
+    const health = object(service.health, `${where}.service.health`);
+    exact3(health, ["protocol", "method", "path", "expectedStatus", "timeoutMs", "intervalMs", "attempts"], `${where}.service.health`);
+    if (health.protocol !== "http" || !["GET", "HEAD"].includes(String(health.method)) || typeof health.path !== "string" || !HEALTH_PATH.test(health.path) || health.path.includes("..") || health.path.includes("//"))
+      fail2(`${where}.service.health`, "is invalid.");
+    if (!Array.isArray(health.expectedStatus) || health.expectedStatus.length < 1 || health.expectedStatus.length > 16 || health.expectedStatus.some((status) => !Number.isInteger(status) || status < 100 || status > 599))
+      fail2(`${where}.service.health.expectedStatus`, "is invalid.");
+    integer(health.timeoutMs, `${where}.service.health.timeoutMs`, 100, 300000);
+    if (health.intervalMs !== undefined)
+      integer(health.intervalMs, `${where}.service.health.intervalMs`, 100, 300000);
+    if (health.attempts !== undefined)
+      integer(health.attempts, `${where}.service.health.attempts`, 1, 1000);
+    if (service.websocket !== undefined && typeof service.websocket !== "boolean")
+      fail2(`${where}.service.websocket`, "must be a boolean.");
+    if (service.maximumConnections !== undefined)
+      integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    validateResources(row2.resources, `${where}.resources`);
+    if (runtime.kind === "container") {
+      const resources = object(row2.resources, `${where}.resources`);
+      for (const required of ["cpu", "memory", "pids"])
+        if (resources[required] === undefined)
+          fail2(`${where}.resources.${required}`, "is required for a bounded container.");
+      if (row2.network === undefined)
+        fail2(`${where}.network`, "is required for a container.");
+      const network = object(row2.network, `${where}.network`);
+      if (network.container === undefined)
+        fail2(`${where}.network.container`, "must select bridge or reviewed host networking.");
+    }
+    if (row2.storage !== undefined) {
+      if (!Array.isArray(row2.storage) || row2.storage.length > 32)
+        fail2(`${where}.storage`, "must contain at most 32 mounts.");
+      row2.storage.forEach((entry, index) => validateStorage(entry, `${where}.storage[${index}]`));
+    }
+    if (row2.network !== undefined)
+      validateNetwork(row2.network, `${where}.network`);
+    const rollout = object(row2.rollout, `${where}.rollout`);
+    exact3(rollout, ["strategy", "proxy", "drainMs", "automaticRollback"], `${where}.rollout`);
+    if (!["direct", "blue-green", "rolling", "canary"].includes(String(rollout.strategy)))
+      fail2(`${where}.rollout.strategy`, "is unsupported.");
+    if (rollout.proxy !== undefined)
+      named(rollout.proxy, `${where}.rollout.proxy`);
+    if (rollout.strategy !== "direct") {
+      const proxyRequirement = requirements.get(String(rollout.proxy));
+      if (!proxyRequirement || proxyRequirement.capability !== "proxy.http")
+        fail2(`${where}.rollout.proxy`, "must name a proxy.http requirement for managed rollout.");
+    }
+    if (rollout.drainMs !== undefined)
+      integer(rollout.drainMs, `${where}.rollout.drainMs`, 0, 600000);
+    if (rollout.automaticRollback !== undefined && typeof rollout.automaticRollback !== "boolean")
+      fail2(`${where}.rollout.automaticRollback`, "must be a boolean.");
+  } else if (row2.kind === "database") {
+    exact3(row2, ["kind", "target", "runtime", "topology", "resources", "storage", "network"], where);
+    const runtime = object(row2.runtime, `${where}.runtime`);
+    exact3(runtime, ["provider", "requirement", "mode"], `${where}.runtime`);
+    const databaseRequirement = requirements.get(String(runtime.requirement));
+    if (!databaseRequirement)
+      fail2(`${where}.runtime.requirement`, "must name an existing requirement.");
+    if (databaseRequirement && (runtime.provider !== databaseRequirement.provider || databaseRequirement.capability !== "database.arangodb"))
+      fail2(`${where}.runtime.requirement`, "must match a database.arangodb provider requirement.");
+    if (databaseRequirement && databaseRequirement.config.runtime !== runtime.mode)
+      fail2(`${where}.runtime.mode`, "must match the provider runtime mode.");
+    if (runtime.mode !== "native")
+      fail2(`${where}.runtime.mode`, "must be native in deployment plan v1.");
+    const topology = object(row2.topology, `${where}.topology`);
+    if (topology.mode === "standalone")
+      exact3(topology, ["mode"], `${where}.topology`);
+    else if (topology.mode === "cluster") {
+      exact3(topology, ["mode", "bootstrapMembers", "replicationFactor", "writeConcern", "additionalJoiners"], `${where}.topology`);
+      integer(topology.bootstrapMembers, `${where}.topology.bootstrapMembers`, 3, 9);
+      integer(topology.replicationFactor, `${where}.topology.replicationFactor`, 1, 16);
+      integer(topology.writeConcern, `${where}.topology.writeConcern`, 1, topology.replicationFactor);
+      if (!["allowed", "disabled"].includes(String(topology.additionalJoiners)))
+        fail2(`${where}.topology.additionalJoiners`, "is unsupported.");
+    } else
+      fail2(`${where}.topology.mode`, "is unsupported.");
+    if (row2.resources !== undefined)
+      validateResources(row2.resources, `${where}.resources`);
+    validateStorage(row2.storage, `${where}.storage`);
+    if (row2.storage.class !== "database")
+      fail2(`${where}.storage.class`, "must be database.");
+    validateNetwork(row2.network, `${where}.network`);
+  } else
+    fail2(`${where}.kind`, "is unsupported.");
+  return row2;
+}
+function validateStep(value, where, targets, context) {
+  const row2 = object(value, where);
+  exact3(row2, ["uses", "with", "if", "scope", "timeoutMs", "retry", "failure", "compensate"], where);
+  if (typeof row2.uses !== "string" || !ACTION.test(row2.uses))
+    fail2(`${where}.uses`, "must be a versioned action coordinate.");
+  jsonValue(row2.with, `${where}.with`);
+  if (row2.if !== undefined)
+    condition(row2.if, `${where}.if`);
+  const scope = object(row2.scope, `${where}.scope`);
+  if (scope.kind === "release-executor")
+    exact3(scope, ["kind"], `${where}.scope`);
+  else if (scope.kind === "elected-one") {
+    exact3(scope, ["kind", "group"], `${where}.scope`);
+    named(scope.group, `${where}.scope.group`);
+  } else if (scope.kind === "each-target") {
+    exact3(scope, ["kind", "target"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail2(`${where}.scope.target`, "must name an existing target.");
+  } else if (scope.kind === "target-batches") {
+    exact3(scope, ["kind", "target", "size"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail2(`${where}.scope.target`, "must name an existing target.");
+    integer(scope.size, `${where}.scope.size`, 1, 32);
+  } else
+    fail2(`${where}.scope.kind`, "is unsupported.");
+  if (row2.timeoutMs !== undefined)
+    integer(row2.timeoutMs, `${where}.timeoutMs`, 1, 86400000);
+  if (row2.retry !== undefined) {
+    const retry = object(row2.retry, `${where}.retry`);
+    exact3(retry, ["attempts", "backoff", "retryOn"], `${where}.retry`);
+    integer(retry.attempts, `${where}.retry.attempts`, 1, 20);
+    const backoff = object(retry.backoff, `${where}.retry.backoff`);
+    exact3(backoff, ["kind", "initialMs", "maximumMs"], `${where}.retry.backoff`);
+    if (!["fixed", "linear", "exponential"].includes(String(backoff.kind)))
+      fail2(`${where}.retry.backoff.kind`, "is unsupported.");
+    integer(backoff.initialMs, `${where}.retry.backoff.initialMs`, 0, 300000);
+    integer(backoff.maximumMs, `${where}.retry.backoff.maximumMs`, backoff.initialMs, 3600000);
+    if (retry.retryOn !== undefined && (!Array.isArray(retry.retryOn) || retry.retryOn.length > 8 || retry.retryOn.some((entry) => !["network", "timeout", "provider-unavailable", "rate-limited", "conflict"].includes(String(entry))) || new Set(retry.retryOn).size !== retry.retryOn.length))
+      fail2(`${where}.retry.retryOn`, "is invalid.");
+  }
+  if (row2.failure !== undefined) {
+    const failure = object(row2.failure, `${where}.failure`);
+    exact3(failure, ["policy"], `${where}.failure`);
+    if (!["continue", "stop", "rollback-stage", "rollback-deployment", "compensate", "manual-intervention"].includes(String(failure.policy)))
+      fail2(`${where}.failure.policy`, "is unsupported.");
+  }
+  if (row2.compensate !== undefined) {
+    const compensate = object(row2.compensate, `${where}.compensate`);
+    exact3(compensate, ["uses", "with"], `${where}.compensate`);
+    if (typeof compensate.uses !== "string" || !ACTION.test(compensate.uses))
+      fail2(`${where}.compensate.uses`, "must be a versioned action coordinate.");
+    jsonValue(compensate.with, `${where}.compensate.with`);
+    if (row2.failure?.policy !== "compensate")
+      fail2(`${where}.compensate`, "requires failure.policy compensate.");
+  }
+  const definition = row2;
+  validateBuiltInAction(definition, context, where);
+  if (definition.compensate)
+    validateBuiltInAction({ uses: definition.compensate.uses, with: definition.compensate.with, scope: definition.scope }, context, `${where}.compensate`);
+  return definition;
+}
+function topologicalStages(stages, workflow) {
+  const names = Object.keys(stages);
+  const nameSet = new Set(names);
+  for (const name of names)
+    for (const dependency of stages[name].dependsOn ?? []) {
+      if (!nameSet.has(dependency))
+        fail2(`workflows.${workflow}.stages.${name}.dependsOn`, `names missing stage ${dependency}.`);
+      if (dependency === name)
+        fail2(`workflows.${workflow}.stages.${name}.dependsOn`, "cannot depend on itself.");
+    }
+  const visiting = new Set;
+  const visited = new Set;
+  const ordered = [];
+  const visit = (name) => {
+    if (visiting.has(name))
+      fail2(`workflows.${workflow}.stages`, "contains a dependency cycle.");
+    if (visited.has(name))
+      return;
+    visiting.add(name);
+    for (const dependency of stages[name].dependsOn ?? [])
+      visit(dependency);
+    visiting.delete(name);
+    visited.add(name);
+    ordered.push(name);
+  };
+  for (const name of names.sort())
+    visit(name);
+  return ordered;
+}
+function validateStage(value, where, targets, context) {
+  const row2 = object(value, where);
+  exact3(row2, ["dependsOn", "if", "strategy", "steps"], where);
+  if (row2.dependsOn !== undefined && (!Array.isArray(row2.dependsOn) || row2.dependsOn.length > 64 || row2.dependsOn.some((entry) => typeof entry !== "string" || !NAME3.test(entry)) || new Set(row2.dependsOn).size !== row2.dependsOn.length))
+    fail2(`${where}.dependsOn`, "is invalid.");
+  if (row2.if !== undefined)
+    condition(row2.if, `${where}.if`);
+  const strategy = object(row2.strategy, `${where}.strategy`);
+  exact3(strategy, ["mode", "maximumConcurrency", "batchSize", "minimumHealthy", "increments", "observationMs"], `${where}.strategy`);
+  if (!["sequential", "parallel", "rolling", "blue-green", "canary"].includes(String(strategy.mode)))
+    fail2(`${where}.strategy.mode`, "is unsupported.");
+  if (strategy.maximumConcurrency !== undefined)
+    integer(strategy.maximumConcurrency, `${where}.strategy.maximumConcurrency`, 1, 1024);
+  if (strategy.batchSize !== undefined)
+    integer(strategy.batchSize, `${where}.strategy.batchSize`, 1, 1024);
+  if (strategy.minimumHealthy !== undefined)
+    integer(strategy.minimumHealthy, `${where}.strategy.minimumHealthy`, 0, 1024);
+  if (strategy.increments !== undefined && (!Array.isArray(strategy.increments) || strategy.increments.length < 1 || strategy.increments.length > 20 || strategy.increments.some((entry) => !Number.isInteger(entry) || entry < 1 || entry > 100) || strategy.increments.at(-1) !== 100))
+    fail2(`${where}.strategy.increments`, "must end at 100 and contain bounded percentages.");
+  if (strategy.observationMs !== undefined)
+    integer(strategy.observationMs, `${where}.strategy.observationMs`, 1000, 86400000);
+  if (strategy.mode === "canary" && strategy.increments === undefined)
+    fail2(`${where}.strategy.increments`, "is required for canary mode.");
+  if (strategy.mode === "rolling" && strategy.batchSize === undefined)
+    fail2(`${where}.strategy.batchSize`, "is required for rolling mode.");
+  const steps = object(row2.steps, `${where}.steps`);
+  const entries = Object.entries(steps);
+  if (entries.length < 1 || entries.length > 256)
+    fail2(`${where}.steps`, "must contain 1 to 256 steps.");
+  for (const [name, stepValue] of entries) {
+    named(name, `${where}.steps key`);
+    validateStep(stepValue, `${where}.steps.${name}`, targets, context);
+  }
+  return row2;
+}
+function compileDeployment(sourceValue) {
+  const source = object(sourceValue, "deployment");
+  exact3(source, ["apiVersion", "kind", "metadata", "spec"], "deployment");
+  if (source.apiVersion !== "deploy.forgezero.net/v1")
+    fail2("deployment.apiVersion", "must be deploy.forgezero.net/v1.");
+  if (source.kind !== "Deployment")
+    fail2("deployment.kind", "must be Deployment.");
+  const metadata = object(source.metadata, "deployment.metadata");
+  exact3(metadata, ["name", "description"], "deployment.metadata");
+  const name = named(metadata.name, "deployment.metadata.name");
+  if (metadata.description !== undefined)
+    boundedString(metadata.description, "deployment.metadata.description", 1024);
+  const spec = object(source.spec, "deployment.spec");
+  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  if (spec.security !== undefined) {
+    const security = object(spec.security, "deployment.spec.security");
+    exact3(security, ["attestation"], "deployment.spec.security");
+    if (security.attestation !== undefined && !["required", "preferred", "disabled"].includes(String(security.attestation)))
+      fail2("deployment.spec.security.attestation", "is unsupported.");
+  }
+  const inputs = object(spec.inputs ?? {}, "deployment.spec.inputs");
+  if (Object.keys(inputs).length > 128)
+    fail2("deployment.spec.inputs", "contains more than 128 inputs.");
+  for (const [inputName, value] of Object.entries(inputs)) {
+    named(inputName, "deployment.spec.inputs key");
+    validateInput(value, `deployment.spec.inputs.${inputName}`);
+  }
+  const credentials = object(spec.credentials ?? {}, "deployment.spec.credentials");
+  if (Object.keys(credentials).length > 128)
+    fail2("deployment.spec.credentials", "contains more than 128 credentials.");
+  for (const [credentialName, value] of Object.entries(credentials)) {
+    named(credentialName, "deployment.spec.credentials key");
+    const credential = object(value, `deployment.spec.credentials.${credentialName}`);
+    exact3(credential, ["schema", "source"], `deployment.spec.credentials.${credentialName}`);
+    if (!ACTION.test(String(credential.schema)))
+      fail2(`deployment.spec.credentials.${credentialName}.schema`, "must be a versioned schema coordinate.");
+    const credentialSource = object(credential.source, `deployment.spec.credentials.${credentialName}.source`);
+    exact3(credentialSource, ["kind", "name", "fallback"], `deployment.spec.credentials.${credentialName}.source`);
+    if (!["vault", "systemd"].includes(String(credentialSource.kind)))
+      fail2(`deployment.spec.credentials.${credentialName}.source.kind`, "is unsupported.");
+    named(credentialSource.name, `deployment.spec.credentials.${credentialName}.source.name`);
+    if (credentialSource.fallback !== undefined && (credentialSource.kind !== "vault" || credentialSource.fallback !== "systemd"))
+      fail2(`deployment.spec.credentials.${credentialName}.source.fallback`, "may only be systemd behind Vault.");
+  }
+  const targets = object(spec.targets, "deployment.spec.targets");
+  const targetEntries = Object.entries(targets);
+  if (targetEntries.length < 1 || targetEntries.length > 64)
+    fail2("deployment.spec.targets", "must contain 1 to 64 targets.");
+  const targetNames = new Set(targetEntries.map(([targetName]) => named(targetName, "deployment.spec.targets key")));
+  for (const [targetName, value] of targetEntries) {
+    const target = object(value, `deployment.spec.targets.${targetName}`);
+    exact3(target, ["kind", "selector", "cardinality", "placement"], `deployment.spec.targets.${targetName}`);
+    if (target.kind !== "compute")
+      fail2(`deployment.spec.targets.${targetName}.kind`, "must be compute.");
+    const selector = object(target.selector, `deployment.spec.targets.${targetName}.selector`);
+    exact3(selector, ["profiles", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
+    if (!Array.isArray(selector.profiles) || selector.profiles.length < 1 || selector.profiles.length > 32 || selector.profiles.some((profile) => typeof profile !== "string" || !NAME3.test(profile)) || new Set(selector.profiles).size !== selector.profiles.length)
+      fail2(`deployment.spec.targets.${targetName}.selector.profiles`, "is invalid.");
+    if (selector.confidentialCompute !== undefined && !["required", "preferred", "disabled"].includes(String(selector.confidentialCompute)))
+      fail2(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "is unsupported.");
+    if (selector.labels !== undefined)
+      jsonValue(selector.labels, `deployment.spec.targets.${targetName}.selector.labels`);
+    const cardinality = object(target.cardinality, `deployment.spec.targets.${targetName}.cardinality`);
+    exact3(cardinality, ["minimum", "desired", "maximum"], `deployment.spec.targets.${targetName}.cardinality`);
+    const minimum = integer(cardinality.minimum, `deployment.spec.targets.${targetName}.cardinality.minimum`, 1, 1024);
+    const maximum = integer(cardinality.maximum, `deployment.spec.targets.${targetName}.cardinality.maximum`, minimum, 1024);
+    if (typeof cardinality.desired === "number")
+      integer(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`, minimum, maximum);
+    else
+      reference(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`);
+    if (target.placement !== undefined)
+      jsonValue(target.placement, `deployment.spec.targets.${targetName}.placement`);
+  }
+  const requirements = object(spec.requirements ?? {}, "deployment.spec.requirements");
+  if (Object.keys(requirements).length > 64)
+    fail2("deployment.spec.requirements", "contains more than 64 requirements.");
+  const requirementDefinitions = new Map;
+  const requiredProviders = new Map;
+  for (const [requirementName, value] of Object.entries(requirements)) {
+    named(requirementName, "deployment.spec.requirements key");
+    const requirementValue = validateRequirement(value, `deployment.spec.requirements.${requirementName}`);
+    requirementDefinitions.set(requirementName, requirementValue);
+    const key = `${requirementValue.provider}@${requirementValue.contract}:${requirementValue.capability}`;
+    requiredProviders.set(key, { provider: requirementValue.provider, contract: requirementValue.contract, capability: requirementValue.capability });
+  }
+  const components = object(spec.components, "deployment.spec.components");
+  const componentEntries = Object.entries(components);
+  if (componentEntries.length < 1 || componentEntries.length > 128)
+    fail2("deployment.spec.components", "must contain 1 to 128 components.");
+  for (const [componentName, value] of componentEntries) {
+    named(componentName, "deployment.spec.components key");
+    validateComponent(value, `deployment.spec.components.${componentName}`, targetNames, requirementDefinitions);
+  }
+  const actionContext = {
+    components,
+    requirements,
+    credentials
+  };
+  const workflows = object(spec.workflows, "deployment.spec.workflows");
+  const workflowEntries = Object.entries(workflows);
+  if (workflowEntries.length < 1 || workflowEntries.length > 32)
+    fail2("deployment.spec.workflows", "must contain 1 to 32 workflows.");
+  const plannedWorkflows = [];
+  for (const [workflowName, value] of workflowEntries.sort(([left], [right]) => left.localeCompare(right))) {
+    named(workflowName, "deployment.spec.workflows key");
+    const workflowValue = object(value, `deployment.spec.workflows.${workflowName}`);
+    exact3(workflowValue, ["concurrency", "stages"], `deployment.spec.workflows.${workflowName}`);
+    if (workflowValue.concurrency !== undefined) {
+      const concurrency = object(workflowValue.concurrency, `deployment.spec.workflows.${workflowName}.concurrency`);
+      exact3(concurrency, ["group", "limit"], `deployment.spec.workflows.${workflowName}.concurrency`);
+      boundedString(concurrency.group, `deployment.spec.workflows.${workflowName}.concurrency.group`, 256);
+      integer(concurrency.limit, `deployment.spec.workflows.${workflowName}.concurrency.limit`, 1, 1024);
+    }
+    const stages = object(workflowValue.stages, `deployment.spec.workflows.${workflowName}.stages`);
+    if (Object.keys(stages).length < 1 || Object.keys(stages).length > 64)
+      fail2(`deployment.spec.workflows.${workflowName}.stages`, "must contain 1 to 64 stages.");
+    for (const [stageName, stageValue] of Object.entries(stages)) {
+      named(stageName, `deployment.spec.workflows.${workflowName}.stages key`);
+      validateStage(stageValue, `deployment.spec.workflows.${workflowName}.stages.${stageName}`, targetNames, actionContext);
+    }
+    const stepIds = new Set;
+    const plannedStages = topologicalStages(stages, workflowName).map((stageName) => {
+      const stageValue = stages[stageName];
+      const plannedSteps = Object.entries(stageValue.steps).map(([stepName, stepValue]) => {
+        if (stepIds.has(stepName))
+          fail2(`deployment.spec.workflows.${workflowName}`, `contains duplicate step id ${stepName}.`);
+        stepIds.add(stepName);
+        return { id: stepName, ...stepValue };
+      });
+      return { id: stageName, ...stageValue.dependsOn ? { dependsOn: [...stageValue.dependsOn].sort() } : {}, ...stageValue.if ? { if: stageValue.if } : {}, strategy: stageValue.strategy, steps: plannedSteps };
+    });
+    plannedWorkflows.push({ id: workflowName, ...workflowValue.concurrency ? { concurrency: workflowValue.concurrency } : {}, stages: plannedStages });
+  }
+  const typedSource = source;
+  return {
+    format: DEPLOY_PLAN_FORMAT,
+    version: DEPLOY_PLAN_VERSION,
+    sourceDigest: deploymentSourceDigest(typedSource),
+    name,
+    ...metadata.description ? { description: metadata.description } : {},
+    requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
+    spec: {
+      ...spec.security ? { security: spec.security } : {},
+      inputs,
+      credentials,
+      targets,
+      requirements,
+      components,
+      workflows: plannedWorkflows
+    }
+  };
+}
+function deploymentPlanDigest(plan) {
+  return `sha256:${createHash2("sha256").update(canonicalJson(plan)).digest("hex")}`;
+}
+function parseDeploymentPlan(value) {
+  const row2 = object(value, "plan");
+  exact3(row2, ["format", "version", "sourceDigest", "name", "description", "requiredProviders", "spec"], "plan");
+  if (row2.format !== DEPLOY_PLAN_FORMAT || row2.version !== DEPLOY_PLAN_VERSION)
+    fail2("plan", "uses an unsupported format or version.");
+  if (typeof row2.sourceDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(row2.sourceDigest))
+    fail2("plan.sourceDigest", "is invalid.");
+  named(row2.name, "plan.name");
+  if (row2.description !== undefined)
+    boundedString(row2.description, "plan.description", 1024);
+  if (!Array.isArray(row2.requiredProviders) || row2.requiredProviders.length > 64)
+    fail2("plan.requiredProviders", "must be a bounded array.");
+  for (const [index, provider] of row2.requiredProviders.entries()) {
+    const item = object(provider, `plan.requiredProviders[${index}]`);
+    exact3(item, ["provider", "contract", "capability"], `plan.requiredProviders[${index}]`);
+    if (!COORDINATE.test(String(item.provider)) || !COORDINATE.test(String(item.capability)))
+      fail2(`plan.requiredProviders[${index}]`, "contains an invalid coordinate.");
+    integer(item.contract, `plan.requiredProviders[${index}].contract`, 1, 65535);
+  }
+  const spec = object(row2.spec, "plan.spec");
+  const workflows = spec.workflows;
+  if (!Array.isArray(workflows))
+    fail2("plan.spec.workflows", "must be an array.");
+  const sourceWorkflows = {};
+  for (const [workflowIndex, workflow] of workflows.entries()) {
+    const item = object(workflow, `plan.spec.workflows[${workflowIndex}]`);
+    exact3(item, ["id", "concurrency", "stages"], `plan.spec.workflows[${workflowIndex}]`);
+    const workflowId = named(item.id, `plan.spec.workflows[${workflowIndex}].id`);
+    if (sourceWorkflows[workflowId])
+      fail2("plan.spec.workflows", `contains duplicate workflow ${workflowId}.`);
+    if (!Array.isArray(item.stages))
+      fail2(`plan.spec.workflows[${workflowIndex}].stages`, "must be an array.");
+    const sourceStages = {};
+    for (const [stageIndex, stage] of item.stages.entries()) {
+      const stageItem = object(stage, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}]`);
+      exact3(stageItem, ["id", "dependsOn", "if", "strategy", "steps"], `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}]`);
+      const stageId = named(stageItem.id, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].id`);
+      if (sourceStages[stageId])
+        fail2(`plan.spec.workflows[${workflowIndex}].stages`, `contains duplicate stage ${stageId}.`);
+      if (!Array.isArray(stageItem.steps))
+        fail2(`plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps`, "must be an array.");
+      const sourceSteps = {};
+      for (const [stepIndex, step3] of stageItem.steps.entries()) {
+        const stepItem = object(step3, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps[${stepIndex}]`);
+        const stepId = named(stepItem.id, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps[${stepIndex}].id`);
+        if (sourceSteps[stepId])
+          fail2(`plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps`, `contains duplicate step ${stepId}.`);
+        const { id: _id3, ...stepWithoutId } = stepItem;
+        sourceSteps[stepId] = stepWithoutId;
+      }
+      const { id: _id2, steps: _steps, ...stageWithoutId } = stageItem;
+      sourceStages[stageId] = { ...stageWithoutId, steps: sourceSteps };
+    }
+    const { id: _id, stages: _stages, ...workflowWithoutId } = item;
+    sourceWorkflows[workflowId] = { ...workflowWithoutId, stages: sourceStages };
+  }
+  const { workflows: _workflows, ...specWithoutWorkflows } = spec;
+  const reconstructed = {
+    apiVersion: "deploy.forgezero.net/v1",
+    kind: "Deployment",
+    metadata: { name: row2.name, ...row2.description ? { description: row2.description } : {} },
+    spec: { ...specWithoutWorkflows, workflows: sourceWorkflows }
+  };
+  const compiled = compileDeployment(reconstructed);
+  return { ...compiled, sourceDigest: row2.sourceDigest };
+}
+
+// src/deploy-compiler.ts
+var DEPLOY_SOURCE_FILE = "forgezero.deploy.ts";
+var DEPLOY_PLAN_FILE = ".fz/deploy.plan.json";
+function safeName2(value) {
+  const result = value.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+  return /^[a-z]/.test(result) ? result : `app-${result || "service"}`;
+}
+function defaultTypeScriptDeployment(name) {
+  return `import { actions, application, defineDeployment, input, providers, stage, target, workflow } from '@forgezero/agent/deploy';
+
+export default defineDeployment({
+	apiVersion: 'deploy.forgezero.net/v1',
+	kind: 'Deployment',
+	metadata: { name: '${safeName2(name)}' },
+	spec: {
+		security: { attestation: 'preferred' },
+		inputs: { replicas: input.integer({ minimum: 1, maximum: 32, default: 1 }) },
+		targets: {
+			app: target.compute({
+				selector: { profiles: ['app'] },
+				cardinality: { minimum: 1, desired: input.ref('replicas'), maximum: 32 }
+			})
+		},
+		requirements: { bun: providers.bun.require() },
+		components: {
+			app: application({
+				target: 'app',
+				runtime: { kind: 'native', provider: 'forgezero.bun', requirement: 'bun', argv: ['/usr/local/bin/bun', 'run', 'start'] },
+				service: { protocol: 'http', port: 3000, health: { protocol: 'http', method: 'GET', path: '/health', expectedStatus: [200], timeoutMs: 5_000 } },
+				resources: {},
+				rollout: { strategy: 'direct' }
+			})
+		},
+		workflows: {
+			deploy: workflow({
+				stages: {
+					build: stage({ strategy: { mode: 'sequential' }, steps: {
+						build: actions.exec.argv(
+							{ component: 'app', argv: ['/usr/local/bin/fz-agent', 'pipeline-todo', 'replace with the project build argv'] },
+							{ scope: { kind: 'each-target', target: 'app' }, timeoutMs: 600_000 }
+						)
+					} }),
+					release: stage({ dependsOn: ['build'], strategy: { mode: 'sequential' }, steps: {
+						start: actions.exec.argv(
+							{ component: 'app', argv: ['/usr/local/bin/fz-agent', 'pipeline-todo', 'replace with the project release argv'] },
+							{ scope: { kind: 'each-target', target: 'app' }, timeoutMs: 120_000 }
+						)
+					} }),
+					verify: stage({ dependsOn: ['release'], strategy: { mode: 'parallel' }, steps: {
+						health: actions.service.health({ component: 'app' }, { scope: { kind: 'each-target', target: 'app' }, timeoutMs: 30_000 })
+					} })
+				}
+			})
+		}
+	}
+});
+`;
+}
+function initializeTypeScriptDeployment(rootValue, options) {
+  const path = localPath(rootValue, DEPLOY_SOURCE_FILE, "deployment source");
+  if (existsSync6(path) && !options.force)
+    throw new Error(`${DEPLOY_SOURCE_FILE} already exists; use --force only when replacing it deliberately`);
+  writeFileSync6(path, defaultTypeScriptDeployment(options.name), { mode: 420, flag: options.force ? "w" : "wx" });
+  return path;
+}
+function inside(root, path) {
+  const nested = relative(root, path);
+  return nested === "" || !nested.startsWith(`..${sep3}`) && nested !== ".." && !isAbsolute(nested);
+}
+function localPath(rootValue, value, label) {
+  const root = resolve4(rootValue);
+  const path = resolve4(root, value);
+  if (!inside(root, path))
+    throw new Error(`${label} must remain inside the project root`);
+  return path;
+}
+async function loadDeploymentSource(root, sourceFile = DEPLOY_SOURCE_FILE) {
+  const source = localPath(root, sourceFile, "deployment source");
+  if (!existsSync6(source))
+    throw new Error(`${sourceFile} does not exist`);
+  const status = lstatSync2(source);
+  if (!status.isFile() || status.isSymbolicLink() || status.size > 2 * 1024 * 1024)
+    throw new Error("deployment source must be one bounded regular file");
+  const module = await import(`${pathToFileURL(source).href}?forgezero=${status.mtimeMs}`);
+  if (module.default === undefined)
+    throw new Error(`${sourceFile} must export one default deployment definition`);
+  return module.default;
+}
+async function compileDeploymentProject(rootValue, options = {}) {
+  const root = resolve4(rootValue);
+  const sourceFile = options.sourceFile ?? DEPLOY_SOURCE_FILE;
+  const outputFile = options.outputFile ?? DEPLOY_PLAN_FILE;
+  const source = localPath(root, sourceFile, "deployment source");
+  const output = localPath(root, outputFile, "deployment output");
+  const plan = compileDeployment(await loadDeploymentSource(root, sourceFile));
+  const bytes = `${canonicalJson(plan)}
+`;
+  parseDeploymentPlan(JSON.parse(bytes));
+  const previous = existsSync6(output) ? readFileSync6(output, "utf8") : undefined;
+  const changed = previous !== bytes;
+  if (options.write !== false && changed) {
+    mkdirSync6(dirname5(output), { recursive: true, mode: 493 });
+    const temporary = `${output}.new-${process.pid}`;
+    try {
+      writeFileSync6(temporary, bytes, { mode: 420, flag: "wx" });
+      renameSync5(temporary, output);
+    } finally {
+      rmSync4(temporary, { force: true });
+    }
+  }
+  return { source, output, plan, digest: deploymentPlanDigest(plan), changed };
+}
+function inspectCompiledDeployment(rootValue, outputFile = DEPLOY_PLAN_FILE) {
+  const path = localPath(rootValue, outputFile, "deployment output");
+  if (!existsSync6(path))
+    throw new Error(`${outputFile} does not exist; run \`fz deploy compile\``);
+  const status = lstatSync2(path);
+  if (!status.isFile() || status.isSymbolicLink() || status.size > 4194304)
+    throw new Error("deployment plan must be one bounded regular file");
+  const plan = parseDeploymentPlan(JSON.parse(readFileSync6(path, "utf8")));
+  return { path, plan, digest: deploymentPlanDigest(plan) };
+}
+
 // ../vault/dist/config.js
 class ConfigError extends Error {
   code;
@@ -10351,15 +11436,15 @@ function loadConfig(options = {}) {
 // src/cli/session-store.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync5,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync5,
-  readFileSync as readFileSync5,
-  renameSync as renameSync4,
+  existsSync as existsSync7,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync7,
+  renameSync as renameSync6,
   unlinkSync,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname6, join as join5 } from "path";
 import { homedir } from "os";
 var EMPTY2 = () => ({ version: 1, sessions: {} });
 function canonicalApi(value) {
@@ -10381,9 +11466,9 @@ function defaultSessionPath(env = process.env) {
   return join5(state, "forgezero", "sessions.json");
 }
 function assertPrivate(path, kind) {
-  if (!existsSync5(path))
+  if (!existsSync7(path))
     return;
-  const stat = lstatSync2(path);
+  const stat = lstatSync3(path);
   if (stat.isSymbolicLink())
     throw new Error(`Refusing symlinked CLI session ${kind}: ${path}`);
   if (kind === "directory" ? !stat.isDirectory() : !stat.isFile()) {
@@ -10399,13 +11484,13 @@ function assertPrivate(path, kind) {
   }
 }
 function parse(path) {
-  if (!existsSync5(path))
+  if (!existsSync7(path))
     return EMPTY2();
-  assertPrivate(dirname4(path), "directory");
+  assertPrivate(dirname6(path), "directory");
   assertPrivate(path, "file");
   let value;
   try {
-    value = JSON.parse(readFileSync5(path, "utf8"));
+    value = JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     throw new Error(`CLI session file is not valid JSON: ${path}`);
   }
@@ -10416,19 +11501,19 @@ function parse(path) {
   return raw;
 }
 function persist(path, value) {
-  const directory = dirname4(path);
-  if (!existsSync5(directory))
-    mkdirSync5(directory, { recursive: true, mode: 448 });
+  const directory = dirname6(path);
+  if (!existsSync7(directory))
+    mkdirSync7(directory, { recursive: true, mode: 448 });
   assertPrivate(directory, "directory");
   if (process.platform !== "win32")
     chmodSync2(directory, 448);
   const temporary = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
   try {
-    writeFileSync5(temporary, `${JSON.stringify(value, null, 2)}
+    writeFileSync7(temporary, `${JSON.stringify(value, null, 2)}
 `, { mode: 384, flag: "wx" });
     if (process.platform !== "win32")
       chmodSync2(temporary, 384);
-    renameSync4(temporary, path);
+    renameSync6(temporary, path);
   } finally {
     try {
       unlinkSync(temporary);
@@ -10465,18 +11550,18 @@ function removeSession(api, realm, path = defaultSessionPath()) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash2, createHmac, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash3, createHmac, randomBytes as randomBytes7 } from "crypto";
 import {
   chmodSync as chmodSync3,
-  existsSync as existsSync6,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync6,
-  renameSync as renameSync5,
-  rmSync as rmSync3,
-  writeFileSync as writeFileSync6
+  existsSync as existsSync8,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync8,
+  renameSync as renameSync7,
+  rmSync as rmSync5,
+  writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname6 } from "path";
+import { dirname as dirname8 } from "path";
 import { fileURLToPath } from "url";
 
 // src/platform-bootstrap-runtime.ts
@@ -10854,7 +11939,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 import { constants } from "fs";
 import { randomBytes as randomBytes6, randomUUID } from "crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
-import { dirname as dirname5, join as join6, resolve as resolve3 } from "path";
+import { dirname as dirname7, join as join6, resolve as resolve5 } from "path";
 import { isIP as isIP3 } from "net";
 
 // src/cloudflare-edge.ts
@@ -11098,16 +12183,16 @@ async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
     throw new Error(`${path} has an invalid size`);
 }
 async function readOwnerOnlyFile(path, maximumBytes) {
-  const absolute = resolve3(path);
+  const absolute2 = resolve5(path);
   let handle;
   try {
-    handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
-    await assertOwnerOnlyHandle(absolute, handle, maximumBytes);
+    handle = await open(absolute2, constants.O_RDONLY | constants.O_NOFOLLOW);
+    await assertOwnerOnlyHandle(absolute2, handle, maximumBytes);
     return await handle.readFile({ encoding: "utf8" });
   } catch (cause) {
-    if (cause instanceof Error && cause.message.startsWith(absolute))
+    if (cause instanceof Error && cause.message.startsWith(absolute2))
       throw cause;
-    throw new Error(`cannot securely read owner-only file ${absolute}`);
+    throw new Error(`cannot securely read owner-only file ${absolute2}`);
   } finally {
     await handle?.close();
   }
@@ -11115,7 +12200,7 @@ async function readOwnerOnlyFile(path, maximumBytes) {
 async function readOwnerApiToken(path) {
   const token = (await readOwnerOnlyFile(path, 4096)).trim();
   if (!TOKEN.test(token))
-    throw new Error(`${resolve3(path)} must contain exactly one Cloudflare API token`);
+    throw new Error(`${resolve5(path)} must contain exactly one Cloudflare API token`);
   return token;
 }
 async function readCloudflareBootstrapTokens(files) {
@@ -11308,7 +12393,7 @@ function planCloudflareBootstrap(input, outputPath) {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-plan",
     mode: "attended-token-file",
-    outputFile: resolve3(outputPath),
+    outputFile: resolve5(outputPath),
     coordinates,
     operations: [
       "prove CF_API_TOKEN can write, read and remove one namespaced nonce in the existing KV namespace",
@@ -11368,11 +12453,11 @@ async function readExistingOutput(path) {
     parsed = JSON.parse(await readOwnerOnlyFile(path, 1048576));
   } catch (cause) {
     if (cause instanceof SyntaxError)
-      throw new Error(`${resolve3(path)} is not valid bootstrap JSON`);
+      throw new Error(`${resolve5(path)} is not valid bootstrap JSON`);
     throw cause;
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new Error(`${resolve3(path)} is not a ForgeZero Cloudflare bootstrap output`);
+    throw new Error(`${resolve5(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
   const output = parsed;
   const unsupported = Object.keys(output).filter((key) => ![
@@ -11385,9 +12470,9 @@ async function readExistingOutput(path) {
     "created"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`${resolve3(path)} contains unsupported field ${unsupported[0]}`);
+    throw new Error(`${resolve5(path)} contains unsupported field ${unsupported[0]}`);
   if (output.format !== 1 || output.kind !== "forgezero-cloudflare-bootstrap" || !["edge-resources-provisioned", "complete"].includes(String(output.phase)) || typeof output.updatedAt !== "string" || Number.isNaN(Date.parse(output.updatedAt)) || !output.resources || typeof output.resources !== "object" || Array.isArray(output.resources)) {
-    throw new Error(`${resolve3(path)} is not a ForgeZero Cloudflare bootstrap output`);
+    throw new Error(`${resolve5(path)} is not a ForgeZero Cloudflare bootstrap output`);
   }
   const resources = output.resources;
   const unsupportedResource = Object.keys(resources).filter((key) => ![
@@ -11397,24 +12482,24 @@ async function readExistingOutput(path) {
     "nodes"
   ].includes(key));
   if (unsupportedResource.length) {
-    throw new Error(`${resolve3(path)} resources contain unsupported field ${unsupportedResource[0]}`);
+    throw new Error(`${resolve5(path)} resources contain unsupported field ${unsupportedResource[0]}`);
   }
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
   if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !TOKEN.test(String(resources.apiToken ?? "")) || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
-    throw new Error(`${resolve3(path)} has malformed Cloudflare bootstrap resources`);
+    throw new Error(`${resolve5(path)} has malformed Cloudflare bootstrap resources`);
   }
   if (coordinates.realtime) {
     const realtime = resources.realtime;
     if (!realtime || !REALTIME_SECRET.test(String(realtime.publishSecret ?? "")) || !REALTIME_SECRET.test(String(realtime.ticketSecret ?? "")) || realtime.publishSecret === realtime.ticketSecret) {
-      throw new Error(`${resolve3(path)} has malformed Cloudflare realtime resources`);
+      throw new Error(`${resolve5(path)} has malformed Cloudflare realtime resources`);
     }
   } else if (resources.realtime !== undefined) {
-    throw new Error(`${resolve3(path)} contains undeclared Cloudflare realtime resources`);
+    throw new Error(`${resolve5(path)} contains undeclared Cloudflare realtime resources`);
   }
   const seen = new Set;
   for (const item of resources.nodes) {
     if (!item || typeof item !== "object" || Array.isArray(item)) {
-      throw new Error(`${resolve3(path)} has a malformed Cloudflare node resource`);
+      throw new Error(`${resolve5(path)} has a malformed Cloudflare node resource`);
     }
     const node = item;
     const unknownNode = Object.keys(node).filter((key) => ![
@@ -11428,24 +12513,24 @@ async function readExistingOutput(path) {
     ].includes(key));
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
     if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? "")) || !CONNECTOR_TOKEN.test(String(node.connectorToken ?? ""))) {
-      throw new Error(`${resolve3(path)} has a malformed or unbound Cloudflare node resource`);
+      throw new Error(`${resolve5(path)} has a malformed or unbound Cloudflare node resource`);
     }
     if (expected.mesh) {
       const mesh = node.mesh;
       if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? "")) || !CONNECTOR_TOKEN.test(String(mesh.connectorToken ?? ""))) {
-        throw new Error(`${resolve3(path)} has a malformed or unbound Cloudflare Mesh resource`);
+        throw new Error(`${resolve5(path)} has a malformed or unbound Cloudflare Mesh resource`);
       }
     } else if (node.mesh !== undefined) {
-      throw new Error(`${resolve3(path)} contains an undeclared Cloudflare Mesh resource`);
+      throw new Error(`${resolve5(path)} contains an undeclared Cloudflare Mesh resource`);
     }
     seen.add(expected.nodeName);
   }
   if (output.phase === "complete" && resources.nodes.length !== coordinates.nodes.length) {
-    throw new Error(`${resolve3(path)} completed output does not cover the declared node fleet`);
+    throw new Error(`${resolve5(path)} completed output does not cover the declared node fleet`);
   }
   if (output.created !== undefined) {
     if (!output.created || typeof output.created !== "object" || Array.isArray(output.created) || Object.keys(output.created).some((key) => key !== "nodes") || !Array.isArray(output.created.nodes) || output.created.nodes.some((node) => !node || typeof node !== "object" || Array.isArray(node) || Object.keys(node).some((key) => !["nodeName", "tunnel", "mesh"].includes(key)) || typeof node.nodeName !== "string" || typeof node.tunnel !== "boolean" || typeof node.mesh !== "boolean")) {
-      throw new Error(`${resolve3(path)} has malformed Cloudflare creation evidence`);
+      throw new Error(`${resolve5(path)} has malformed Cloudflare creation evidence`);
     }
   }
   output.coordinates = coordinates;
@@ -11455,7 +12540,7 @@ function cloudflareHostHandoffPath(checkpointPath, nodeName) {
   const normalized = nodeName.trim().toLowerCase();
   if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(normalized))
     throw new Error("Cloudflare host handoff node name is invalid");
-  return join6(`${resolve3(checkpointPath)}.hosts`, `${normalized}.json`);
+  return join6(`${resolve5(checkpointPath)}.hosts`, `${normalized}.json`);
 }
 async function readCloudflareHostHandoff(handoffPath, nodeName) {
   let parsed;
@@ -11540,7 +12625,7 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   };
 }
 async function prepareOwnerOutputDirectory(absolutePath) {
-  const directory = dirname5(absolutePath);
+  const directory = dirname7(absolutePath);
   await mkdir(directory, { recursive: true, mode: 448 });
   const metadata = await stat(directory);
   const uid = ownerUid();
@@ -11550,9 +12635,9 @@ async function prepareOwnerOutputDirectory(absolutePath) {
   return directory;
 }
 async function writeOwnerJson(path, output) {
-  const absolute = resolve3(path);
-  const directory = await prepareOwnerOutputDirectory(absolute);
-  const temporary = `${absolute}.${randomUUID()}.tmp`;
+  const absolute2 = resolve5(path);
+  const directory = await prepareOwnerOutputDirectory(absolute2);
+  const temporary = `${absolute2}.${randomUUID()}.tmp`;
   let handle;
   try {
     handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
@@ -11561,8 +12646,8 @@ async function writeOwnerJson(path, output) {
     await handle.sync();
     await handle.close();
     handle = undefined;
-    await rename(temporary, absolute);
-    await chmod(absolute, 384);
+    await rename(temporary, absolute2);
+    await chmod(absolute2, 384);
     const directoryHandle = await open(directory, constants.O_RDONLY);
     try {
       await directoryHandle.sync();
@@ -11611,7 +12696,7 @@ var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(r
 var newRealtimeSecret = () => randomBytes6(48).toString("base64url");
 async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
-  const absoluteOutput = resolve3(outputPath);
+  const absoluteOutput = resolve5(outputPath);
   const existing = await readExistingOutput(absoluteOutput);
   if (existing && !sameCoordinates(existing.coordinates, coordinates)) {
     throw new Error("bootstrap output belongs to different Cloudflare coordinates; choose a different output file");
@@ -11806,8 +12891,8 @@ var acceptanceFetch = async (url, label, fetcher) => {
   return response.status;
 };
 async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fetch) {
-  const absolute = resolve3(checkpointPath);
-  const output = await readExistingOutput(absolute);
+  const absolute2 = resolve5(checkpointPath);
+  const output = await readExistingOutput(absolute2);
   if (!output || output.phase !== "complete")
     throw new Error("Cloudflare acceptance requires a completed owner checkpoint");
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
@@ -11828,13 +12913,13 @@ async function verifyCloudflareBootstrapAcceptance(checkpointPath, fetcher = fet
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-acceptance",
-    checkpointFile: absolute,
+    checkpointFile: absolute2,
     verifiedAt: new Date().toISOString(),
     nodes
   };
 }
 async function removeCloudflareBootstrapSecrets(checkpointPath, output) {
-  const directory = `${resolve3(checkpointPath)}.hosts`;
+  const directory = `${resolve5(checkpointPath)}.hosts`;
   let entries;
   try {
     const metadata = await lstat(directory);
@@ -11856,11 +12941,11 @@ async function removeCloudflareBootstrapSecrets(checkpointPath, output) {
       await unlink(join6(directory, name));
     await rmdir(directory);
   }
-  await unlink(resolve3(checkpointPath));
+  await unlink(resolve5(checkpointPath));
 }
 async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
-  const checkpointPath = resolve3(request.checkpointPath);
-  const acceptancePath = resolve3(request.acceptancePath);
+  const checkpointPath = resolve5(request.checkpointPath);
+  const acceptancePath = resolve5(request.acceptancePath);
   if (acceptancePath === checkpointPath || acceptancePath.startsWith(`${checkpointPath}.hosts/`)) {
     throw new Error("Cloudflare acceptance evidence must be outside the secret checkpoint and handoff directory");
   }
@@ -12496,7 +13581,7 @@ function bootstrapIdentity(config) {
   };
 }
 function bootstrapIdentityDigest(config) {
-  return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
+  return createHash3("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 function parseStoredState(raw) {
   let value;
@@ -13130,11 +14215,11 @@ function strictBootstrapDocument(value) {
   return value;
 }
 function readBootstrapConfig(path) {
-  const metadata = lstatSync3(path);
+  const metadata = lstatSync4(path);
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
     throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
   }
-  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync6(path, "utf8"))));
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync8(path, "utf8"))));
 }
 function localBootstrapHost() {
   const execute = async (argv2, options = {}) => {
@@ -13152,19 +14237,19 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync6,
-    read: (path) => readFileSync6(path, "utf8"),
+    exists: existsSync8,
+    read: (path) => readFileSync8(path, "utf8"),
     write(path, content, mode) {
-      mkdirSync6(dirname6(path), { recursive: true, mode: 493 });
+      mkdirSync8(dirname8(path), { recursive: true, mode: 493 });
       const temporary = `${path}.next.${process.pid}`;
-      writeFileSync6(temporary, content, { mode });
+      writeFileSync8(temporary, content, { mode });
       chmodSync3(temporary, mode);
-      renameSync5(temporary, path);
+      renameSync7(temporary, path);
     },
-    mkdir: (path, mode) => mkdirSync6(path, { recursive: true, mode }),
-    remove: (path) => rmSync3(path, { force: true }),
+    mkdir: (path, mode) => mkdirSync8(path, { recursive: true, mode }),
+    remove: (path) => rmSync5(path, { force: true }),
     inspect(path) {
-      const value = lstatSync3(path);
+      const value = lstatSync4(path);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
     },
     exec: execute,
@@ -13186,7 +14271,7 @@ function localBootstrapHost() {
     async installAgent(config, enrolTokenSourcePath) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync6("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync8("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -13198,8 +14283,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync6(dirname6(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync6(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync8(dirname8(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync8(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -13240,8 +14325,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync6(dirname6(unit.path), { recursive: true, mode: 493 });
-        writeFileSync6(unit.path, unit.unit, { mode: 420 });
+        mkdirSync8(dirname8(unit.path), { recursive: true, mode: 493 });
+        writeFileSync8(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;
@@ -13250,8 +14335,8 @@ function localBootstrapHost() {
 }
 
 // src/cli/cloudflare-bootstrap.ts
-import { constants as constants2, closeSync, fstatSync, openSync, readFileSync as readFileSync7 } from "fs";
-import { dirname as dirname7, resolve as resolve4 } from "path";
+import { constants as constants2, closeSync, fstatSync, openSync, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname9, resolve as resolve6 } from "path";
 var exactKeys3 = (value, allowed, label) => {
   const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
   if (unknown.length)
@@ -13263,22 +14348,22 @@ var record2 = (value, label) => {
   return value;
 };
 function readOwnerConfig(path) {
-  const absolute = resolve4(path);
+  const absolute2 = resolve6(path);
   let descriptor;
   try {
-    descriptor = openSync(absolute, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    descriptor = openSync(absolute2, constants2.O_RDONLY | constants2.O_NOFOLLOW);
     const metadata = fstatSync(descriptor);
     const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
     if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size < 2 || metadata.size > 131072 || uid !== undefined && metadata.uid !== uid || (metadata.mode & 63) !== 0) {
-      throw new Error(`${absolute} must be one operator-owned 0600 regular file`);
+      throw new Error(`${absolute2} must be one operator-owned 0600 regular file`);
     }
-    return JSON.parse(readFileSync7(descriptor, "utf8"));
+    return JSON.parse(readFileSync9(descriptor, "utf8"));
   } catch (cause) {
     if (cause instanceof SyntaxError)
-      throw new Error(`${absolute} is not valid Cloudflare bootstrap JSON`);
-    if (cause instanceof Error && cause.message.startsWith(absolute))
+      throw new Error(`${absolute2} is not valid Cloudflare bootstrap JSON`);
+    if (cause instanceof Error && cause.message.startsWith(absolute2))
       throw cause;
-    throw new Error(`cannot securely read Cloudflare bootstrap config ${absolute}`);
+    throw new Error(`cannot securely read Cloudflare bootstrap config ${absolute2}`);
   } finally {
     if (descriptor !== undefined)
       closeSync(descriptor);
@@ -13286,7 +14371,7 @@ function readOwnerConfig(path) {
 }
 function readCloudflareBootstrapCommandConfig(path, mode) {
   const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
-  const baseDirectory = dirname7(resolve4(path));
+  const baseDirectory = dirname9(resolve6(path));
   exactKeys3(input, ["format", "kind", "checkpointPath", "coordinates", "tokenFiles"], "Cloudflare bootstrap config");
   if (input.format !== 1 || input.kind !== "forgezero-cloudflare-bootstrap-request") {
     throw new Error("Cloudflare bootstrap config format/kind is invalid");
@@ -13334,8 +14419,8 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
       }
     }
     tokenFiles = {
-      tunnelTokenFile: resolve4(baseDirectory, source.tunnelTokenFile),
-      apiTokenFile: resolve4(baseDirectory, source.apiTokenFile)
+      tunnelTokenFile: resolve6(baseDirectory, source.tunnelTokenFile),
+      apiTokenFile: resolve6(baseDirectory, source.apiTokenFile)
     };
   }
   if (mode === "apply" && !tokenFiles) {
@@ -13344,7 +14429,7 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
   return {
     mode,
     coordinates,
-    checkpointPath: resolve4(baseDirectory, input.checkpointPath),
+    checkpointPath: resolve6(baseDirectory, input.checkpointPath),
     ...tokenFiles ? { tokenFiles } : {}
   };
 }
@@ -13356,14 +14441,14 @@ async function runCloudflareBootstrapCommand(configPath, apply, dependencies = {
   return evidence;
 }
 async function runCloudflareBootstrapVerificationCommand(checkpointPath, dependencies = {}) {
-  const evidence = await (dependencies.verify ?? verifyCloudflareBootstrapAcceptance)(resolve4(checkpointPath));
+  const evidence = await (dependencies.verify ?? verifyCloudflareBootstrapAcceptance)(resolve6(checkpointPath));
   (dependencies.write ?? ((text3) => process.stdout.write(text3)))(`${JSON.stringify(evidence, null, 2)}
 `);
   return evidence;
 }
 function readCloudflareBootstrapFinalizeConfig(path) {
   const input = record2(readOwnerConfig(path), "Cloudflare bootstrap finalize config");
-  const baseDirectory = dirname7(resolve4(path));
+  const baseDirectory = dirname9(resolve6(path));
   exactKeys3(input, ["format", "kind", "checkpointPath", "acceptancePath"], "Cloudflare bootstrap finalize config");
   if (input.format !== 1 || input.kind !== "forgezero-cloudflare-bootstrap-finalize") {
     throw new Error("Cloudflare bootstrap finalize config format/kind is invalid");
@@ -13374,8 +14459,8 @@ function readCloudflareBootstrapFinalizeConfig(path) {
     }
   }
   return {
-    checkpointPath: resolve4(baseDirectory, input.checkpointPath),
-    acceptancePath: resolve4(baseDirectory, input.acceptancePath)
+    checkpointPath: resolve6(baseDirectory, input.checkpointPath),
+    acceptancePath: resolve6(baseDirectory, input.acceptancePath)
   };
 }
 async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies = {}) {
@@ -13387,31 +14472,31 @@ async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies =
 }
 
 // src/metal-bootstrap.ts
-import { createHash as createHash3, randomBytes as randomBytes8 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes8 } from "crypto";
 import {
   chmodSync as chmodSync4,
   chownSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync7,
-  lstatSync as lstatSync4,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync8,
-  realpathSync as realpathSync3,
-  renameSync as renameSync6,
+  existsSync as existsSync9,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync10,
+  realpathSync as realpathSync4,
+  renameSync as renameSync8,
   statSync,
   symlinkSync as symlinkSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync10
 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute2, join as join9, resolve as resolve5 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute3, join as join9, resolve as resolve7 } from "path";
 import { isIP as isIP5 } from "net";
 
 // src/metal-isolation.ts
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
 import { join as join8 } from "path";
 
 // src/metal-provision.ts
-import { dirname as dirname8, isAbsolute, join as join7 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute2, join as join7 } from "path";
 import { isIP as isIP4 } from "net";
 
 // src/ubuntu.ts
@@ -13460,7 +14545,7 @@ function validateMetalProfile(profile) {
   if (!Number.isInteger(profile.addressStart) || !Number.isInteger(profile.addressEnd) || profile.addressStart < 2 || profile.addressEnd > 254 || profile.addressStart > profile.addressEnd)
     throw new MetalProvisionError("invalid guest address range");
   for (const path of [profile.stateDir, profile.seedDir, profile.unitDir]) {
-    if (!isAbsolute(path))
+    if (!isAbsolute2(path))
       throw new MetalProvisionError("metal paths must be absolute");
   }
   new URL(profile.apiUrl);
@@ -13599,16 +14684,16 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
   validateMetalProfile(profile);
   await requireGuestsInSlice(exec);
   const unitDir = profile.unitDir;
-  mkdirSync7(unitDir, { recursive: true });
-  writeFileSync7(join8(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  mkdirSync9(unitDir, { recursive: true });
+  writeFileSync9(join8(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
   for (const unit of ["system.slice", "user.slice"]) {
     const directory = join8(unitDir, `${unit}.d`);
-    mkdirSync7(directory, { recursive: true });
-    writeFileSync7(join8(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+    mkdirSync9(directory, { recursive: true });
+    writeFileSync9(join8(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
   }
   const initDirectory = join8(unitDir, "init.scope.d");
-  mkdirSync7(initDirectory, { recursive: true });
-  writeFileSync7(join8(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  mkdirSync9(initDirectory, { recursive: true });
+  writeFileSync9(join8(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
   await checked3(exec, ["systemctl", "daemon-reload"]);
   await requireGuestsInSlice(exec);
   const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
@@ -13727,7 +14812,7 @@ function validateMetalBootstrapConfig(config) {
     throw new MetalBootstrapError("metal bootstrap uses fixed state, seed, and systemd unit directories");
   }
   const image = config.profile.images[Object.keys(config.profile.images)[0]];
-  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve5(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
+  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve7(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
     throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
   }
   if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION2) {
@@ -13762,11 +14847,11 @@ function validateMetalBootstrapConfig(config) {
   return config;
 }
 function validateOwnerOnlyPath(path, requireRootOwner) {
-  if (!isAbsolute2(path) || resolve5(path) !== path || path.includes("/../")) {
+  if (!isAbsolute3(path) || resolve7(path) !== path || path.includes("/../")) {
     throw new MetalBootstrapError("private bootstrap paths must be canonical absolute paths");
   }
-  const metadata = lstatSync4(path);
-  if (!metadata.isFile() || metadata.isSymbolicLink() || realpathSync3(path) !== path) {
+  const metadata = lstatSync5(path);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || realpathSync4(path) !== path) {
     throw new MetalBootstrapError("private bootstrap path must be a regular non-symlink file");
   }
   if ((metadata.mode & 63) !== 0)
@@ -13783,7 +14868,7 @@ function readMetalBootstrapConfig(path) {
     throw new MetalBootstrapError("metal bootstrap config size is invalid");
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync8(path, "utf8"));
+    parsed = JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
   }
@@ -13816,15 +14901,15 @@ function planMetalBootstrap(config) {
   };
 }
 var atomicWrite2 = (path, body, mode) => {
-  mkdirSync8(dirname9(path), { recursive: true, mode: 493 });
+  mkdirSync10(dirname11(path), { recursive: true, mode: 493 });
   const temporary = `${path}.next-${process.pid}`;
-  writeFileSync8(temporary, body, { mode, flag: "wx" });
+  writeFileSync10(temporary, body, { mode, flag: "wx" });
   chmodSync4(temporary, mode);
   chownSync(temporary, 0, 0);
-  renameSync6(temporary, path);
+  renameSync8(temporary, path);
 };
 var validateAgentSourcePath = (source) => {
-  if (!isAbsolute2(source) || !lstatSync4(source).isFile() || lstatSync4(source).isSymbolicLink()) {
+  if (!isAbsolute3(source) || !lstatSync5(source).isFile() || lstatSync5(source).isSymbolicLink()) {
     throw new MetalBootstrapError("published Agent source path must be an absolute regular non-symlink file");
   }
 };
@@ -13988,11 +15073,11 @@ WantedBy=multi-user.target
 var installAgentBinary = (source, version) => {
   validateAgentSourcePath(source);
   const release = `/opt/forgezero/agent/versions/${version}/dist`;
-  mkdirSync8(release, { recursive: true, mode: 493 });
+  mkdirSync10(release, { recursive: true, mode: 493 });
   copyFileSync2(source, join9(release, "fz-agent.js"));
   chmodSync4(join9(release, "fz-agent.js"), 493);
   chownSync(join9(release, "fz-agent.js"), 0, 0);
-  mkdirSync8("/opt/forgezero/agent", { recursive: true, mode: 493 });
+  mkdirSync10("/opt/forgezero/agent", { recursive: true, mode: 493 });
   for (const [link, target] of [
     ["/opt/forgezero/agent/current.next", `versions/${version}`],
     [AGENT_PATH, "/opt/forgezero/agent/current/dist/fz-agent.js"]
@@ -14002,7 +15087,7 @@ var installAgentBinary = (source, version) => {
     } catch {}
     symlinkSync2(target, link);
     if (link.endsWith("current.next"))
-      renameSync6(link, "/opt/forgezero/agent/current");
+      renameSync8(link, "/opt/forgezero/agent/current");
   }
 };
 var preflight = async (config, exec) => {
@@ -14024,10 +15109,10 @@ var preflight = async (config, exec) => {
   ]);
   await runChecked(exec, ["/usr/sbin/vgs", config.profile.volumeGroup]);
   await runChecked(exec, ["/usr/sbin/ip", "link", "show", config.profile.bridge]);
-  if (!existsSync7("/dev/kvm"))
+  if (!existsSync9("/dev/kvm"))
     throw new MetalBootstrapError("/dev/kvm is required");
   if (config.profile.confidential) {
-    if (!existsSync7("/dev/sev"))
+    if (!existsSync9("/dev/sev"))
       throw new MetalBootstrapError("/dev/sev is required by the confidential profile");
     await runChecked(exec, ["/usr/bin/qemu-system-x86_64", "-object", "sev-snp-guest,help"]);
   }
@@ -14039,16 +15124,16 @@ var assertSupportedMetalHost = () => {
   if (process.platform !== "linux" || process.arch !== "x64") {
     throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
   }
-  const release = readFileSync8("/etc/os-release", "utf8");
+  const release = readFileSync10("/etc/os-release", "utf8");
   if (!/^ID=ubuntu$/m.test(release) || !/^VERSION_ID="?26\.04"?$/m.test(release)) {
     throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
   }
 };
 var ensurePinnedGuestImage = async (config, exec) => {
   const image = config.profile.images[SUPPORTED_GUEST_IMAGE.key];
-  if (existsSync7(image.path))
+  if (existsSync9(image.path))
     return;
-  mkdirSync8(dirname9(image.path), { recursive: true, mode: 493 });
+  mkdirSync10(dirname11(image.path), { recursive: true, mode: 493 });
   const temporary = `${image.path}.next-${process.pid}`;
   try {
     await runChecked(exec, [
@@ -14067,7 +15152,7 @@ var ensurePinnedGuestImage = async (config, exec) => {
       throw new MetalBootstrapError("downloaded guest image digest mismatch");
     chmodSync4(temporary, 292);
     chownSync(temporary, 0, 0);
-    renameSync6(temporary, image.path);
+    renameSync8(temporary, image.path);
   } catch (cause) {
     try {
       unlinkSync2(temporary);
@@ -14080,11 +15165,11 @@ async function applyMetalBootstrap(config, options) {
   if ((options.getuid ?? process.getuid)?.() !== 0)
     throw new MetalBootstrapError("fz bootstrap metal --apply must run as root");
   assertSupportedMetalHost();
-  if (existsSync7(STATE_PATH2) && !options.repair)
+  if (existsSync9(STATE_PATH2) && !options.repair)
     throw new MetalBootstrapError("metal host is already initialized; use explicit repair");
   if (config.agentSeedFile)
     validateOwnerOnlyPath(config.agentSeedFile, true);
-  if (config.agentSeedFile && existsSync7(SEED_CREDENTIAL_PATH)) {
+  if (config.agentSeedFile && existsSync9(SEED_CREDENTIAL_PATH)) {
     throw new MetalBootstrapError("repair refuses replacement seed material while the sealed metal identity exists");
   }
   validateAgentSourcePath(options.agentSourcePath);
@@ -14111,9 +15196,9 @@ async function applyMetalBootstrap(config, options) {
   await preflight(config, exec);
   await ensureAccount(exec);
   installAgentBinary(options.agentSourcePath, config.profile.agentVersion);
-  mkdirSync8("/etc/forgezero/creds", { recursive: true, mode: 448 });
-  mkdirSync8(config.profile.stateDir, { recursive: true, mode: 448 });
-  mkdirSync8(config.profile.seedDir, { recursive: true, mode: 448 });
+  mkdirSync10("/etc/forgezero/creds", { recursive: true, mode: 448 });
+  mkdirSync10(config.profile.stateDir, { recursive: true, mode: 448 });
+  mkdirSync10(config.profile.seedDir, { recursive: true, mode: 448 });
   const persistedProfile = {
     ...config.profile,
     metalHostname: config.metalHostname,
@@ -14122,8 +15207,8 @@ async function applyMetalBootstrap(config, options) {
   };
   atomicWrite2(PROFILE_PATH, `${JSON.stringify(persistedProfile, null, 2)}
 `, 384);
-  if (!existsSync7(SEED_CREDENTIAL_PATH)) {
-    const seed = config.agentSeedFile ? readFileSync8(config.agentSeedFile, "utf8").trim() : randomBytes8(32).toString("base64url");
+  if (!existsSync9(SEED_CREDENTIAL_PATH)) {
+    const seed = config.agentSeedFile ? readFileSync10(config.agentSeedFile, "utf8").trim() : randomBytes8(32).toString("base64url");
     if (seed.length < 32 || /[\0\r\n]/.test(seed))
       throw new MetalBootstrapError("metal Agent seed is invalid");
     await runChecked(exec, ["/usr/bin/systemd-creds", "encrypt", "--name=metal-agent-seed", "-", SEED_CREDENTIAL_PATH], `${seed}
@@ -14177,7 +15262,7 @@ async function applyMetalBootstrap(config, options) {
     initializedAt: new Date().toISOString(),
     role: "metal",
     metalHostname: config.metalHostname,
-    profileSha256: createHash3("sha256").update(JSON.stringify(config.profile)).digest("hex")
+    profileSha256: createHash4("sha256").update(JSON.stringify(config.profile)).digest("hex")
   };
   atomicWrite2(STATE_PATH2, `${JSON.stringify(state, null, 2)}
 `, 384);
@@ -14185,7 +15270,7 @@ async function applyMetalBootstrap(config, options) {
 }
 var socketReady = (path) => {
   try {
-    return lstatSync4(path).isSocket();
+    return lstatSync5(path).isSocket();
   } catch {
     return false;
   }
@@ -14194,17 +15279,17 @@ async function metalBootstrapStatus(exec = defaultExec2) {
   const problems = [];
   let profileValid = false, imageVerified = false, metalHostname, profileSha256;
   let profileMode = null;
-  if (existsSync7(PROFILE_PATH)) {
+  if (existsSync9(PROFILE_PATH)) {
     try {
       const metadata = statSync(PROFILE_PATH);
       profileMode = metadata.mode & 511;
       if (profileMode !== 384 || metadata.uid !== 0)
         problems.push("metal profile is not root-owned mode 0600");
-      const persisted = JSON.parse(readFileSync8(PROFILE_PATH, "utf8"));
+      const persisted = JSON.parse(readFileSync10(PROFILE_PATH, "utf8"));
       const { metalHostname: profileHostname, hostTelemetryEndpoint, hostTelemetryUnit, ...profile } = persisted;
       validateMetalProfile(profile);
       profileValid = true;
-      profileSha256 = createHash3("sha256").update(JSON.stringify(profile)).digest("hex");
+      profileSha256 = createHash4("sha256").update(JSON.stringify(profile)).digest("hex");
       if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(profileHostname) || hostTelemetryEndpoint !== "http://127.0.0.1:4318") {
         problems.push("persisted metal host coordinates are invalid");
       }
@@ -14233,7 +15318,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
         problems.push("local OTLP metrics receiver did not accept a proof request");
       }
       const image = profile.images[Object.keys(profile.images)[0]];
-      if (existsSync7(image.path)) {
+      if (existsSync9(image.path)) {
         const digest = (await exec(["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
         imageVerified = digest === image.sha256;
       }
@@ -14244,9 +15329,9 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     }
   } else
     problems.push("metal profile is missing");
-  if (existsSync7(STATE_PATH2)) {
+  if (existsSync9(STATE_PATH2)) {
     try {
-      const state = JSON.parse(readFileSync8(STATE_PATH2, "utf8"));
+      const state = JSON.parse(readFileSync10(STATE_PATH2, "utf8"));
       metalHostname = state.metalHostname;
       if (state.role !== "metal" || !metalHostname || state.profileSha256 !== profileSha256) {
         problems.push("metal initialized state does not bind the current profile");
@@ -14262,7 +15347,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]) {
-    if (!existsSync7(join9(UNIT_DIRECTORY, unit)))
+    if (!existsSync9(join9(UNIT_DIRECTORY, unit)))
       units[unit] = "missing";
     else
       units[unit] = (await exec(["/usr/bin/systemctl", "is-active", "--quiet", unit])).exitCode === 0 ? "active" : "inactive";
@@ -14276,7 +15361,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
   return {
-    initialized: existsSync7(STATE_PATH2),
+    initialized: existsSync9(STATE_PATH2),
     profileValid,
     profileMode,
     imageVerified,
@@ -14289,8 +15374,8 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
-import { createHash as createHash4, randomBytes as randomBytes9 } from "crypto";
-import { lstatSync as lstatSync5, mkdtempSync, readFileSync as readFileSync9, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
+import { createHash as createHash5, randomBytes as randomBytes9 } from "crypto";
+import { lstatSync as lstatSync6, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
 import { basename as basename2, join as join10 } from "path";
@@ -14384,22 +15469,22 @@ var exactKeys5 = (value, keys, label) => {
 var ownerFile = (path, limit, label) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error(`${label} path must be absolute`);
-  const metadata = lstatSync5(path);
+  const metadata = lstatSync6(path);
   const uid = process.getuid?.() ?? metadata.uid;
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== uid || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size < 1 || metadata.size > limit) {
     throw new Error(`${label} must be an owner-only regular file with one link and at most ${limit} bytes`);
   }
-  return readFileSync9(path);
+  return readFileSync11(path);
 };
 var publicIdentity = (path) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error("SSH public-key path must be absolute");
-  const metadata = lstatSync5(path);
+  const metadata = lstatSync6(path);
   const uid = process.getuid?.() ?? metadata.uid;
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== uid || metadata.nlink !== 1 || metadata.size > 16384) {
     throw new Error("SSH public key must be a caller-owned regular file with one link");
   }
-  const value = readFileSync9(path, "utf8").trim();
+  const value = readFileSync11(path, "utf8").trim();
   if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(value)) {
     throw new Error("SSH public key is malformed");
   }
@@ -14408,7 +15493,7 @@ var publicIdentity = (path) => {
 var socketPath = (path) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error("SSH agent socket path must be absolute");
-  const metadata = lstatSync5(path);
+  const metadata = lstatSync6(path);
   const uid = process.getuid?.() ?? metadata.uid;
   if (!metadata.isSocket() || metadata.isSymbolicLink() || metadata.uid !== uid) {
     throw new Error("SSH agent socket must be a caller-owned Unix socket");
@@ -14422,7 +15507,7 @@ var fingerprint = (key) => {
   if (!bytes.length || bytes.toString("base64").replace(/=+$/, "") !== encoded.replace(/=+$/, "")) {
     throw new Error("SSH host key is malformed");
   }
-  return `SHA256:${createHash4("sha256").update(bytes).digest("base64").replace(/=+$/, "")}`;
+  return `SHA256:${createHash5("sha256").update(bytes).digest("base64").replace(/=+$/, "")}`;
 };
 var validateHop = (value, label) => {
   const hop = exactKeys5(value, ["address", "port", "user", "hostKey", "hostKeySha256"], label);
@@ -14603,7 +15688,7 @@ function writeKnownHosts(request, directory) {
   if (request.target.jump)
     lines.push(`${hostLabel(request.target.jump.address, request.target.jump.port)} ${request.target.jump.hostKey}`);
   const path = join10(directory, "known_hosts");
-  writeFileSync9(path, `${lines.join(`
+  writeFileSync11(path, `${lines.join(`
 `)}
 `, { mode: 384, flag: "wx" });
   return path;
@@ -14678,7 +15763,7 @@ function stageConfig(config, directory) {
   for (const [name, source] of secretSources(config)) {
     const bytes = ownerFile(source, SECRET_LIMIT, name);
     const local = join10(directory, name);
-    writeFileSync9(local, bytes, { mode: 384, flag: "wx" });
+    writeFileSync11(local, bytes, { mode: 384, flag: "wx" });
     staged.push(name);
     const remotePath = `${REMOTE_STAGE}/${name}`;
     if (name === "cluster-code")
@@ -14693,7 +15778,7 @@ function stageConfig(config, directory) {
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
   const path = join10(directory, "platform-config.json");
-  writeFileSync9(path, `${JSON.stringify(rewritten, null, 2)}
+  writeFileSync11(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files: staged };
 }
@@ -14702,7 +15787,7 @@ function stageMetalConfig(config, directory) {
   const files = [];
   if (config.agentSeedFile) {
     const name = "metal-agent-seed";
-    writeFileSync9(join10(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
+    writeFileSync11(join10(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
       mode: 384,
       flag: "wx"
     });
@@ -14710,7 +15795,7 @@ function stageMetalConfig(config, directory) {
     files.push(name);
   }
   const path = join10(directory, "metal-config.json");
-  writeFileSync9(path, `${JSON.stringify(rewritten, null, 2)}
+  writeFileSync11(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files };
 }
@@ -14719,10 +15804,10 @@ async function verifiedBunArchive(directory, fetcher) {
   if (!response.ok)
     throw new Error("pinned Bun download failed");
   const bytes = new Uint8Array(await response.arrayBuffer());
-  if (createHash4("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256)
+  if (createHash5("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256)
     throw new Error("pinned Bun checksum mismatch");
   const path = join10(directory, "bun.zip");
-  writeFileSync9(path, bytes, { mode: 384, flag: "wx" });
+  writeFileSync11(path, bytes, { mode: 384, flag: "wx" });
   return path;
 }
 async function installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options) {
@@ -14732,7 +15817,7 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
     [options.fzGitSshPath ?? fileURLToPath2(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
   ];
   for (const [artifact] of artifacts) {
-    if (!readFileSync9(artifact).length)
+    if (!readFileSync11(artifact).length)
       throw new Error(`packaged artifact is empty: ${basename2(artifact)}`);
   }
   await remote(exec, request, knownHosts, ["/usr/bin/mkdir", "-m", "0700", remoteTemp], "remote staging");
@@ -14803,7 +15888,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
         return;
       });
     }
-    rmSync4(directory, { recursive: true, force: true });
+    rmSync6(directory, { recursive: true, force: true });
   }
 }
 async function applyOperatorMetalBootstrap(request, mode, options = {}) {
@@ -14855,7 +15940,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         return;
       });
     }
-    rmSync4(directory, { recursive: true, force: true });
+    rmSync6(directory, { recursive: true, force: true });
   }
 }
 
@@ -14910,7 +15995,7 @@ function platformGenesisBootstrapConfigs(template, nodes) {
 }
 
 // src/host-maintenance.ts
-import { lstatSync as lstatSync6, readFileSync as readFileSync10 } from "fs";
+import { lstatSync as lstatSync7, readFileSync as readFileSync12 } from "fs";
 var ROOT = "/opt/forgezero";
 var SLOT_FILE = `${ROOT}/.forge-slot`;
 var SHARED_ENV = `${ROOT}/shared/.env`;
@@ -14918,9 +16003,9 @@ var JWT = "/etc/forgezero/creds/arangodb-jwt.cred";
 var FZ = "/usr/local/bin/fz";
 var localRuntime = () => ({
   uid: () => process.getuid?.() ?? -1,
-  read: (path) => readFileSync10(path, "utf8"),
+  read: (path) => readFileSync12(path, "utf8"),
   inspect(path) {
-    const value = lstatSync6(path);
+    const value = lstatSync7(path);
     return {
       regular: value.isFile(),
       symbolic: value.isSymbolicLink(),
@@ -15041,8 +16126,8 @@ async function applyHostMaintenance(request, runtime = localRuntime()) {
 }
 
 // src/cli/maintenance.ts
-import { existsSync as existsSync8, lstatSync as lstatSync7, readFileSync as readFileSync11, realpathSync as realpathSync4 } from "fs";
-import { isAbsolute as isAbsolute3, join as join11, relative, resolve as resolve6 } from "path";
+import { existsSync as existsSync10, lstatSync as lstatSync8, readFileSync as readFileSync13, realpathSync as realpathSync5 } from "fs";
+import { isAbsolute as isAbsolute4, join as join11, relative as relative2, resolve as resolve8 } from "path";
 var API_OPERATION_ENTRYPOINTS = {
   "dev-reset": ["src", "server", "maintenance", "dev-reset.ts"],
   "db-backup": ["src", "server", "maintenance", "snapshot-backup.ts"],
@@ -15112,12 +16197,12 @@ function unsupportedRepositoryCliOption(argv2) {
 }
 function manifestName(root) {
   const manifestPath = join11(root, "package.json");
-  if (!existsSync8(manifestPath)) {
+  if (!existsSync10(manifestPath)) {
     throw new Error(`No package.json exists at repository root ${root}.`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(manifestPath, "utf8"));
+    parsed = JSON.parse(readFileSync13(manifestPath, "utf8"));
   } catch (cause) {
     throw new Error(`Cannot read ${manifestPath}: ${cause instanceof Error ? cause.message : String(cause)}`);
   }
@@ -15128,21 +16213,21 @@ function manifestName(root) {
 }
 function checkedEntrypoint(root, parts) {
   const candidate = join11(root, ...parts);
-  if (!existsSync8(candidate) || !lstatSync7(candidate).isFile()) {
+  if (!existsSync10(candidate) || !lstatSync8(candidate).isFile()) {
     throw new Error(`The reviewed operation entrypoint is missing: ${candidate}`);
   }
-  if (lstatSync7(candidate).isSymbolicLink()) {
+  if (lstatSync8(candidate).isSymbolicLink()) {
     throw new Error(`The reviewed operation entrypoint must not be a symbolic link: ${candidate}`);
   }
-  const actual = realpathSync4(candidate);
-  const within = relative(root, actual);
-  if (within.startsWith("..") || isAbsolute3(within)) {
+  const actual = realpathSync5(candidate);
+  const within = relative2(root, actual);
+  if (within.startsWith("..") || isAbsolute4(within)) {
     throw new Error(`The reviewed operation entrypoint escapes repository root ${root}.`);
   }
   return actual;
 }
 function resolveRepositoryOperation(operation, requestedRoot) {
-  const root = realpathSync4(resolve6(requestedRoot));
+  const root = realpathSync5(resolve8(requestedRoot));
   const name = manifestName(root);
   if (operation in API_OPERATION_ENTRYPOINTS) {
     const parts = API_OPERATION_ENTRYPOINTS[operation];
@@ -15155,7 +16240,7 @@ function resolveRepositoryOperation(operation, requestedRoot) {
       };
     }
     if (name === "forgezero") {
-      const apiRoot = realpathSync4(join11(root, "api"));
+      const apiRoot = realpathSync5(join11(root, "api"));
       if (manifestName(apiRoot) !== "@forgezero/api") {
         throw new Error(`${apiRoot} is not the ForgeZero API package.`);
       }
@@ -15443,7 +16528,7 @@ async function api(options, path, init) {
   return { status: response.status, body };
 }
 function sleep(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -15528,7 +16613,7 @@ function requireSession() {
 function readOwnerOnlySecret(path, label) {
   let metadata;
   try {
-    metadata = lstatSync8(path);
+    metadata = lstatSync9(path);
   } catch {
     throw new Error(`The ${label} file ${path} is unreadable.`);
   }
@@ -15542,7 +16627,7 @@ function readOwnerOnlySecret(path, label) {
   if (uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error(`The ${label} file ${path} is not owned by the current user.`);
   }
-  const value = readFileSync12(path, "utf8").trim();
+  const value = readFileSync14(path, "utf8").trim();
   if (!value)
     throw new Error(`The ${label} file ${path} is empty.`);
   return value;
@@ -15666,13 +16751,13 @@ async function cmdRoutes(options, search) {
       throw new Error("This API does not expose the CLI action catalog yet. Update the ForgeZero API first.");
     }
     const needle = search?.trim().toLowerCase();
-    const actions = needle ? body.actions.filter((action) => `${action.method} ${action.path} ${action.label} ${action.page}`.toLowerCase().includes(needle)) : body.actions;
+    const actions2 = needle ? body.actions.filter((action) => `${action.method} ${action.path} ${action.label} ${action.page}`.toLowerCase().includes(needle)) : body.actions;
     if (options.json) {
-      out.line(JSON.stringify({ api: options.api, realm: options.realm, actions }, null, 2));
+      out.line(JSON.stringify({ api: options.api, realm: options.realm, actions: actions2 }, null, 2));
       return 0;
     }
     out.line(`Authorized UI actions for ${options.realm}${needle ? ` matching "${search}"` : ""}:`);
-    for (const action of actions) {
+    for (const action of actions2) {
       out.line(`  ${action.method.padEnd(6)} ${action.path}${action.freshProof ? "  [fresh proof]" : ""}`);
       out.step(`${action.label} \xB7 page ${action.page}`);
     }
@@ -15723,7 +16808,7 @@ async function cmdApi(options, args) {
     let body = undefined;
     if (options.data !== undefined && options.dataFile)
       throw new Error("Use only one of --data or --data-file.");
-    const encoded = options.data === "-" ? await Bun.stdin.text() : options.dataFile ? readFileSync12(options.dataFile, "utf8") : options.data;
+    const encoded = options.data === "-" ? await Bun.stdin.text() : options.dataFile ? readFileSync14(options.dataFile, "utf8") : options.data;
     if (encoded !== undefined)
       body = JSON.parse(encoded);
     const result = await api(options, `${url.pathname}${url.search}`, { method, body });
@@ -15857,22 +16942,22 @@ async function cmdAgent(options, args) {
       out.line(auxiliary.unit);
     }
     out.line("  --- then ---");
-    for (const step2 of plan.steps)
-      out.step(`${step2.command}`);
+    for (const step3 of plan.steps)
+      out.step(`${step3.command}`);
     return 0;
   }
   try {
-    writeFileSync10(plan.unitPath, plan.unit, { mode: 420 });
+    writeFileSync12(plan.unitPath, plan.unit, { mode: 420 });
     out.ok(`Wrote ${plan.unitPath}`);
     for (const auxiliary of plan.auxiliaryUnits) {
-      mkdirSync9(dirname10(auxiliary.path), { recursive: true, mode: 493 });
-      writeFileSync10(auxiliary.path, auxiliary.unit, { mode: 420 });
+      mkdirSync11(dirname12(auxiliary.path), { recursive: true, mode: 493 });
+      writeFileSync12(auxiliary.path, auxiliary.unit, { mode: 420 });
       out.ok(`Wrote ${auxiliary.path}`);
     }
     if (options.enrol) {
-      if (existsSync9(enrolTokenSourcePath)) {
+      if (existsSync11(enrolTokenSourcePath)) {
         const source = statSync2(enrolTokenSourcePath);
-        const token = readFileSync12(enrolTokenSourcePath, "utf8").trim();
+        const token = readFileSync14(enrolTokenSourcePath, "utf8").trim();
         if (!source.isFile() || (source.mode & 511) !== 384 || source.uid !== 0) {
           throw new Error("The preloaded enrolment token must be a root-owned 0600 file in /run.");
         }
@@ -15885,18 +16970,18 @@ async function cmdAgent(options, args) {
         if (await prompt.exited !== 0 || !/^fze_[A-Za-z0-9_-]{40,100}$/.test(token)) {
           throw new Error("A valid fze_ enrolment token was not provided.");
         }
-        writeFileSync10(enrolTokenSourcePath, `${token}
+        writeFileSync12(enrolTokenSourcePath, `${token}
 `, { mode: 384, flag: "wx" });
       }
     }
     const transcript = await applyPlan(plan, localRunner);
-    for (const step2 of transcript)
-      out.ok(step2.label);
+    for (const step3 of transcript)
+      out.ok(step3.label);
     out.ok("Agent service and socket verified");
     out.line();
     out.line("  Add this machine-specific PUBLIC key as a read-only deploy key:");
     out.line();
-    out.line(`  ${readFileSync12(gitPublicKeyPath, "utf8").trim()}`);
+    out.line(`  ${readFileSync14(gitPublicKeyPath, "utf8").trim()}`);
     out.line();
     return 0;
   } catch (cause) {
@@ -15985,19 +17070,19 @@ function interactiveMetalBootstrap() {
   });
 }
 function writeBootstrapConfig(path, config) {
-  if (!isAbsolute4(path) || resolve7(path) !== path)
+  if (!isAbsolute5(path) || resolve9(path) !== path)
     throw new Error("--output must be a canonical absolute path");
-  mkdirSync9(dirname10(path), { recursive: true, mode: 448 });
-  writeFileSync10(path, `${JSON.stringify(config, null, 2)}
+  mkdirSync11(dirname12(path), { recursive: true, mode: 448 });
+  writeFileSync12(path, `${JSON.stringify(config, null, 2)}
 `, { mode: 384, flag: "wx" });
   return path;
 }
 function genesisOutputDirectory(path) {
-  if (!isAbsolute4(path) || resolve7(path) !== path)
+  if (!isAbsolute5(path) || resolve9(path) !== path)
     throw new Error("--output must be a canonical absolute directory");
-  if (!existsSync9(path))
-    mkdirSync9(path, { recursive: true, mode: 448 });
-  const metadata = lstatSync8(path);
+  if (!existsSync11(path))
+    mkdirSync11(path, { recursive: true, mode: 448 });
+  const metadata = lstatSync9(path);
   const uid = process.getuid?.();
   if (!metadata.isDirectory() || metadata.isSymbolicLink() || (metadata.mode & 63) !== 0 || uid !== undefined && uid !== 0 && metadata.uid !== uid) {
     throw new Error("platform genesis output must be an owner-only directory owned by the current user");
@@ -16006,8 +17091,8 @@ function genesisOutputDirectory(path) {
 }
 function ensureGenesisClusterSecret(directory) {
   const path = `${directory}/cluster-bootstrap.code`;
-  if (!existsSync9(path))
-    writeFileSync10(path, `${randomBytes10(32).toString("hex")}
+  if (!existsSync11(path))
+    writeFileSync12(path, `${randomBytes10(32).toString("hex")}
 `, { mode: 384, flag: "wx" });
   if (!/^[a-f0-9]{64}$/i.test(readOwnerOnlySecret(path, "cluster bootstrap code"))) {
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
@@ -16264,8 +17349,8 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     const installedBootstrapKind = () => resolveInstalledBootstrapKind({
-      metal: existsSync9(METAL_BOOTSTRAP_STATE_PATH),
-      compute: existsSync9(BOOTSTRAP_STATE_PATH)
+      metal: existsSync11(METAL_BOOTSTRAP_STATE_PATH),
+      compute: existsSync11(BOOTSTRAP_STATE_PATH)
     });
     if (operation === "status") {
       if (installedBootstrapKind() === "metal") {
@@ -16389,7 +17474,7 @@ async function cmdUnlock(options) {
     if (options.key || options.userExplicit) {
       throw new Error("SSH/user unlock coordinates are not accepted. SSH keys cannot open a WebAuthn-PRF custody envelope; use --phrase-file or --phrase-stdin.");
     }
-    const phraseText = options.phraseFile ? readOwnerOnlySecret(options.phraseFile, "recovery phrase") : options.phraseStdin ? readFileSync12(0, "utf8").trim() : "";
+    const phraseText = options.phraseFile ? readOwnerOnlySecret(options.phraseFile, "recovery phrase") : options.phraseStdin ? readFileSync14(0, "utf8").trim() : "";
     const phrase = phraseText ? phraseText.split(/\s+/) : [];
     if (phrase.length !== 24) {
       throw new Error(`Recovery phrase must contain exactly 24 words; received ${phrase.length}. Use --phrase-file or --phrase-stdin.`);
@@ -16605,7 +17690,7 @@ function projectFromCheckout(options) {
   try {
     return loadConfig({
       cwd: options.projectRoot,
-      readFile: (path) => existsSync9(path) ? readFileSync12(path, "utf8") : undefined
+      readFile: (path) => existsSync11(path) ? readFileSync14(path, "utf8") : undefined
     }).config.project;
   } catch (cause) {
     throw new Error(`No --project was given and the checkout has no usable .fz/config.json: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -16653,24 +17738,69 @@ async function cmdDeploy(options, args) {
     if (options.optionError)
       throw new Error(options.optionError);
     if (operation === "init") {
-      const created = initializeDeployFile(options.projectRoot, {
-        name: options.projectName,
-        profile: options.deployProfile,
-        software: softwareCoordinates(options.deploySoftware),
-        requireAttestation: options.requireAttestation,
-        channel: options.deployChannel,
-        force: options.force
-      });
+      if (options.deploySoftware.length > 0 || options.deployProfile !== "app" || options.requireAttestation) {
+        const created = initializeDeployFile(options.projectRoot, {
+          name: options.projectName,
+          profile: options.deployProfile,
+          software: softwareCoordinates(options.deploySoftware),
+          requireAttestation: options.requireAttestation,
+          channel: options.deployChannel,
+          force: options.force
+        });
+        if (options.json)
+          out.line(JSON.stringify(created.summary, null, 2));
+        else
+          out.ok(`Initialized legacy .fz/deploy.json (${created.summary.digest}).`);
+        return 0;
+      }
+      initializeTypeScriptDeployment(options.projectRoot, { name: options.projectName ?? basename3(resolve9(options.projectRoot)), force: options.force });
+      const compiled = await compileDeploymentProject(options.projectRoot);
       if (options.json)
-        out.line(JSON.stringify(created.summary, null, 2));
+        out.line(JSON.stringify({ source: compiled.source, output: compiled.output, digest: compiled.digest }, null, 2));
       else {
-        out.ok(`Initialized .fz/deploy.json (${created.summary.digest}).`);
-        out.warn("Release and health use safe blockers until you replace them with project-specific commands.");
+        out.ok(`Initialized ${DEPLOY_SOURCE_FILE} and ${DEPLOY_PLAN_FILE} (${compiled.digest}).`);
+        out.warn("Build and release use safe blockers until you replace them with project-specific typed actions.");
         out.step("Run `fz deploy check`, commit the file, then push; the verified Git commit is the live sync.");
       }
       return 0;
     }
+    if (operation === "compile") {
+      const compiled = await compileDeploymentProject(options.projectRoot);
+      const problems = canonicalJson(compiled.plan).includes("pipeline-todo") ? ["typed plan contains safe initialization blockers"] : [];
+      const summary = { source: compiled.source, output: compiled.output, digest: compiled.digest, changed: compiled.changed, ready: problems.length === 0, problems };
+      if (options.json)
+        out.line(JSON.stringify(summary, null, 2));
+      else {
+        out.ok(`Compiled ${DEPLOY_SOURCE_FILE} \u2192 ${DEPLOY_PLAN_FILE} (${compiled.digest}).`);
+        for (const problem of problems)
+          out.warn(problem);
+      }
+      return problems.length === 0 ? 0 : 1;
+    }
     if (operation === "check" || operation === "sync") {
+      if (existsSync11(resolve9(options.projectRoot, DEPLOY_SOURCE_FILE))) {
+        const expected = await compileDeploymentProject(options.projectRoot, { write: false });
+        const actual = inspectCompiledDeployment(options.projectRoot);
+        const current = canonicalJson(expected.plan) === canonicalJson(actual.plan);
+        const problems = [
+          ...current ? [] : [`${DEPLOY_PLAN_FILE} is stale; run \`fz deploy compile\``],
+          ...canonicalJson(expected.plan).includes("pipeline-todo") ? ["typed plan contains safe initialization blockers"] : []
+        ];
+        const summary = { source: expected.source, output: actual.path, digest: actual.digest, version: actual.plan.version, name: actual.plan.name, ready: problems.length === 0, problems };
+        if (options.json)
+          out.line(JSON.stringify(summary, null, 2));
+        else {
+          out.step(`${summary.name} \xB7 plan v${summary.version} \xB7 ${summary.digest}`);
+          for (const problem of problems)
+            out.fail(problem);
+          if (summary.ready) {
+            out.ok("TypeScript definition and canonical execution plan are current.");
+            if (operation === "sync")
+              out.step("Commit both files. ForgeZero executes only the reviewed plan.");
+          }
+        }
+        return summary.ready ? 0 : 1;
+      }
       const inspected = inspectDeployFile(options.projectRoot, { channel: options.deployChannel });
       if (options.json)
         out.line(JSON.stringify(inspected.summary, null, 2));
@@ -16724,7 +17854,7 @@ async function cmdDeploy(options, args) {
         branch: options.branch,
         cloneUrl: required(options.cloneUrl, "--clone-url"),
         sourceAuth,
-        ...options.knownHostsFile ? { knownHosts: readFileSync12(options.knownHostsFile, "utf8") } : {},
+        ...options.knownHostsFile ? { knownHosts: readFileSync14(options.knownHostsFile, "utf8") } : {},
         projectKey
       } });
       const pipelineKey2 = String(created.pipelineKey);
@@ -16784,7 +17914,7 @@ async function cmdDeploy(options, args) {
       out.line(JSON.stringify(await deploymentRequest(options, "/rotate", { method: "POST", body: { pipelineKey } }), null, 2));
       return 0;
     }
-    out.fail("Usage: fz deploy init|check|sync|catalog|list|connect|attach|runs|release|enable|disable|target-enable|target-disable|rotate");
+    out.fail("Usage: fz deploy init|compile|check|sync|catalog|list|connect|attach|runs|release|enable|disable|target-enable|target-disable|rotate");
     return 2;
   } catch (cause) {
     out.fail(cause instanceof Error ? cause.message : String(cause));
@@ -16847,8 +17977,9 @@ function usage() {
     fz project init         Create vendor-neutral, Git-persisted AI context
     fz project sync         Regenerate Claude/Codex/Gemini/Copilot/Cursor adapters
     fz project check        Fail when truth sources or generated adapters drift
-    fz deploy init          Create a typed, fail-safe .fz/deploy.json
-    fz deploy check         Validate commands, profiles and software coordinates
+    fz deploy init          Create forgezero.deploy.ts and its fail-safe canonical plan
+    fz deploy compile       Compile TypeScript into .fz/deploy.plan.json
+    fz deploy check         Validate source, plan, actions, providers and topology
     fz deploy sync          Prove readiness and print the Git synchronization rule
     fz deploy catalog       List selectable tested OS/software coordinates
 	 fz deploy list          List pipelines for .fz/config.json's project