@forgezero/agent 0.1.53 → 0.1.56

package/dist/fz-agent.js

@@ -3,9 +3,9 @@
 
 // src/index.ts
 import { randomBytes as randomBytes6 } from "crypto";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync15, existsSync as existsSync18, mkdirSync as mkdirSync15, chmodSync as chmodSync17, lstatSync as lstatSync8, statfsSync } from "fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync16, existsSync as existsSync20, mkdirSync as mkdirSync16, chmodSync as chmodSync17, lstatSync as lstatSync8, statfsSync as statfsSync2 } from "fs";
 import { cpus, totalmem } from "os";
-import { dirname as dirname11, join as join12 } from "path";
+import { dirname as dirname12, join as join12 } from "path";
 
 // ../access/dist/security.js
 var HEX = Array.from({ length: 256 }, (_, index) => index.toString(16).padStart(2, "0"));
@@ -4641,8 +4641,8 @@ function safeOp(line) {
 }
 
 // src/deployment.ts
-import { chmodSync as chmodSync3, existsSync as existsSync2, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "fs";
-import { createHash as createHash3, randomUUID } from "crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync as renameSync2, statfsSync, writeFileSync as writeFileSync2 } from "fs";
+import { createHash as createHash4, randomUUID } from "crypto";
 import { dirname, isAbsolute as isAbsolute2, join as join2 } from "path";
 
 // ../runtime/dist/queue.js
@@ -4953,6 +4953,7 @@ import {
   accessSync,
   chmodSync as chmodSync2,
   copyFileSync,
+  existsSync as existsSync2,
   mkdtempSync,
   mkdirSync,
   readFileSync,
@@ -4973,6 +4974,7 @@ var OS_CATALOG = [
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4982,6 +4984,7 @@ var SOFTWARE_CATALOG = [
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-26.04" } },
   { requirement: { id: "nginx", version: "ubuntu-26.04" } },
   { requirement: { id: "arangodb", version: "3.11.14" } },
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
@@ -4990,6 +4993,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
 ];
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
 var softwareSpawnFailure = (cause, argv) => cause.code === "ENOENT" ? { exitCode: 127, output: `executable is absent: ${argv[0]}` } : undefined;
 var runSoftwareCommand = async (argv, env = {}) => {
   let child;
@@ -5032,6 +5044,15 @@ async function executeSoftwareOperation(operation) {
   if (operation.kind === "check") {
     if (software === "bun")
       return run(["/usr/local/bin/bun", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /^1\.3\.14\s*$/m) ? 0 : 1 }));
+    if (software === "docker") {
+      const binary = await run(["/usr/bin/docker", "--version"]);
+      if (!successful(binary, /Docker version/))
+        return { ...binary, exitCode: 1 };
+      if (!existsSync2(DOCKER_DAEMON_PATH) || readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG)
+        return { exitCode: 1, output: "Docker daemon policy is absent or differs from the reviewed ForgeZero policy" };
+      const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "docker.service"]);
+      return active.exitCode === 0 ? { exitCode: 0, output: binary.output } : active;
+    }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
       return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
@@ -5064,11 +5085,22 @@ async function executeSoftwareOperation(operation) {
       return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
     }
   }
-  if (software === "nginx" || software === "ufw" || software === "openssh-client") {
-    const installed = await aptInstall(software === "openssh-client" ? "openssh-client" : software);
-    if (installed.exitCode !== 0 || software !== "nginx")
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client") {
+    const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
+    const installed = await aptInstall(packageName);
+    if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
-    return run(["/usr/bin/systemctl", "enable", "--now", "nginx.service"]);
+    if (software === "docker") {
+      mkdirSync("/etc/docker", { recursive: true, mode: 493 });
+      if (existsSync2(DOCKER_DAEMON_PATH) && readFileSync(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG) {
+        return { exitCode: 2, output: "refusing to overwrite an existing Docker daemon configuration that differs from the reviewed ForgeZero policy" };
+      }
+      if (!existsSync2(DOCKER_DAEMON_PATH))
+        writeFileSync(DOCKER_DAEMON_PATH, DOCKER_DAEMON_CONFIG, { mode: 420, flag: "wx" });
+      const enabled = await run(["/usr/bin/systemctl", "enable", "docker.service"]);
+      return enabled.exitCode === 0 ? run(["/usr/bin/systemctl", "restart", "docker.service"]) : enabled;
+    }
+    return run(["/usr/bin/systemctl", "enable", "--now", `${software}.service`]);
   }
   const directory = mkdtempSync(join(tmpdir(), "forgezero-software-"));
   try {
@@ -5153,7 +5185,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -5888,6 +5920,1206 @@ async function runPipeline(options) {
   return { pipeline: pipeline.name, ok: !failed, assurance, steps };
 }
 
+// src/deploy-plan.ts
+import { createHash as createHash3 } from "crypto";
+
+// src/deploy-actions.ts
+var row = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${where} must be an object`);
+  return value;
+};
+var exact = (value, keys, where) => {
+  const unknown = Object.keys(value).filter((key) => !keys.includes(key));
+  if (unknown.length)
+    throw new Error(`${where} contains unknown field(s): ${unknown.join(", ")}`);
+  for (const key of keys)
+    if (value[key] === undefined)
+      throw new Error(`${where} requires ${key}`);
+};
+var component = (value, components, where) => {
+  if (typeof value !== "string" || !components[value])
+    throw new Error(`${where}.component must name an existing component`);
+  return components[value];
+};
+var exactArgv = (value, where) => {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 256 || value.some((entry) => typeof entry !== "string" || entry.length < 1 || entry.length > 16384 || entry.includes("\x00")))
+    throw new Error(`${where} requires a bounded exact argv array`);
+  const executable = value[0].split("/").at(-1).toLowerCase();
+  if (["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"].includes(executable))
+    throw new Error(`${where} cannot invoke a command dispatcher`);
+};
+function validateBuiltInAction(definition, context, where) {
+  if (!definition.uses.startsWith("forgezero."))
+    return;
+  const withValue = row(definition.with, `${where}.with`);
+  if (definition.uses === "forgezero.software/ensure@1") {
+    exact(withValue, ["requirements"], `${where}.with`);
+    if (!Array.isArray(withValue.requirements) || withValue.requirements.length < 1 || withValue.requirements.length > 64 || withValue.requirements.some((name) => typeof name !== "string" || !context.requirements[name]))
+      throw new Error(`${where}.with.requirements must name existing requirements`);
+    return;
+  }
+  if (definition.uses === "forgezero.exec/argv@1") {
+    const allowed = ["component", "argv", "credentials"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    component(withValue.component, context.components, `${where}.with`);
+    exactArgv(withValue.argv, `${where}.with.argv`);
+    if (withValue.credentials !== undefined) {
+      const bindings = row(withValue.credentials, `${where}.with.credentials`);
+      for (const [environment, credentialName] of Object.entries(bindings))
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(environment) || typeof credentialName !== "string" || !context.credentials[credentialName])
+          throw new Error(`${where}.with.credentials contains an invalid binding`);
+    }
+    return;
+  }
+  if (["forgezero.oci/build@1", "forgezero.oci/pull@1"].includes(definition.uses)) {
+    const allowed = definition.uses.endsWith("/build@1") ? ["component", "noCache"] : ["component"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    const selected = component(withValue.component, context.components, `${where}.with`);
+    if (selected.kind !== "application" || selected.runtime.kind !== "container")
+      throw new Error(`${where}.with.component must use a container runtime`);
+    if (withValue.noCache !== undefined && typeof withValue.noCache !== "boolean")
+      throw new Error(`${where}.with.noCache must be a boolean`);
+    return;
+  }
+  if (["forgezero.service/deploy@1", "forgezero.service/promote@1", "forgezero.health/http@1", "forgezero.storage/verify@1"].includes(definition.uses)) {
+    const allowed = definition.uses === "forgezero.service/deploy@1" || definition.uses === "forgezero.service/promote@1" ? ["component", "imageDigest"] : ["component"];
+    const unknown = Object.keys(withValue).filter((key) => !allowed.includes(key));
+    if (unknown.length)
+      throw new Error(`${where}.with contains unknown field(s): ${unknown.join(", ")}`);
+    component(withValue.component, context.components, `${where}.with`);
+    return;
+  }
+  throw new Error(`${where}.uses is an unknown ForgeZero action`);
+}
+// src/deploy-providers.ts
+var plain = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var exact2 = (row2, keys, provider) => {
+  const unknown = Object.keys(row2).filter((key) => !keys.includes(key));
+  if (unknown.length)
+    throw new Error(`${provider} config contains unknown field(s): ${unknown.join(", ")}`);
+  for (const key of keys)
+    if (row2[key] === undefined)
+      throw new Error(`${provider} config requires ${key}`);
+};
+var absolute = (value) => typeof value === "string" && /^\/(?:[A-Za-z0-9._-]+\/?)*$/.test(value) && !value.includes("..");
+function validateBuiltInProvider(requirement2, where) {
+  const row2 = plain(requirement2.config);
+  if (!requirement2.provider.startsWith("forgezero."))
+    return;
+  const expected = {
+    "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
+    "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
+    "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
+  };
+  const contract = expected[requirement2.provider];
+  if (!contract)
+    throw new Error(`${where} uses unknown built-in provider ${requirement2.provider}`);
+  if (requirement2.contract !== 1 || requirement2.capability !== contract.capability || !contract.versions.includes(requirement2.version))
+    throw new Error(`${where} provider coordinate is unsupported`);
+  exact2(row2, contract.keys, requirement2.provider);
+  if (row2.installScope !== "host")
+    throw new Error(`${where}.config.installScope must be host`);
+  if (requirement2.provider === "forgezero.docker") {
+    if (row2.storageDriver !== "overlay2" || row2.dataRoot !== "/var/lib/docker" || row2.liveRestore !== true || row2.logDriver !== "local" || row2.defaultNetwork !== "bridge" || row2.rootless !== false)
+      throw new Error(`${where} Docker config is unsupported by the fixed host strategy`);
+  }
+  if (requirement2.provider === "forgezero.nginx" && (typeof row2.websocket !== "boolean" || !Number.isInteger(row2.maximumBodyMiB) || Number(row2.maximumBodyMiB) < 1 || Number(row2.maximumBodyMiB) > 1024 || !(row2.workerProcesses === "auto" || Number.isInteger(row2.workerProcesses)) || !Number.isInteger(row2.workerConnections)))
+    throw new Error(`${where} Nginx config is invalid`);
+  if (requirement2.provider === "forgezero.arangodb" && (row2.runtime !== "native" || !absolute(row2.dataPath) || row2.bind !== "private"))
+    throw new Error(`${where} ArangoDB config is invalid`);
+}
+
+// src/deploy-plan.ts
+var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
+var DEPLOY_PLAN_VERSION = 1;
+
+class DeploymentPlanError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DeploymentPlanError";
+  }
+}
+var NAME2 = /^[a-z][A-Za-z0-9-]{0,62}$/;
+var COORDINATE = /^[a-z][a-z0-9.-]{0,127}$/;
+var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
+var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
+var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
+var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+var fail = (where, message) => {
+  throw new DeploymentPlanError(`${where} ${message}`);
+};
+var object = (value, where) => {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    fail(where, "must be an object.");
+  return value;
+};
+var exact3 = (value, allowed, where) => {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    fail(where, `contains unknown field(s): ${unknown.join(", ")}.`);
+};
+var named = (value, where) => {
+  if (typeof value !== "string" || !NAME2.test(value))
+    fail(where, "must be a lowercase typed name.");
+  return value;
+};
+var boundedString = (value, where, maximum = 256) => {
+  if (typeof value !== "string" || value.length < 1 || value.length > maximum || value.includes("\x00"))
+    fail(where, `must be a non-empty string of at most ${maximum} characters.`);
+  return value;
+};
+var integer = (value, where, minimum, maximum) => {
+  if (!Number.isInteger(value) || value < minimum || value > maximum)
+    fail(where, `must be an integer from ${minimum} to ${maximum}.`);
+  return value;
+};
+var number = (value, where, minimum, maximum) => {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < minimum || value > maximum)
+    fail(where, `must be a finite number from ${minimum} to ${maximum}.`);
+  return value;
+};
+function canonicalJson(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string")
+    return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new DeploymentPlanError("deployment data contains a non-finite number.");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
+    return `{${Object.entries(value).filter(([, entry]) => entry !== undefined).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+  }
+  throw new DeploymentPlanError("deployment data must contain only plain JSON values.");
+}
+function deploymentSourceDigest(source) {
+  return `sha256:${createHash3("sha256").update(canonicalJson(source)).digest("hex")}`;
+}
+function reference(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["$ref"], where);
+  const coordinate = boundedString(row2.$ref, `${where}.$ref`, 256);
+  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62})$/.test(coordinate)) {
+    fail(where, "contains an unsupported reference.");
+  }
+  return { $ref: coordinate };
+}
+function operand(value, where) {
+  if (value === null || ["string", "number", "boolean"].includes(typeof value)) {
+    if (typeof value === "number" && !Number.isFinite(value))
+      fail(where, "must be finite.");
+    return value;
+  }
+  return reference(value, where);
+}
+function condition(value, where, depth = 0) {
+  if (depth > 16)
+    fail(where, "is nested too deeply.");
+  const row2 = object(value, where);
+  if (Object.keys(row2).length !== 1)
+    fail(where, "must contain exactly one operator.");
+  const [operator, body] = Object.entries(row2)[0];
+  if (operator === "all" || operator === "any") {
+    if (!Array.isArray(body) || body.length < 1 || body.length > 32)
+      fail(where, `${operator} must contain 1 to 32 conditions.`);
+    const entries = body;
+    return { [operator]: entries.map((entry, index) => condition(entry, `${where}.${operator}[${index}]`, depth + 1)) };
+  }
+  if (operator === "not")
+    return { not: condition(body, `${where}.not`, depth + 1) };
+  if (["equals", "notEquals", "greaterThan", "greaterThanOrEqual", "lessThan", "lessThanOrEqual", "contains", "startsWith"].includes(operator)) {
+    if (!Array.isArray(body) || body.length !== 2)
+      fail(where, `${operator} must contain two operands.`);
+    const entries = body;
+    return { [operator]: [operand(entries[0], `${where}.${operator}[0]`), operand(entries[1], `${where}.${operator}[1]`)] };
+  }
+  if (operator === "exists")
+    return { exists: reference(body, `${where}.exists`) };
+  if (["succeeded", "failed", "changed"].includes(operator))
+    return { [operator]: named(body, `${where}.${operator}`) };
+  return fail(where, `uses unsupported operator ${operator}.`);
+}
+function jsonValue(value, where, depth = 0) {
+  if (depth > 16)
+    fail(where, "is nested too deeply.");
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      fail(where, "must be finite.");
+    return value;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 1000)
+      fail(where, "contains more than 1000 entries.");
+    return value.map((entry, index) => jsonValue(entry, `${where}[${index}]`, depth + 1));
+  }
+  const row2 = object(value, where);
+  if (Object.keys(row2).length > 1000)
+    fail(where, "contains more than 1000 fields.");
+  return Object.fromEntries(Object.entries(row2).map(([key, entry]) => [key, jsonValue(entry, `${where}.${key}`, depth + 1)]));
+}
+function validateInput(value, where) {
+  const row2 = object(value, where);
+  const type = row2.type;
+  const common = ["type", "required", "default"];
+  if (row2.required !== undefined && typeof row2.required !== "boolean")
+    fail(`${where}.required`, "must be a boolean.");
+  if (type === "string") {
+    exact3(row2, [...common, "minimumLength", "maximumLength", "pattern"], where);
+    if (row2.default !== undefined)
+      boundedString(row2.default, `${where}.default`, 16384);
+    if (row2.minimumLength !== undefined)
+      integer(row2.minimumLength, `${where}.minimumLength`, 0, 16384);
+    if (row2.maximumLength !== undefined)
+      integer(row2.maximumLength, `${where}.maximumLength`, 1, 16384);
+    if (row2.pattern !== undefined) {
+      const pattern = boundedString(row2.pattern, `${where}.pattern`, 512);
+      try {
+        new RegExp(pattern);
+      } catch {
+        fail(`${where}.pattern`, "must be a valid regular expression.");
+      }
+    }
+  } else if (type === "integer" || type === "number") {
+    exact3(row2, [...common, "minimum", "maximum"], where);
+    if (row2.default !== undefined)
+      number(row2.default, `${where}.default`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (row2.minimum !== undefined)
+      number(row2.minimum, `${where}.minimum`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (row2.maximum !== undefined)
+      number(row2.maximum, `${where}.maximum`, -Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
+    if (type === "integer" && row2.default !== undefined && !Number.isInteger(row2.default))
+      fail(`${where}.default`, "must be an integer.");
+  } else if (type === "boolean") {
+    exact3(row2, common, where);
+    if (row2.default !== undefined && typeof row2.default !== "boolean")
+      fail(`${where}.default`, "must be a boolean.");
+  } else if (type === "enum") {
+    exact3(row2, [...common, "values"], where);
+    if (!Array.isArray(row2.values) || row2.values.length < 1 || row2.values.length > 64)
+      fail(`${where}.values`, "must contain 1 to 64 values.");
+    const values = row2.values.map((entry, index) => boundedString(entry, `${where}.values[${index}]`, 128));
+    if (new Set(values).size !== values.length)
+      fail(`${where}.values`, "must be unique.");
+    if (row2.default !== undefined && !values.includes(row2.default))
+      fail(`${where}.default`, "must be an enum value.");
+  } else if (type === "hostname") {
+    exact3(row2, common, where);
+    if (row2.default !== undefined && !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(String(row2.default)))
+      fail(`${where}.default`, "must be a hostname.");
+  } else
+    fail(`${where}.type`, "is unsupported.");
+  return row2;
+}
+function validateRequirement(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["capability", "provider", "contract", "version", "config", "when"], where);
+  if (!COORDINATE.test(String(row2.capability)))
+    fail(`${where}.capability`, "is invalid.");
+  if (!COORDINATE.test(String(row2.provider)))
+    fail(`${where}.provider`, "is invalid.");
+  integer(row2.contract, `${where}.contract`, 1, 65535);
+  if (typeof row2.version !== "string" || !VERSION.test(row2.version))
+    fail(`${where}.version`, "is invalid.");
+  jsonValue(row2.config, `${where}.config`);
+  if (row2.when !== undefined)
+    condition(row2.when, `${where}.when`);
+  const requirement2 = row2;
+  validateBuiltInProvider(requirement2, where);
+  return requirement2;
+}
+function validateArgv(value, where) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 256)
+    fail(where, "must contain 1 to 256 arguments.");
+  let bytes = 0;
+  const values = value.map((entry, index) => {
+    const result = boundedString(entry, `${where}[${index}]`, 16384);
+    bytes += Buffer.byteLength(result);
+    return result;
+  });
+  if (bytes > 64 * 1024)
+    fail(where, "is larger than 64 KiB.");
+  const executable = values[0].split("/").at(-1).toLowerCase();
+  if (["sh", "bash", "dash", "zsh", "ksh", "fish", "busybox", "env"].includes(executable))
+    fail(`${where}[0]`, "may not invoke a command dispatcher.");
+  return values;
+}
+function validateResources(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["cpu", "memory", "pids", "io"], where);
+  if (row2.cpu !== undefined) {
+    const cpu = object(row2.cpu, `${where}.cpu`);
+    exact3(cpu, ["limit", "weight", "pinning"], `${where}.cpu`);
+    number(cpu.limit, `${where}.cpu.limit`, 0.01, 1024);
+    if (cpu.weight !== undefined)
+      integer(cpu.weight, `${where}.cpu.weight`, 1, 1e4);
+    if (cpu.pinning !== undefined && !["automatic", "dedicated"].includes(String(cpu.pinning)))
+      fail(`${where}.cpu.pinning`, "is unsupported.");
+  }
+  if (row2.memory !== undefined) {
+    const memory = object(row2.memory, `${where}.memory`);
+    exact3(memory, ["limitMiB", "reservationMiB", "swap"], `${where}.memory`);
+    integer(memory.limitMiB, `${where}.memory.limitMiB`, 16, 16777216);
+    if (memory.reservationMiB !== undefined && integer(memory.reservationMiB, `${where}.memory.reservationMiB`, 1, memory.limitMiB) > memory.limitMiB)
+      fail(`${where}.memory.reservationMiB`, "must not exceed limitMiB.");
+    if (memory.swap !== undefined && !["disabled", "bounded"].includes(String(memory.swap)))
+      fail(`${where}.memory.swap`, "is unsupported.");
+  }
+  if (row2.pids !== undefined) {
+    const pids = object(row2.pids, `${where}.pids`);
+    exact3(pids, ["limit"], `${where}.pids`);
+    integer(pids.limit, `${where}.pids.limit`, 1, 1048576);
+  }
+  if (row2.io !== undefined) {
+    const io = object(row2.io, `${where}.io`);
+    exact3(io, ["weight", "readBps", "writeBps", "readIops", "writeIops"], `${where}.io`);
+    for (const key of Object.keys(io))
+      integer(io[key], `${where}.io.${key}`, 1, Number.MAX_SAFE_INTEGER);
+  }
+}
+function validateStorage(value, where) {
+  const row2 = object(value, where);
+  if (row2.class === "ephemeral") {
+    exact3(row2, ["class", "path", "type", "sizeMiB"], where);
+    if (row2.type !== "tmpfs")
+      fail(`${where}.type`, "must be tmpfs.");
+    integer(row2.sizeMiB, `${where}.sizeMiB`, 1, 1048576);
+  } else if (row2.class === "persistent") {
+    exact3(row2, ["class", "name", "path", "minimumFreePercent"], where);
+    named(row2.name, `${where}.name`);
+    if (row2.minimumFreePercent !== undefined)
+      integer(row2.minimumFreePercent, `${where}.minimumFreePercent`, 1, 95);
+  } else if (row2.class === "database") {
+    exact3(row2, ["class", "name", "path", "minimumFreePercent", "minimumIops", "latencyTargetMs"], where);
+    named(row2.name, `${where}.name`);
+    integer(row2.minimumFreePercent, `${where}.minimumFreePercent`, 1, 95);
+    if (row2.minimumIops !== undefined)
+      integer(row2.minimumIops, `${where}.minimumIops`, 1, 1e8);
+    if (row2.latencyTargetMs !== undefined)
+      number(row2.latencyTargetMs, `${where}.latencyTargetMs`, 0.01, 60000);
+  } else
+    fail(`${where}.class`, "is unsupported.");
+  if (typeof row2.path !== "string" || !ABSOLUTE_PATH.test(row2.path) || row2.path.includes(".."))
+    fail(`${where}.path`, "must be a normalized absolute path.");
+}
+function validateNetwork(value, where) {
+  const row2 = object(value, where);
+  exact3(row2, ["ingress", "private", "public", "container"], where);
+  if (row2.ingress !== undefined) {
+    const ingress = object(row2.ingress, `${where}.ingress`);
+    exact3(ingress, ["exposure", "stablePort"], `${where}.ingress`);
+    if (!["loopback", "private", "public"].includes(String(ingress.exposure)))
+      fail(`${where}.ingress.exposure`, "is unsupported.");
+    if (ingress.stablePort !== undefined)
+      integer(ingress.stablePort, `${where}.ingress.stablePort`, 1, 65535);
+  }
+  if (row2.private !== undefined) {
+    const privateNetwork = object(row2.private, `${where}.private`);
+    exact3(privateNetwork, ["mode", "preferences"], `${where}.private`);
+    if (!["private-lan", "cloudflare-warp", "auto"].includes(String(privateNetwork.mode)))
+      fail(`${where}.private.mode`, "is unsupported.");
+    if (privateNetwork.preferences !== undefined && (!Array.isArray(privateNetwork.preferences) || privateNetwork.preferences.length < 1 || privateNetwork.preferences.length > 2 || privateNetwork.preferences.some((entry) => !["private-lan", "cloudflare-warp"].includes(String(entry))) || new Set(privateNetwork.preferences).size !== privateNetwork.preferences.length))
+      fail(`${where}.private.preferences`, "is invalid.");
+  }
+  if (row2.public !== undefined) {
+    const publicNetwork = object(row2.public, `${where}.public`);
+    exact3(publicNetwork, ["mode", "optional"], `${where}.public`);
+    if (!["disabled", "cloudflare-tunnel"].includes(String(publicNetwork.mode)))
+      fail(`${where}.public.mode`, "is unsupported.");
+    if (publicNetwork.optional !== undefined && typeof publicNetwork.optional !== "boolean")
+      fail(`${where}.public.optional`, "must be a boolean.");
+  }
+  if (row2.container !== undefined) {
+    const container = object(row2.container, `${where}.container`);
+    exact3(container, ["mode", "network"], `${where}.container`);
+    if (!["bridge", "host"].includes(String(container.mode)))
+      fail(`${where}.container.mode`, "is unsupported.");
+    if (container.network !== undefined)
+      named(container.network, `${where}.container.network`);
+  }
+}
+function validateComponent(value, where, targetNames, requirements) {
+  const row2 = object(value, where);
+  if (!targetNames.has(String(row2.target)))
+    fail(`${where}.target`, "must name an existing target.");
+  if (row2.kind === "application") {
+    exact3(row2, ["kind", "target", "runtime", "service", "resources", "storage", "network", "rollout"], where);
+    const runtime = object(row2.runtime, `${where}.runtime`);
+    const runtimeRequirement = requirements.get(String(runtime.requirement));
+    if (!runtimeRequirement)
+      fail(`${where}.runtime.requirement`, "must name an existing requirement.");
+    if (runtime.kind === "native") {
+      exact3(runtime, ["kind", "provider", "requirement", "argv"], `${where}.runtime`);
+      validateArgv(runtime.argv, `${where}.runtime.argv`);
+    } else if (runtime.kind === "container") {
+      exact3(runtime, ["kind", "provider", "requirement", "image", "entrypoint", "security"], `${where}.runtime`);
+      const image = object(runtime.image, `${where}.runtime.image`);
+      exact3(image, ["source"], `${where}.runtime.image`);
+      const source = object(image.source, `${where}.runtime.image.source`);
+      if (source.kind === "build") {
+        exact3(source, ["kind", "context", "dockerfile"], `${where}.runtime.image.source`);
+        boundedString(source.context, `${where}.runtime.image.source.context`, 512);
+        boundedString(source.dockerfile, `${where}.runtime.image.source.dockerfile`, 512);
+      } else if (source.kind === "registry") {
+        exact3(source, ["kind", "reference"], `${where}.runtime.image.source`);
+        if (!/^[-a-zA-Z0-9./:_@]+$/.test(boundedString(source.reference, `${where}.runtime.image.source.reference`, 512)))
+          fail(`${where}.runtime.image.source.reference`, "is invalid.");
+      } else
+        fail(`${where}.runtime.image.source.kind`, "is unsupported.");
+      if (runtime.entrypoint !== undefined)
+        validateArgv(runtime.entrypoint, `${where}.runtime.entrypoint`);
+      const security = object(runtime.security, `${where}.runtime.security`);
+      exact3(security, ["privileged", "noNewPrivileges", "root", "dropCapabilities"], `${where}.runtime.security`);
+      if (security.privileged !== false || security.noNewPrivileges !== true)
+        fail(`${where}.runtime.security`, "must disable privileged mode and enable noNewPrivileges.");
+      if (!["read-only", "writable"].includes(String(security.root)))
+        fail(`${where}.runtime.security.root`, "is unsupported.");
+      if (!Array.isArray(security.dropCapabilities) || !security.dropCapabilities.includes("ALL"))
+        fail(`${where}.runtime.security.dropCapabilities`, "must include ALL.");
+    } else
+      fail(`${where}.runtime.kind`, "is unsupported.");
+    if (!COORDINATE.test(String(runtime.provider)))
+      fail(`${where}.runtime.provider`, "is invalid.");
+    if (runtimeRequirement && runtime.provider !== runtimeRequirement.provider)
+      fail(`${where}.runtime.provider`, "must match its requirement provider.");
+    if (runtimeRequirement && runtime.kind === "container" && runtimeRequirement.capability !== "runtime.container")
+      fail(`${where}.runtime.requirement`, "must provide runtime.container.");
+    if (runtimeRequirement && runtime.kind === "native" && !runtimeRequirement.capability.startsWith("runtime."))
+      fail(`${where}.runtime.requirement`, "must provide a runtime capability.");
+    const service = object(row2.service, `${where}.service`);
+    exact3(service, ["protocol", "port", "health", "websocket", "maximumConnections"], `${where}.service`);
+    if (service.protocol !== "http")
+      fail(`${where}.service.protocol`, "must be http.");
+    integer(service.port, `${where}.service.port`, 1, 65535);
+    const health = object(service.health, `${where}.service.health`);
+    exact3(health, ["protocol", "method", "path", "expectedStatus", "timeoutMs", "intervalMs", "attempts"], `${where}.service.health`);
+    if (health.protocol !== "http" || !["GET", "HEAD"].includes(String(health.method)) || typeof health.path !== "string" || !HEALTH_PATH.test(health.path) || health.path.includes("..") || health.path.includes("//"))
+      fail(`${where}.service.health`, "is invalid.");
+    if (!Array.isArray(health.expectedStatus) || health.expectedStatus.length < 1 || health.expectedStatus.length > 16 || health.expectedStatus.some((status) => !Number.isInteger(status) || status < 100 || status > 599))
+      fail(`${where}.service.health.expectedStatus`, "is invalid.");
+    integer(health.timeoutMs, `${where}.service.health.timeoutMs`, 100, 300000);
+    if (health.intervalMs !== undefined)
+      integer(health.intervalMs, `${where}.service.health.intervalMs`, 100, 300000);
+    if (health.attempts !== undefined)
+      integer(health.attempts, `${where}.service.health.attempts`, 1, 1000);
+    if (service.websocket !== undefined && typeof service.websocket !== "boolean")
+      fail(`${where}.service.websocket`, "must be a boolean.");
+    if (service.maximumConnections !== undefined)
+      integer(service.maximumConnections, `${where}.service.maximumConnections`, 1, 1e7);
+    validateResources(row2.resources, `${where}.resources`);
+    if (runtime.kind === "container") {
+      const resources = object(row2.resources, `${where}.resources`);
+      for (const required of ["cpu", "memory", "pids"])
+        if (resources[required] === undefined)
+          fail(`${where}.resources.${required}`, "is required for a bounded container.");
+      if (row2.network === undefined)
+        fail(`${where}.network`, "is required for a container.");
+      const network = object(row2.network, `${where}.network`);
+      if (network.container === undefined)
+        fail(`${where}.network.container`, "must select bridge or reviewed host networking.");
+    }
+    if (row2.storage !== undefined) {
+      if (!Array.isArray(row2.storage) || row2.storage.length > 32)
+        fail(`${where}.storage`, "must contain at most 32 mounts.");
+      row2.storage.forEach((entry, index) => validateStorage(entry, `${where}.storage[${index}]`));
+    }
+    if (row2.network !== undefined)
+      validateNetwork(row2.network, `${where}.network`);
+    const rollout = object(row2.rollout, `${where}.rollout`);
+    exact3(rollout, ["strategy", "proxy", "drainMs", "automaticRollback"], `${where}.rollout`);
+    if (!["direct", "blue-green", "rolling", "canary"].includes(String(rollout.strategy)))
+      fail(`${where}.rollout.strategy`, "is unsupported.");
+    if (rollout.proxy !== undefined)
+      named(rollout.proxy, `${where}.rollout.proxy`);
+    if (rollout.strategy !== "direct") {
+      const proxyRequirement = requirements.get(String(rollout.proxy));
+      if (!proxyRequirement || proxyRequirement.capability !== "proxy.http")
+        fail(`${where}.rollout.proxy`, "must name a proxy.http requirement for managed rollout.");
+    }
+    if (rollout.drainMs !== undefined)
+      integer(rollout.drainMs, `${where}.rollout.drainMs`, 0, 600000);
+    if (rollout.automaticRollback !== undefined && typeof rollout.automaticRollback !== "boolean")
+      fail(`${where}.rollout.automaticRollback`, "must be a boolean.");
+  } else if (row2.kind === "database") {
+    exact3(row2, ["kind", "target", "runtime", "topology", "resources", "storage", "network"], where);
+    const runtime = object(row2.runtime, `${where}.runtime`);
+    exact3(runtime, ["provider", "requirement", "mode"], `${where}.runtime`);
+    const databaseRequirement = requirements.get(String(runtime.requirement));
+    if (!databaseRequirement)
+      fail(`${where}.runtime.requirement`, "must name an existing requirement.");
+    if (databaseRequirement && (runtime.provider !== databaseRequirement.provider || databaseRequirement.capability !== "database.arangodb"))
+      fail(`${where}.runtime.requirement`, "must match a database.arangodb provider requirement.");
+    if (databaseRequirement && databaseRequirement.config.runtime !== runtime.mode)
+      fail(`${where}.runtime.mode`, "must match the provider runtime mode.");
+    if (runtime.mode !== "native")
+      fail(`${where}.runtime.mode`, "must be native in deployment plan v1.");
+    const topology = object(row2.topology, `${where}.topology`);
+    if (topology.mode === "standalone")
+      exact3(topology, ["mode"], `${where}.topology`);
+    else if (topology.mode === "cluster") {
+      exact3(topology, ["mode", "bootstrapMembers", "replicationFactor", "writeConcern", "additionalJoiners"], `${where}.topology`);
+      integer(topology.bootstrapMembers, `${where}.topology.bootstrapMembers`, 3, 9);
+      integer(topology.replicationFactor, `${where}.topology.replicationFactor`, 1, 16);
+      integer(topology.writeConcern, `${where}.topology.writeConcern`, 1, topology.replicationFactor);
+      if (!["allowed", "disabled"].includes(String(topology.additionalJoiners)))
+        fail(`${where}.topology.additionalJoiners`, "is unsupported.");
+    } else
+      fail(`${where}.topology.mode`, "is unsupported.");
+    if (row2.resources !== undefined)
+      validateResources(row2.resources, `${where}.resources`);
+    validateStorage(row2.storage, `${where}.storage`);
+    if (row2.storage.class !== "database")
+      fail(`${where}.storage.class`, "must be database.");
+    validateNetwork(row2.network, `${where}.network`);
+  } else
+    fail(`${where}.kind`, "is unsupported.");
+  return row2;
+}
+function validateStep(value, where, targets, context) {
+  const row2 = object(value, where);
+  exact3(row2, ["uses", "with", "if", "scope", "timeoutMs", "retry", "failure", "compensate"], where);
+  if (typeof row2.uses !== "string" || !ACTION.test(row2.uses))
+    fail(`${where}.uses`, "must be a versioned action coordinate.");
+  jsonValue(row2.with, `${where}.with`);
+  if (row2.if !== undefined)
+    condition(row2.if, `${where}.if`);
+  const scope = object(row2.scope, `${where}.scope`);
+  if (scope.kind === "release-executor")
+    exact3(scope, ["kind"], `${where}.scope`);
+  else if (scope.kind === "elected-one") {
+    exact3(scope, ["kind", "group"], `${where}.scope`);
+    named(scope.group, `${where}.scope.group`);
+  } else if (scope.kind === "each-target") {
+    exact3(scope, ["kind", "target"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail(`${where}.scope.target`, "must name an existing target.");
+  } else if (scope.kind === "target-batches") {
+    exact3(scope, ["kind", "target", "size"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail(`${where}.scope.target`, "must name an existing target.");
+    integer(scope.size, `${where}.scope.size`, 1, 32);
+  } else
+    fail(`${where}.scope.kind`, "is unsupported.");
+  if (row2.timeoutMs !== undefined)
+    integer(row2.timeoutMs, `${where}.timeoutMs`, 1, 86400000);
+  if (row2.retry !== undefined) {
+    const retry = object(row2.retry, `${where}.retry`);
+    exact3(retry, ["attempts", "backoff", "retryOn"], `${where}.retry`);
+    integer(retry.attempts, `${where}.retry.attempts`, 1, 20);
+    const backoff = object(retry.backoff, `${where}.retry.backoff`);
+    exact3(backoff, ["kind", "initialMs", "maximumMs"], `${where}.retry.backoff`);
+    if (!["fixed", "linear", "exponential"].includes(String(backoff.kind)))
+      fail(`${where}.retry.backoff.kind`, "is unsupported.");
+    integer(backoff.initialMs, `${where}.retry.backoff.initialMs`, 0, 300000);
+    integer(backoff.maximumMs, `${where}.retry.backoff.maximumMs`, backoff.initialMs, 3600000);
+    if (retry.retryOn !== undefined && (!Array.isArray(retry.retryOn) || retry.retryOn.length > 8 || retry.retryOn.some((entry) => !["network", "timeout", "provider-unavailable", "rate-limited", "conflict"].includes(String(entry))) || new Set(retry.retryOn).size !== retry.retryOn.length))
+      fail(`${where}.retry.retryOn`, "is invalid.");
+  }
+  if (row2.failure !== undefined) {
+    const failure = object(row2.failure, `${where}.failure`);
+    exact3(failure, ["policy"], `${where}.failure`);
+    if (!["continue", "stop", "rollback-stage", "rollback-deployment", "compensate", "manual-intervention"].includes(String(failure.policy)))
+      fail(`${where}.failure.policy`, "is unsupported.");
+  }
+  if (row2.compensate !== undefined) {
+    const compensate = object(row2.compensate, `${where}.compensate`);
+    exact3(compensate, ["uses", "with"], `${where}.compensate`);
+    if (typeof compensate.uses !== "string" || !ACTION.test(compensate.uses))
+      fail(`${where}.compensate.uses`, "must be a versioned action coordinate.");
+    jsonValue(compensate.with, `${where}.compensate.with`);
+    if (row2.failure?.policy !== "compensate")
+      fail(`${where}.compensate`, "requires failure.policy compensate.");
+  }
+  const definition = row2;
+  validateBuiltInAction(definition, context, where);
+  if (definition.compensate)
+    validateBuiltInAction({ uses: definition.compensate.uses, with: definition.compensate.with, scope: definition.scope }, context, `${where}.compensate`);
+  return definition;
+}
+function topologicalStages(stages, workflow) {
+  const names = Object.keys(stages);
+  const nameSet = new Set(names);
+  for (const name of names)
+    for (const dependency of stages[name].dependsOn ?? []) {
+      if (!nameSet.has(dependency))
+        fail(`workflows.${workflow}.stages.${name}.dependsOn`, `names missing stage ${dependency}.`);
+      if (dependency === name)
+        fail(`workflows.${workflow}.stages.${name}.dependsOn`, "cannot depend on itself.");
+    }
+  const visiting = new Set;
+  const visited = new Set;
+  const ordered = [];
+  const visit = (name) => {
+    if (visiting.has(name))
+      fail(`workflows.${workflow}.stages`, "contains a dependency cycle.");
+    if (visited.has(name))
+      return;
+    visiting.add(name);
+    for (const dependency of stages[name].dependsOn ?? [])
+      visit(dependency);
+    visiting.delete(name);
+    visited.add(name);
+    ordered.push(name);
+  };
+  for (const name of names.sort())
+    visit(name);
+  return ordered;
+}
+function validateStage(value, where, targets, context) {
+  const row2 = object(value, where);
+  exact3(row2, ["dependsOn", "if", "strategy", "steps"], where);
+  if (row2.dependsOn !== undefined && (!Array.isArray(row2.dependsOn) || row2.dependsOn.length > 64 || row2.dependsOn.some((entry) => typeof entry !== "string" || !NAME2.test(entry)) || new Set(row2.dependsOn).size !== row2.dependsOn.length))
+    fail(`${where}.dependsOn`, "is invalid.");
+  if (row2.if !== undefined)
+    condition(row2.if, `${where}.if`);
+  const strategy = object(row2.strategy, `${where}.strategy`);
+  exact3(strategy, ["mode", "maximumConcurrency", "batchSize", "minimumHealthy", "increments", "observationMs"], `${where}.strategy`);
+  if (!["sequential", "parallel", "rolling", "blue-green", "canary"].includes(String(strategy.mode)))
+    fail(`${where}.strategy.mode`, "is unsupported.");
+  if (strategy.maximumConcurrency !== undefined)
+    integer(strategy.maximumConcurrency, `${where}.strategy.maximumConcurrency`, 1, 1024);
+  if (strategy.batchSize !== undefined)
+    integer(strategy.batchSize, `${where}.strategy.batchSize`, 1, 1024);
+  if (strategy.minimumHealthy !== undefined)
+    integer(strategy.minimumHealthy, `${where}.strategy.minimumHealthy`, 0, 1024);
+  if (strategy.increments !== undefined && (!Array.isArray(strategy.increments) || strategy.increments.length < 1 || strategy.increments.length > 20 || strategy.increments.some((entry) => !Number.isInteger(entry) || entry < 1 || entry > 100) || strategy.increments.at(-1) !== 100))
+    fail(`${where}.strategy.increments`, "must end at 100 and contain bounded percentages.");
+  if (strategy.observationMs !== undefined)
+    integer(strategy.observationMs, `${where}.strategy.observationMs`, 1000, 86400000);
+  if (strategy.mode === "canary" && strategy.increments === undefined)
+    fail(`${where}.strategy.increments`, "is required for canary mode.");
+  if (strategy.mode === "rolling" && strategy.batchSize === undefined)
+    fail(`${where}.strategy.batchSize`, "is required for rolling mode.");
+  const steps = object(row2.steps, `${where}.steps`);
+  const entries = Object.entries(steps);
+  if (entries.length < 1 || entries.length > 256)
+    fail(`${where}.steps`, "must contain 1 to 256 steps.");
+  for (const [name, stepValue] of entries) {
+    named(name, `${where}.steps key`);
+    validateStep(stepValue, `${where}.steps.${name}`, targets, context);
+  }
+  return row2;
+}
+function compileDeployment(sourceValue) {
+  const source = object(sourceValue, "deployment");
+  exact3(source, ["apiVersion", "kind", "metadata", "spec"], "deployment");
+  if (source.apiVersion !== "deploy.forgezero.net/v1")
+    fail("deployment.apiVersion", "must be deploy.forgezero.net/v1.");
+  if (source.kind !== "Deployment")
+    fail("deployment.kind", "must be Deployment.");
+  const metadata = object(source.metadata, "deployment.metadata");
+  exact3(metadata, ["name", "description"], "deployment.metadata");
+  const name = named(metadata.name, "deployment.metadata.name");
+  if (metadata.description !== undefined)
+    boundedString(metadata.description, "deployment.metadata.description", 1024);
+  const spec = object(source.spec, "deployment.spec");
+  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  if (spec.security !== undefined) {
+    const security = object(spec.security, "deployment.spec.security");
+    exact3(security, ["attestation"], "deployment.spec.security");
+    if (security.attestation !== undefined && !["required", "preferred", "disabled"].includes(String(security.attestation)))
+      fail("deployment.spec.security.attestation", "is unsupported.");
+  }
+  const inputs = object(spec.inputs ?? {}, "deployment.spec.inputs");
+  if (Object.keys(inputs).length > 128)
+    fail("deployment.spec.inputs", "contains more than 128 inputs.");
+  for (const [inputName, value] of Object.entries(inputs)) {
+    named(inputName, "deployment.spec.inputs key");
+    validateInput(value, `deployment.spec.inputs.${inputName}`);
+  }
+  const credentials = object(spec.credentials ?? {}, "deployment.spec.credentials");
+  if (Object.keys(credentials).length > 128)
+    fail("deployment.spec.credentials", "contains more than 128 credentials.");
+  for (const [credentialName, value] of Object.entries(credentials)) {
+    named(credentialName, "deployment.spec.credentials key");
+    const credential = object(value, `deployment.spec.credentials.${credentialName}`);
+    exact3(credential, ["schema", "source"], `deployment.spec.credentials.${credentialName}`);
+    if (!ACTION.test(String(credential.schema)))
+      fail(`deployment.spec.credentials.${credentialName}.schema`, "must be a versioned schema coordinate.");
+    const credentialSource = object(credential.source, `deployment.spec.credentials.${credentialName}.source`);
+    exact3(credentialSource, ["kind", "name", "fallback"], `deployment.spec.credentials.${credentialName}.source`);
+    if (!["vault", "systemd"].includes(String(credentialSource.kind)))
+      fail(`deployment.spec.credentials.${credentialName}.source.kind`, "is unsupported.");
+    named(credentialSource.name, `deployment.spec.credentials.${credentialName}.source.name`);
+    if (credentialSource.fallback !== undefined && (credentialSource.kind !== "vault" || credentialSource.fallback !== "systemd"))
+      fail(`deployment.spec.credentials.${credentialName}.source.fallback`, "may only be systemd behind Vault.");
+  }
+  const targets = object(spec.targets, "deployment.spec.targets");
+  const targetEntries = Object.entries(targets);
+  if (targetEntries.length < 1 || targetEntries.length > 64)
+    fail("deployment.spec.targets", "must contain 1 to 64 targets.");
+  const targetNames = new Set(targetEntries.map(([targetName]) => named(targetName, "deployment.spec.targets key")));
+  for (const [targetName, value] of targetEntries) {
+    const target = object(value, `deployment.spec.targets.${targetName}`);
+    exact3(target, ["kind", "selector", "cardinality", "placement"], `deployment.spec.targets.${targetName}`);
+    if (target.kind !== "compute")
+      fail(`deployment.spec.targets.${targetName}.kind`, "must be compute.");
+    const selector = object(target.selector, `deployment.spec.targets.${targetName}.selector`);
+    exact3(selector, ["profiles", "confidentialCompute", "labels"], `deployment.spec.targets.${targetName}.selector`);
+    if (!Array.isArray(selector.profiles) || selector.profiles.length < 1 || selector.profiles.length > 32 || selector.profiles.some((profile) => typeof profile !== "string" || !NAME2.test(profile)) || new Set(selector.profiles).size !== selector.profiles.length)
+      fail(`deployment.spec.targets.${targetName}.selector.profiles`, "is invalid.");
+    if (selector.confidentialCompute !== undefined && !["required", "preferred", "disabled"].includes(String(selector.confidentialCompute)))
+      fail(`deployment.spec.targets.${targetName}.selector.confidentialCompute`, "is unsupported.");
+    if (selector.labels !== undefined)
+      jsonValue(selector.labels, `deployment.spec.targets.${targetName}.selector.labels`);
+    const cardinality = object(target.cardinality, `deployment.spec.targets.${targetName}.cardinality`);
+    exact3(cardinality, ["minimum", "desired", "maximum"], `deployment.spec.targets.${targetName}.cardinality`);
+    const minimum = integer(cardinality.minimum, `deployment.spec.targets.${targetName}.cardinality.minimum`, 1, 1024);
+    const maximum = integer(cardinality.maximum, `deployment.spec.targets.${targetName}.cardinality.maximum`, minimum, 1024);
+    if (typeof cardinality.desired === "number")
+      integer(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`, minimum, maximum);
+    else
+      reference(cardinality.desired, `deployment.spec.targets.${targetName}.cardinality.desired`);
+    if (target.placement !== undefined)
+      jsonValue(target.placement, `deployment.spec.targets.${targetName}.placement`);
+  }
+  const requirements = object(spec.requirements ?? {}, "deployment.spec.requirements");
+  if (Object.keys(requirements).length > 64)
+    fail("deployment.spec.requirements", "contains more than 64 requirements.");
+  const requirementDefinitions = new Map;
+  const requiredProviders = new Map;
+  for (const [requirementName, value] of Object.entries(requirements)) {
+    named(requirementName, "deployment.spec.requirements key");
+    const requirementValue = validateRequirement(value, `deployment.spec.requirements.${requirementName}`);
+    requirementDefinitions.set(requirementName, requirementValue);
+    const key = `${requirementValue.provider}@${requirementValue.contract}:${requirementValue.capability}`;
+    requiredProviders.set(key, { provider: requirementValue.provider, contract: requirementValue.contract, capability: requirementValue.capability });
+  }
+  const components = object(spec.components, "deployment.spec.components");
+  const componentEntries = Object.entries(components);
+  if (componentEntries.length < 1 || componentEntries.length > 128)
+    fail("deployment.spec.components", "must contain 1 to 128 components.");
+  for (const [componentName, value] of componentEntries) {
+    named(componentName, "deployment.spec.components key");
+    validateComponent(value, `deployment.spec.components.${componentName}`, targetNames, requirementDefinitions);
+  }
+  const actionContext = {
+    components,
+    requirements,
+    credentials
+  };
+  const workflows = object(spec.workflows, "deployment.spec.workflows");
+  const workflowEntries = Object.entries(workflows);
+  if (workflowEntries.length < 1 || workflowEntries.length > 32)
+    fail("deployment.spec.workflows", "must contain 1 to 32 workflows.");
+  const plannedWorkflows = [];
+  for (const [workflowName, value] of workflowEntries.sort(([left], [right]) => left.localeCompare(right))) {
+    named(workflowName, "deployment.spec.workflows key");
+    const workflowValue = object(value, `deployment.spec.workflows.${workflowName}`);
+    exact3(workflowValue, ["concurrency", "stages"], `deployment.spec.workflows.${workflowName}`);
+    if (workflowValue.concurrency !== undefined) {
+      const concurrency = object(workflowValue.concurrency, `deployment.spec.workflows.${workflowName}.concurrency`);
+      exact3(concurrency, ["group", "limit"], `deployment.spec.workflows.${workflowName}.concurrency`);
+      boundedString(concurrency.group, `deployment.spec.workflows.${workflowName}.concurrency.group`, 256);
+      integer(concurrency.limit, `deployment.spec.workflows.${workflowName}.concurrency.limit`, 1, 1024);
+    }
+    const stages = object(workflowValue.stages, `deployment.spec.workflows.${workflowName}.stages`);
+    if (Object.keys(stages).length < 1 || Object.keys(stages).length > 64)
+      fail(`deployment.spec.workflows.${workflowName}.stages`, "must contain 1 to 64 stages.");
+    for (const [stageName, stageValue] of Object.entries(stages)) {
+      named(stageName, `deployment.spec.workflows.${workflowName}.stages key`);
+      validateStage(stageValue, `deployment.spec.workflows.${workflowName}.stages.${stageName}`, targetNames, actionContext);
+    }
+    const stepIds = new Set;
+    const plannedStages = topologicalStages(stages, workflowName).map((stageName) => {
+      const stageValue = stages[stageName];
+      const plannedSteps = Object.entries(stageValue.steps).map(([stepName, stepValue]) => {
+        if (stepIds.has(stepName))
+          fail(`deployment.spec.workflows.${workflowName}`, `contains duplicate step id ${stepName}.`);
+        stepIds.add(stepName);
+        return { id: stepName, ...stepValue };
+      });
+      return { id: stageName, ...stageValue.dependsOn ? { dependsOn: [...stageValue.dependsOn].sort() } : {}, ...stageValue.if ? { if: stageValue.if } : {}, strategy: stageValue.strategy, steps: plannedSteps };
+    });
+    plannedWorkflows.push({ id: workflowName, ...workflowValue.concurrency ? { concurrency: workflowValue.concurrency } : {}, stages: plannedStages });
+  }
+  const typedSource = source;
+  return {
+    format: DEPLOY_PLAN_FORMAT,
+    version: DEPLOY_PLAN_VERSION,
+    sourceDigest: deploymentSourceDigest(typedSource),
+    name,
+    ...metadata.description ? { description: metadata.description } : {},
+    requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
+    spec: {
+      ...spec.security ? { security: spec.security } : {},
+      inputs,
+      credentials,
+      targets,
+      requirements,
+      components,
+      workflows: plannedWorkflows
+    }
+  };
+}
+function parseDeploymentPlan(value) {
+  const row2 = object(value, "plan");
+  exact3(row2, ["format", "version", "sourceDigest", "name", "description", "requiredProviders", "spec"], "plan");
+  if (row2.format !== DEPLOY_PLAN_FORMAT || row2.version !== DEPLOY_PLAN_VERSION)
+    fail("plan", "uses an unsupported format or version.");
+  if (typeof row2.sourceDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(row2.sourceDigest))
+    fail("plan.sourceDigest", "is invalid.");
+  named(row2.name, "plan.name");
+  if (row2.description !== undefined)
+    boundedString(row2.description, "plan.description", 1024);
+  if (!Array.isArray(row2.requiredProviders) || row2.requiredProviders.length > 64)
+    fail("plan.requiredProviders", "must be a bounded array.");
+  for (const [index, provider] of row2.requiredProviders.entries()) {
+    const item = object(provider, `plan.requiredProviders[${index}]`);
+    exact3(item, ["provider", "contract", "capability"], `plan.requiredProviders[${index}]`);
+    if (!COORDINATE.test(String(item.provider)) || !COORDINATE.test(String(item.capability)))
+      fail(`plan.requiredProviders[${index}]`, "contains an invalid coordinate.");
+    integer(item.contract, `plan.requiredProviders[${index}].contract`, 1, 65535);
+  }
+  const spec = object(row2.spec, "plan.spec");
+  const workflows = spec.workflows;
+  if (!Array.isArray(workflows))
+    fail("plan.spec.workflows", "must be an array.");
+  const sourceWorkflows = {};
+  for (const [workflowIndex, workflow] of workflows.entries()) {
+    const item = object(workflow, `plan.spec.workflows[${workflowIndex}]`);
+    exact3(item, ["id", "concurrency", "stages"], `plan.spec.workflows[${workflowIndex}]`);
+    const workflowId = named(item.id, `plan.spec.workflows[${workflowIndex}].id`);
+    if (sourceWorkflows[workflowId])
+      fail("plan.spec.workflows", `contains duplicate workflow ${workflowId}.`);
+    if (!Array.isArray(item.stages))
+      fail(`plan.spec.workflows[${workflowIndex}].stages`, "must be an array.");
+    const sourceStages = {};
+    for (const [stageIndex, stage2] of item.stages.entries()) {
+      const stageItem = object(stage2, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}]`);
+      exact3(stageItem, ["id", "dependsOn", "if", "strategy", "steps"], `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}]`);
+      const stageId = named(stageItem.id, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].id`);
+      if (sourceStages[stageId])
+        fail(`plan.spec.workflows[${workflowIndex}].stages`, `contains duplicate stage ${stageId}.`);
+      if (!Array.isArray(stageItem.steps))
+        fail(`plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps`, "must be an array.");
+      const sourceSteps = {};
+      for (const [stepIndex, step2] of stageItem.steps.entries()) {
+        const stepItem = object(step2, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps[${stepIndex}]`);
+        const stepId = named(stepItem.id, `plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps[${stepIndex}].id`);
+        if (sourceSteps[stepId])
+          fail(`plan.spec.workflows[${workflowIndex}].stages[${stageIndex}].steps`, `contains duplicate step ${stepId}.`);
+        const { id: _id3, ...stepWithoutId } = stepItem;
+        sourceSteps[stepId] = stepWithoutId;
+      }
+      const { id: _id2, steps: _steps, ...stageWithoutId } = stageItem;
+      sourceStages[stageId] = { ...stageWithoutId, steps: sourceSteps };
+    }
+    const { id: _id, stages: _stages, ...workflowWithoutId } = item;
+    sourceWorkflows[workflowId] = { ...workflowWithoutId, stages: sourceStages };
+  }
+  const { workflows: _workflows, ...specWithoutWorkflows } = spec;
+  const reconstructed = {
+    apiVersion: "deploy.forgezero.net/v1",
+    kind: "Deployment",
+    metadata: { name: row2.name, ...row2.description ? { description: row2.description } : {} },
+    spec: { ...specWithoutWorkflows, workflows: sourceWorkflows }
+  };
+  const compiled = compileDeployment(reconstructed);
+  return { ...compiled, sourceDigest: row2.sourceDigest };
+}
+
+// src/deploy-plan-runner.ts
+class DeploymentActionError extends Error {
+  kind;
+  constructor(kind, message) {
+    super(message);
+    this.kind = kind;
+    this.name = "DeploymentActionError";
+  }
+}
+function nested(value, path2) {
+  let current = value;
+  for (const part of path2) {
+    if (!current || typeof current !== "object" || Array.isArray(current))
+      return;
+    current = current[part];
+  }
+  return current;
+}
+function resolveReference(reference2, state) {
+  const parts = reference2.$ref.split(".");
+  if (parts[0] === "inputs")
+    return state.inputs[parts[1]];
+  if (parts[0] === "steps") {
+    const step2 = state.steps.get(parts[1]);
+    if (parts[2] === "status")
+      return step2?.status;
+    if (parts[2] === "outputs")
+      return nested(step2?.outputs, parts.slice(3));
+  }
+  if (parts[0] === "components")
+    return nested(state.plan.spec.components[parts[1]], parts.slice(2));
+  if (parts[0] === "targets")
+    return nested(state.plan.spec.targets[parts[1]], parts.slice(2));
+  if (parts[0] === "deployment")
+    return nested(state.plan, parts.slice(1));
+  return;
+}
+function resolveOperand(value, state) {
+  return value && typeof value === "object" && "$ref" in value ? resolveReference(value, state) : value;
+}
+function stepMatches(id2, status, state) {
+  return state.steps.get(id2)?.status === status;
+}
+function evaluateCondition(value, state) {
+  if ("all" in value)
+    return value.all.every((entry) => evaluateCondition(entry, state));
+  if ("any" in value)
+    return value.any.some((entry) => evaluateCondition(entry, state));
+  if ("not" in value)
+    return !evaluateCondition(value.not, state);
+  if ("equals" in value)
+    return resolveOperand(value.equals[0], state) === resolveOperand(value.equals[1], state);
+  if ("notEquals" in value)
+    return resolveOperand(value.notEquals[0], state) !== resolveOperand(value.notEquals[1], state);
+  if ("greaterThan" in value)
+    return Number(resolveOperand(value.greaterThan[0], state)) > Number(resolveOperand(value.greaterThan[1], state));
+  if ("greaterThanOrEqual" in value)
+    return Number(resolveOperand(value.greaterThanOrEqual[0], state)) >= Number(resolveOperand(value.greaterThanOrEqual[1], state));
+  if ("lessThan" in value)
+    return Number(resolveOperand(value.lessThan[0], state)) < Number(resolveOperand(value.lessThan[1], state));
+  if ("lessThanOrEqual" in value)
+    return Number(resolveOperand(value.lessThanOrEqual[0], state)) <= Number(resolveOperand(value.lessThanOrEqual[1], state));
+  if ("contains" in value) {
+    const [left, right] = [resolveOperand(value.contains[0], state), resolveOperand(value.contains[1], state)];
+    return typeof left === "string" ? left.includes(String(right)) : Array.isArray(left) && left.includes(right);
+  }
+  if ("startsWith" in value)
+    return String(resolveOperand(value.startsWith[0], state) ?? "").startsWith(String(resolveOperand(value.startsWith[1], state) ?? ""));
+  if ("exists" in value)
+    return resolveReference(value.exists, state) !== undefined;
+  if ("succeeded" in value)
+    return stepMatches(value.succeeded, "succeeded", state);
+  if ("failed" in value)
+    return stepMatches(value.failed, "failed", state);
+  return state.steps.get(value.changed)?.changed === true;
+}
+function validateInputValue(definition, value, name) {
+  const selected = value === undefined ? definition.default : value;
+  if (selected === undefined) {
+    if (definition.required)
+      throw new DeploymentActionError("refused", `deployment input ${name} is required`);
+    return null;
+  }
+  if (definition.type === "string" || definition.type === "hostname" || definition.type === "enum") {
+    if (typeof selected !== "string")
+      throw new DeploymentActionError("refused", `deployment input ${name} must be a string`);
+    if (definition.type === "enum" && !definition.values.includes(selected))
+      throw new DeploymentActionError("refused", `deployment input ${name} is not an allowed value`);
+    if (definition.type === "hostname" && !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i.test(selected))
+      throw new DeploymentActionError("refused", `deployment input ${name} must be a hostname`);
+    if (definition.type === "string") {
+      if (definition.minimumLength !== undefined && selected.length < definition.minimumLength)
+        throw new DeploymentActionError("refused", `deployment input ${name} is too short`);
+      if (definition.maximumLength !== undefined && selected.length > definition.maximumLength)
+        throw new DeploymentActionError("refused", `deployment input ${name} is too long`);
+      if (definition.pattern !== undefined && !new RegExp(definition.pattern).test(selected))
+        throw new DeploymentActionError("refused", `deployment input ${name} does not match its pattern`);
+    }
+    return selected;
+  }
+  if (definition.type === "boolean") {
+    if (typeof selected !== "boolean")
+      throw new DeploymentActionError("refused", `deployment input ${name} must be a boolean`);
+    return selected;
+  }
+  if (typeof selected !== "number" || !Number.isFinite(selected) || definition.type === "integer" && !Number.isInteger(selected))
+    throw new DeploymentActionError("refused", `deployment input ${name} must be a ${definition.type}`);
+  if (definition.minimum !== undefined && selected < definition.minimum)
+    throw new DeploymentActionError("refused", `deployment input ${name} is below its minimum`);
+  if (definition.maximum !== undefined && selected > definition.maximum)
+    throw new DeploymentActionError("refused", `deployment input ${name} is above its maximum`);
+  return selected;
+}
+function resolveJson(value, state) {
+  if (Array.isArray(value))
+    return value.map((entry) => resolveJson(entry, state));
+  if (value && typeof value === "object") {
+    if (Object.keys(value).length === 1 && "$ref" in value && typeof value.$ref === "string") {
+      const resolved = resolveReference(value, state);
+      if (resolved === undefined)
+        throw new DeploymentActionError("refused", `deployment reference ${value.$ref} is unavailable`);
+      return resolved;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, resolveJson(entry, state)]));
+  }
+  return value;
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function backoff(step2, attempt) {
+  const retry = step2.retry;
+  if (!retry)
+    return 0;
+  const factor = retry.backoff.kind === "fixed" ? 1 : retry.backoff.kind === "linear" ? attempt : 2 ** (attempt - 1);
+  return Math.min(retry.backoff.maximumMs, retry.backoff.initialMs * factor);
+}
+async function bounded(work, timeoutMs) {
+  const controller = new AbortController;
+  let timer;
+  try {
+    return await Promise.race([
+      work(controller.signal),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new DeploymentActionError("timeout", `action exceeded ${timeoutMs}ms`));
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function actionError(cause) {
+  return cause instanceof DeploymentActionError ? cause : new DeploymentActionError("failed", cause instanceof Error ? cause.message : "action failed");
+}
+async function compensate(record2, step2, stage2, options, state) {
+  if (!step2.compensate)
+    return;
+  const handler = options.actions[step2.compensate.uses];
+  if (!handler)
+    throw new DeploymentActionError("refused", `compensation action ${step2.compensate.uses} is unsupported`);
+  const compensation = { ...step2, uses: step2.compensate.uses, with: step2.compensate.with };
+  await bounded((signal) => handler({ plan: state.plan, workflow: options.workflow, stage: stage2, step: compensation, inputs: state.inputs, resolved: resolveJson(compensation.with, state), attempt: 1, signal }), step2.timeoutMs ?? 600000);
+  record2.status = "compensated";
+}
+async function runStep(step2, stage2, options, state) {
+  const record2 = { id: step2.id, stage: stage2.id, action: step2.uses, status: "pending", attempts: 0, outputs: {}, changed: false };
+  state.steps.set(step2.id, record2);
+  if (options.shouldRun && !options.shouldRun(step2)) {
+    record2.status = "skipped";
+    return record2;
+  }
+  if (step2.if && !evaluateCondition(step2.if, state)) {
+    record2.status = "skipped";
+    return record2;
+  }
+  const handler = options.actions[step2.uses];
+  if (!handler) {
+    record2.status = "failed";
+    record2.error = { kind: "refused", message: `action ${step2.uses} is unsupported` };
+    return record2;
+  }
+  record2.startedAtTs = (options.now ?? Date.now)();
+  record2.status = "running";
+  const attempts = step2.retry?.attempts ?? 1;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    record2.attempts = attempt;
+    try {
+      const result = await bounded((signal) => handler({ plan: state.plan, workflow: options.workflow, stage: stage2, step: step2, inputs: state.inputs, resolved: resolveJson(step2.with, state), attempt, signal }), step2.timeoutMs ?? 600000);
+      record2.status = "succeeded";
+      record2.outputs = result.outputs ?? {};
+      record2.changed = result.changed === true;
+      record2.evidence = result.evidence;
+      record2.finishedAtTs = (options.now ?? Date.now)();
+      return record2;
+    } catch (cause) {
+      const error = actionError(cause);
+      const retryable = attempt < attempts && (step2.retry?.retryOn?.includes(error.kind) ?? error.kind !== "refused");
+      if (!retryable) {
+        record2.status = step2.failure?.policy === "manual-intervention" ? "manual-intervention" : "failed";
+        record2.error = { kind: error.kind, message: error.message };
+        record2.finishedAtTs = (options.now ?? Date.now)();
+        return record2;
+      }
+      await (options.sleep ?? sleep)(backoff(step2, attempt));
+    }
+  }
+  return record2;
+}
+async function mapLimit(values, limit, run2) {
+  const results = new Array(values.length);
+  let next = 0;
+  await Promise.all(Array.from({ length: Math.min(limit, values.length) }, async () => {
+    for (;; ) {
+      const index = next++;
+      if (index >= values.length)
+        return;
+      results[index] = await run2(values[index]);
+    }
+  }));
+  return results;
+}
+async function runDeploymentPlan(options) {
+  const plan = parseDeploymentPlan(options.plan);
+  const workflow = plan.spec.workflows.find((candidate) => candidate.id === options.workflow);
+  if (!workflow)
+    throw new DeploymentActionError("refused", `workflow ${options.workflow} does not exist`);
+  const supplied = options.inputs ?? {};
+  const inputValues = {};
+  const inputDefinitions = plan.spec.inputs ?? {};
+  for (const key of Object.keys(supplied))
+    if (!Object.hasOwn(inputDefinitions, key))
+      throw new DeploymentActionError("refused", `unknown deployment input ${key}`);
+  for (const [name, definition] of Object.entries(inputDefinitions))
+    inputValues[name] = validateInputValue(definition, supplied[name], name);
+  const execute = async () => {
+    const state = { inputs: inputValues, steps: new Map, plan };
+    const records = [];
+    const successful2 = [];
+    for (const stage2 of workflow.stages) {
+      if (stage2.if && !evaluateCondition(stage2.if, state)) {
+        for (const step2 of stage2.steps) {
+          const record2 = { id: step2.id, stage: stage2.id, action: step2.uses, status: "skipped", attempts: 0, outputs: {}, changed: false };
+          state.steps.set(step2.id, record2);
+          records.push(record2);
+        }
+        continue;
+      }
+      const parallel = stage2.strategy.mode === "parallel";
+      const stageRecords = parallel ? await mapLimit(stage2.steps, stage2.strategy.maximumConcurrency ?? stage2.steps.length, (step2) => runStep(step2, stage2, { ...options, plan, workflow: workflow.id }, state)) : await (async () => {
+        const rows = [];
+        for (const step2 of stage2.steps) {
+          const record2 = await runStep(step2, stage2, { ...options, plan, workflow: workflow.id }, state);
+          rows.push(record2);
+          if (["failed", "manual-intervention"].includes(record2.status) && step2.failure?.policy !== "continue")
+            break;
+        }
+        return rows;
+      })();
+      records.push(...stageRecords);
+      for (const record2 of stageRecords) {
+        const step2 = stage2.steps.find((candidate) => candidate.id === record2.id);
+        if (record2.status === "succeeded")
+          successful2.push({ record: record2, step: step2, stage: stage2 });
+        if (record2.status !== "failed" && record2.status !== "manual-intervention")
+          continue;
+        const policy = step2.failure?.policy ?? "stop";
+        if (policy === "continue")
+          continue;
+        if (policy === "compensate")
+          await compensate(record2, step2, stage2, { ...options, plan, workflow: workflow.id }, state);
+        if (policy === "rollback-stage" || policy === "rollback-deployment") {
+          const candidates = successful2.filter((entry) => policy === "rollback-deployment" || entry.stage.id === stage2.id).reverse();
+          for (const entry of candidates)
+            await compensate(entry.record, entry.step, entry.stage, { ...options, plan, workflow: workflow.id }, state);
+        }
+        return { workflow: workflow.id, ok: false, status: record2.status === "manual-intervention" ? "manual-intervention" : "failed", steps: records };
+      }
+    }
+    return { workflow: workflow.id, ok: true, status: "succeeded", steps: records };
+  };
+  return workflow.concurrency && options.lock ? options.lock(workflow.concurrency.group, workflow.concurrency.limit, execute) : execute();
+}
+
+// src/deploy-compiler.ts
+var DEPLOY_PLAN_FILE = ".fz/deploy.plan.json";
+
 // src/deployment.ts
 class DeploymentError extends Error {
   code;
@@ -5933,7 +7165,7 @@ function persistCapacityCalibration(args) {
   if (!isAbsolute2(args.directory)) {
     throw new DeploymentError("PIPELINE_FAILED", "capacity evidence directory must be an absolute Agent-owned path");
   }
-  if (!existsSync2(args.directory)) {
+  if (!existsSync3(args.directory)) {
     const parent = lstatSync(dirname(args.directory));
     if (!parent.isDirectory() || parent.isSymbolicLink()) {
       throw new DeploymentError("PIPELINE_FAILED", "capacity evidence parent must be a real Agent-owned directory");
@@ -5944,7 +7176,7 @@ function persistCapacityCalibration(args) {
   if (!stats.isDirectory() || stats.isSymbolicLink()) {
     throw new DeploymentError("PIPELINE_FAILED", "capacity evidence directory must be a real Agent-owned directory");
   }
-  const identity = createHash3("sha256").update(`${args.deploymentKey}\x00${args.profile}\x00${args.revision}`).digest("hex").slice(0, 24);
+  const identity = createHash4("sha256").update(`${args.deploymentKey}\x00${args.profile}\x00${args.revision}`).digest("hex").slice(0, 24);
   const path2 = join2(args.directory, `${identity}-${args.measuredAtTs}-${randomUUID().slice(0, 8)}.json`);
   const next = `${path2}.next`;
   const recommendedCoordinate = {
@@ -5989,7 +7221,7 @@ function createDeploymentManager(options) {
     if (content.length > 16385 || /\r|\0/.test(content)) {
       throw new DeploymentError("SOURCE_FAILED", "The pinned Git host keys are malformed.");
     }
-    if (existsSync2(knownHostsPath) && readFileSync2(knownHostsPath, "utf8") === content)
+    if (existsSync3(knownHostsPath) && readFileSync2(knownHostsPath, "utf8") === content)
       return;
     mkdirSync2(dirname(knownHostsPath), { recursive: true, mode: 448 });
     const next = `${knownHostsPath}.${process.pid}.${randomUUID()}.next`;
@@ -6148,6 +7380,212 @@ function createDeploymentManager(options) {
     if (request.revision && head !== request.revision) {
       throw new DeploymentError("SOURCE_FAILED", `Git checked out ${head}, not requested ${request.revision}.`);
     }
+    const planPath = join2(release, DEPLOY_PLAN_FILE);
+    if (existsSync3(planPath)) {
+      const plan = parseDeploymentPlan(readDefinition(planPath));
+      for (const workflow of Object.values(plan.spec.workflows))
+        for (const stage2 of Object.values(workflow.stages)) {
+          if (stage2.strategy.mode === "rolling" || stage2.strategy.mode === "canary" || Object.values(stage2.steps).some((step2) => step2.scope.kind === "target-batches")) {
+            throw new DeploymentError("PIPELINE_FAILED", "rolling/canary plans require a fenced multi-target rollout lease that this control protocol does not yet supply");
+          }
+        }
+      const targetNames = new Set(Object.entries(plan.spec.targets).filter(([, target]) => target.selector.profiles.includes(options.profile)).map(([name]) => name));
+      if (targetNames.size === 0)
+        throw new DeploymentError("PIPELINE_FAILED", `deployment plan has no target for profile ${options.profile}`);
+      const assurance = plan.spec.security?.attestation ?? "disabled";
+      if (assurance !== "disabled") {
+        if (!options.attestation && assurance === "required")
+          throw new DeploymentError("PIPELINE_FAILED", "deployment plan requires attestation but this Agent has no source");
+        if (options.attestation) {
+          try {
+            await options.attestation.report(head);
+          } catch (cause) {
+            if (assurance === "required")
+              throw new DeploymentError("PIPELINE_FAILED", `deployment attestation failed: ${cause.message}`);
+          }
+        }
+      }
+      const phaseEnvironment2 = {
+        ...options.environment ?? {},
+        FZ_RELEASE: release,
+        FZ_DEPLOY_REVISION: head,
+        FZ_DEPLOY_BRANCH: options.branch,
+        FZ_DEPLOY_PROFILE: options.profile,
+        ...options.publicApiUrl ? { PUBLIC_API_URL: options.publicApiUrl } : {}
+      };
+      const inputValues = {};
+      for (const [name, definition2] of Object.entries(plan.spec.inputs ?? {})) {
+        const raw = options.environment?.[name];
+        if (raw === undefined)
+          continue;
+        inputValues[name] = definition2.type === "boolean" ? raw === "true" : definition2.type === "integer" || definition2.type === "number" ? Number(raw) : raw;
+      }
+      const projectExec2 = options.projectExec ?? spawnExact;
+      const materializePlanArgv = (argv2) => argv2.map((argument) => {
+        if (argument === "${FZ_RELEASE}")
+          return release;
+        if (argument.includes("${")) {
+          throw new DeploymentActionError("refused", `unsupported deployment argv coordinate ${argument}`);
+        }
+        return argument;
+      });
+      const providerSoftware = {
+        "forgezero.bun": "bun",
+        "forgezero.docker": "docker",
+        "forgezero.nginx": "nginx",
+        "forgezero.arangodb": "arangodb",
+        "forgezero.cloudflared": "cloudflared",
+        "forgezero.warp": "cloudflare-warp",
+        "forgezero.ufw": "ufw",
+        "forgezero.openssh": "openssh-client"
+      };
+      const actions2 = {
+        "forgezero.software/ensure@1": async ({ resolved }) => {
+          if (!options.ensureSoftware)
+            throw new DeploymentActionError("provider-unavailable", "the supervised software helper is unavailable");
+          if (!Array.isArray(resolved.requirements))
+            throw new DeploymentActionError("refused", "software.ensure requires a requirements array");
+          const requirements = resolved.requirements.map((name) => {
+            if (typeof name !== "string")
+              throw new DeploymentActionError("refused", "software requirement name is invalid");
+            const requirement2 = plan.spec.requirements?.[name];
+            const id2 = requirement2 && providerSoftware[requirement2.provider];
+            if (!requirement2 || !id2)
+              throw new DeploymentActionError("refused", `software requirement ${name} is unsupported on this Agent`);
+            return { id: id2, version: requirement2.version };
+          });
+          await options.ensureSoftware(requirements);
+          return { changed: true };
+        },
+        "forgezero.exec/argv@1": async ({ resolved, step: step2 }) => {
+          if (!Array.isArray(resolved.argv) || resolved.argv.some((value) => typeof value !== "string"))
+            throw new DeploymentActionError("refused", "exec.argv requires an exact argv array");
+          const environment = { ...phaseEnvironment2 };
+          const bindings = resolved.credentials;
+          if (bindings !== undefined) {
+            if (!bindings || typeof bindings !== "object" || Array.isArray(bindings))
+              throw new DeploymentActionError("refused", "exec.argv credentials must map environment names to credential declarations");
+            for (const [environmentName, credentialName] of Object.entries(bindings)) {
+              if (!/^[A-Z_][A-Z0-9_]*$/.test(environmentName) || typeof credentialName !== "string")
+                throw new DeploymentActionError("refused", "exec.argv credential binding is invalid");
+              const credential = plan.spec.credentials?.[credentialName];
+              if (!credential || !options.cache)
+                throw new DeploymentActionError("refused", `credential ${credentialName} is unavailable`);
+              environment[environmentName] = await options.cache.get(credential.source.name);
+            }
+          }
+          const result = await projectExec2({ argv: materializePlanArgv(resolved.argv), cwd: release, env: environment, timeoutMs: step2.timeoutMs });
+          if (result.exitCode !== 0)
+            throw new DeploymentActionError("failed", result.output.slice(0, 2000) || `command exited ${result.exitCode}`);
+          return { outputs: { exitCode: result.exitCode } };
+        },
+        "forgezero.health/http@1": async ({ resolved }) => {
+          const componentName = String(resolved.component ?? "");
+          const component2 = plan.spec.components[componentName];
+          if (!component2 || component2.kind !== "application")
+            throw new DeploymentActionError("refused", `health component ${componentName} is invalid`);
+          const health = component2.service.health;
+          try {
+            const response = await fetch(`http://127.0.0.1:${component2.service.port}${health.path}`, { method: health.method, redirect: "manual", signal: AbortSignal.timeout(health.timeoutMs) });
+            if (!health.expectedStatus.includes(response.status))
+              throw new DeploymentActionError("failed", `health returned HTTP ${response.status}`);
+            return { evidence: { status: response.status } };
+          } catch (cause) {
+            throw cause instanceof DeploymentActionError ? cause : new DeploymentActionError("network", cause.message);
+          }
+        },
+        "forgezero.storage/verify@1": async ({ resolved }) => {
+          const component2 = plan.spec.components[String(resolved.component ?? "")];
+          const mounts = component2?.kind === "database" ? [component2.storage] : component2?.storage ?? [];
+          for (const mount of mounts) {
+            const candidate = existsSync3(mount.path) ? mount.path : dirname(mount.path);
+            const stats = statfsSync(candidate);
+            const freePercent = Number(stats.bavail) / Number(stats.blocks) * 100;
+            const minimum = mount.class === "ephemeral" ? 0 : mount.minimumFreePercent ?? 0;
+            if (!Number.isFinite(freePercent) || freePercent < minimum)
+              throw new DeploymentActionError("refused", `storage ${mount.path} has ${freePercent.toFixed(1)}% free; ${minimum}% required`);
+          }
+          return { evidence: { mounts: mounts.length } };
+        },
+        "forgezero.oci/build@1": async ({ resolved }) => {
+          if (!options.buildContainer)
+            throw new DeploymentActionError("provider-unavailable", "the supervised container builder is unavailable");
+          const componentName = String(resolved.component ?? "");
+          const application = plan.spec.components[componentName];
+          if (!application || application.kind !== "application" || application.runtime.kind !== "container")
+            throw new DeploymentActionError("refused", `container component ${componentName} is invalid`);
+          const result = await options.buildContainer({ key: options.key, revision: head, root: options.root, release, component: componentName, application, noCache: resolved.noCache === true });
+          return { changed: true, outputs: { image: result.image, digest: result.digest } };
+        },
+        "forgezero.oci/pull@1": async ({ resolved }) => {
+          if (!options.buildContainer)
+            throw new DeploymentActionError("provider-unavailable", "the supervised container puller is unavailable");
+          const componentName = String(resolved.component ?? "");
+          const application = plan.spec.components[componentName];
+          if (!application || application.kind !== "application" || application.runtime.kind !== "container")
+            throw new DeploymentActionError("refused", `container component ${componentName} is invalid`);
+          const result = await options.buildContainer({ key: options.key, revision: head, root: options.root, release, component: componentName, application });
+          return { changed: true, outputs: { image: result.image, digest: result.digest } };
+        },
+        "forgezero.service/deploy@1": async ({ resolved }) => {
+          if (!options.activateContainer)
+            throw new DeploymentActionError("provider-unavailable", "the supervised container activator is unavailable");
+          const componentName = String(resolved.component ?? "");
+          const application = plan.spec.components[componentName];
+          const image = String(resolved.imageDigest ?? "");
+          if (!application || application.kind !== "application" || application.runtime.kind !== "container" || !image)
+            throw new DeploymentActionError("refused", `container deployment ${componentName} is invalid`);
+          const state = await options.activateContainer({ key: options.key, revision: head, root: options.root, release, component: componentName, application, image });
+          return { changed: true, outputs: { activeSlot: state.activeSlot, publicPort: state.publicPort } };
+        },
+        "forgezero.service/promote@1": async ({ resolved }) => {
+          if (!options.activateContainer)
+            throw new DeploymentActionError("provider-unavailable", "the supervised container activator is unavailable");
+          const componentName = String(resolved.component ?? "");
+          const application = plan.spec.components[componentName];
+          const image = String(resolved.imageDigest ?? "");
+          if (!application || application.kind !== "application" || application.runtime.kind !== "container" || !image)
+            throw new DeploymentActionError("refused", `container promotion ${componentName} is invalid`);
+          const state = await options.activateContainer({ key: options.key, revision: head, root: options.root, release, component: componentName, application, image });
+          return { changed: true, outputs: { activeSlot: state.activeSlot, publicPort: state.publicPort } };
+        }
+      };
+      const run2 = await runDeploymentPlan({
+        plan,
+        workflow: "deploy",
+        inputs: inputValues,
+        actions: actions2,
+        shouldRun: (step2) => step2.scope.kind === "release-executor" || step2.scope.kind === "elected-one" ? request.releaseExecutor === true : targetNames.has(step2.scope.target)
+      });
+      const phase = {
+        pipeline: `${plan.name}:deploy`,
+        ok: run2.ok,
+        assurance: assurance === "disabled" ? "enrolled" : options.attestation ? "attested" : "enrolled",
+        steps: run2.steps.map((step2) => ({
+          name: step2.id,
+          outcome: step2.status === "succeeded" || step2.status === "compensated" ? "ok" : step2.status === "skipped" ? "skipped" : "failed",
+          exitCode: step2.status === "succeeded" || step2.status === "compensated" ? 0 : step2.status === "skipped" ? null : 1,
+          log: step2.error?.message ?? "",
+          durationMs: (step2.finishedAtTs ?? step2.startedAtTs ?? 0) - (step2.startedAtTs ?? 0)
+        }))
+      };
+      if (!run2.ok) {
+        const failed = run2.steps.find((step2) => step2.status === "failed" || step2.status === "manual-intervention");
+        throw new DeploymentError("PIPELINE_FAILED", `deployment plan failed at ${failed?.id ?? "unknown step"}: ${failed?.error?.message ?? run2.status}`);
+      }
+      return {
+        key: options.key,
+        repository: options.repository,
+        branch: options.branch,
+        revision: head,
+        definitionDigest: plan.sourceDigest,
+        definitionVersion: plan.version,
+        profile: options.profile,
+        release,
+        ok: true,
+        phases: [phase]
+      };
+    }
     const definition = parseDeployDefinition(readDefinition(join2(release, ".fz", "deploy.json")));
     const definitionDigest = deployDefinitionDigest(definition);
     const selectedProfile = definition.profiles[options.profile];
@@ -6193,7 +7631,7 @@ function createDeploymentManager(options) {
           phase,
           name: `${definition.name}:${phase}`,
           requireAttestation: definition.requireAttestation,
-          steps: definition.steps.filter((step) => step.phase === phase && (!step.profiles || step.profiles.includes(options.profile)) && (step.scope === "target" || request.releaseExecutor === true) && (!step.when || Object.entries(step.when).every(([name, expected]) => phaseEnvironment[name] === expected)))
+          steps: definition.steps.filter((step2) => step2.phase === phase && (!step2.profiles || step2.profiles.includes(options.profile)) && (step2.scope === "target" || request.releaseExecutor === true) && (!step2.when || Object.entries(step2.when).every(([name, expected]) => phaseEnvironment[name] === expected)))
         };
       })
     ].filter((pipeline) => pipeline.steps.length > 0);
@@ -6220,7 +7658,7 @@ function createDeploymentManager(options) {
       const result = await runPipeline({ pipeline, secret, exec: phaseExec, attest });
       phases.push(result);
       if (!result.ok) {
-        const failedStep = result.steps.find((step) => step.outcome === "failed");
+        const failedStep = result.steps.find((step2) => step2.outcome === "failed");
         const detail = failedStep?.log.trim().slice(0, 2000);
         throw new DeploymentError("PIPELINE_FAILED", `${pipeline.name} failed at ${failedStep?.name ?? "unknown step"}` + (detail ? `: ${detail}` : ` (exit ${failedStep?.exitCode ?? "unknown"}).`));
       }
@@ -6312,7 +7750,7 @@ function createDeploymentManager(options) {
 }
 
 // src/control.ts
-import { chmodSync as chmodSync4, existsSync as existsSync3, unlinkSync as unlinkSync3 } from "fs";
+import { chmodSync as chmodSync4, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
 import { connect, createServer as createServer2 } from "net";
 var DEFAULT_CONTROL_SOCKET = "/run/forgezero/control.sock";
 var MAX_REQUEST_BYTES = 16 * 1024;
@@ -6369,7 +7807,7 @@ async function handleControl(manager, request) {
   }
 }
 function startControlServer(manager, socketPath = DEFAULT_CONTROL_SOCKET) {
-  if (existsSync3(socketPath))
+  if (existsSync4(socketPath))
     unlinkSync3(socketPath);
   const server = createServer2((socket) => {
     let buffer = "";
@@ -6487,7 +7925,7 @@ async function deployClaim(options, claim) {
 }
 async function completeSigned(options, body) {
   const attempts = Math.max(1, Math.min(options.completionAttempts ?? 5, 10));
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   let last;
   for (let attempt = 1;attempt <= attempts; attempt += 1) {
     try {
@@ -6498,7 +7936,7 @@ async function completeSigned(options, body) {
       if (cause instanceof SignedNodeHttpError && cause.status < 500)
         throw cause;
       if (attempt < attempts)
-        await sleep(Math.min(2000, 250 * 2 ** (attempt - 1)));
+        await sleep2(Math.min(2000, 250 * 2 ** (attempt - 1)));
     }
   }
   throw last;
@@ -6589,7 +8027,7 @@ function startDeploymentPull(options) {
 // src/guest-enrolment.ts
 import {
   chmodSync as chmodSync5,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
   renameSync as renameSync3,
@@ -6621,11 +8059,11 @@ function privateNetworkAttachmentFromEnvironment(env = process.env) {
 var validBinding = (value, expectedNodeKey) => {
   if (!value || typeof value !== "object")
     return false;
-  const row = value;
-  return ["nodeKey", "computeReference", "projectKey", "environmentKey"].every((key) => typeof row[key] === "string" && row[key].length > 0) && (row.realm === "platform" || row.realm === "tenant" && typeof row.tenantSlug === "string" && row.tenantSlug.length > 0) && (!expectedNodeKey || row.nodeKey === expectedNodeKey);
+  const row2 = value;
+  return ["nodeKey", "computeReference", "projectKey", "environmentKey"].every((key) => typeof row2[key] === "string" && row2[key].length > 0) && (row2.realm === "platform" || row2.realm === "tenant" && typeof row2.tenantSlug === "string" && row2.tenantSlug.length > 0) && (!expectedNodeKey || row2.nodeKey === expectedNodeKey);
 };
 function loadGuestBinding(path2, expectedNodeKey) {
-  if (!existsSync4(path2))
+  if (!existsSync5(path2))
     return null;
   const mode = statSync(path2).mode & 511;
   if ((mode & 63) !== 0) {
@@ -6751,7 +8189,7 @@ async function runClaim(options, claim) {
 }
 async function complete(options, body) {
   const attempts = Math.max(1, Math.min(options.completionAttempts ?? 5, 10));
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   let last;
   for (let attempt = 1;attempt <= attempts; attempt += 1) {
     try {
@@ -6762,7 +8200,7 @@ async function complete(options, body) {
       if (cause instanceof SignedNodeHttpError && cause.status < 500)
         throw cause;
       if (attempt < attempts)
-        await sleep(Math.min(2000, 250 * 2 ** (attempt - 1)));
+        await sleep2(Math.min(2000, 250 * 2 ** (attempt - 1)));
     }
   }
   throw last;
@@ -6860,7 +8298,7 @@ var remoteOutcome3 = (cause) => cause instanceof SignedNodeHttpError && cause.st
 var post2 = (options, operation, body) => postSignedNode(options, `v1/node/migrations/${operation}`, body);
 async function complete2(options, body) {
   const attempts = Math.max(1, Math.min(options.completionAttempts ?? 5, 10));
-  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   let last;
   for (let attempt = 1;attempt <= attempts; attempt += 1) {
     try {
@@ -6871,7 +8309,7 @@ async function complete2(options, body) {
       if (cause instanceof SignedNodeHttpError && cause.status < 500)
         throw cause;
       if (attempt < attempts)
-        await sleep(Math.min(2000, 250 * 2 ** (attempt - 1)));
+        await sleep2(Math.min(2000, 250 * 2 ** (attempt - 1)));
     }
   }
   throw last;
@@ -6988,7 +8426,7 @@ function startMigrationPull(options) {
 }
 
 // src/ssh-bootstrap.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { chmodSync as chmodSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join3 } from "path";
@@ -7010,7 +8448,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION = "0.1.53";
+var VERSION2 = "0.1.56";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -7138,7 +8576,7 @@ var verifiedBunArchive = async (directory) => {
   if (!response.ok)
     throw new SshBootstrapError("BUN_DOWNLOAD_FAILED");
   const bytes = new Uint8Array(await response.arrayBuffer());
-  if (createHash4("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256) {
+  if (createHash5("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256) {
     throw new SshBootstrapError("BUN_CHECKSUM_MISMATCH");
   }
   const archive = join3(directory, "bun.zip");
@@ -7522,7 +8960,7 @@ async function executeMetalAdmission(claim, options) {
         } },
         bunVersion: PINNED_BUN_VERSION,
         bunReleaseSha256: BUN_RELEASE_SHA256,
-        agentVersion: VERSION
+        agentVersion: VERSION2
       }
     };
     const configPath = join3(directory, "metal.json");
@@ -7713,13 +9151,13 @@ function startMetalAdmissionPull(options) {
 }
 
 // src/metal-helper-socket.ts
-import { chmodSync as chmodSync7, existsSync as existsSync6, unlinkSync as unlinkSync6 } from "fs";
+import { chmodSync as chmodSync7, existsSync as existsSync7, unlinkSync as unlinkSync6 } from "fs";
 import { connect as connect2, createServer as createServer3 } from "net";
 
 // src/metal-provision.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import {
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync5,
   readdirSync,
@@ -7856,8 +9294,8 @@ function membersOfLinuxList(value, label) {
     throw new MetalProvisionError(`${label} list overlaps itself`);
   return members;
 }
-var guestNameFor = (computeKey) => `fzg-${createHash5("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
-var tapNameFor = (computeKey) => `fzt${createHash5("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
+var guestNameFor = (computeKey) => `fzg-${createHash6("sha256").update(computeKey).digest("hex").slice(0, 16)}`;
+var tapNameFor = (computeKey) => `fzt${createHash6("sha256").update(computeKey).digest("hex").slice(0, 12)}`;
 var macForAddress = (address) => {
   const octets = address.split(".").map(Number);
   if (octets.length !== 4 || octets.some((value) => !Number.isInteger(value) || value < 0 || value > 255)) {
@@ -7937,17 +9375,17 @@ function validateMetalProfile(profile) {
   }
 }
 var readManifests = (stateDir) => {
-  if (!existsSync5(stateDir))
+  if (!existsSync6(stateDir))
     return [];
   return readdirSync(stateDir).filter((name) => name.endsWith(".json")).map((name) => JSON.parse(readFileSync5(join4(stateDir, name), "utf8")));
 };
 function allocateAddress(profile, computeKey, rows) {
-  const existing = rows.find((row) => row.computeKey === computeKey);
+  const existing = rows.find((row2) => row2.computeKey === computeKey);
   if (existing)
     return existing.address;
-  const used = new Set(rows.map((row) => row.address));
+  const used = new Set(rows.map((row2) => row2.address));
   const width = profile.addressEnd - profile.addressStart + 1;
-  const start = createHash5("sha256").update(computeKey).digest().readUInt16BE(0) % width;
+  const start = createHash6("sha256").update(computeKey).digest().readUInt16BE(0) % width;
   for (let offset = 0;offset < width; offset += 1) {
     const last = profile.addressStart + (start + offset) % width;
     const address = `${profile.subnetPrefix}.${last}`;
@@ -7966,13 +9404,13 @@ function requestedAddress(profile, claim, rows) {
   if (!Number.isInteger(last) || last < profile.addressStart || last > profile.addressEnd) {
     throw new MetalProvisionError("requested guest address is outside the allocatable range");
   }
-  const occupied = rows.find((row) => row.address === claim.spec.guestAddress && row.computeKey !== claim.computeKey);
+  const occupied = rows.find((row2) => row2.address === claim.spec.guestAddress && row2.computeKey !== claim.computeKey);
   if (occupied)
     throw new MetalProvisionError("requested guest address is already allocated");
   return claim.spec.guestAddress;
 }
 function allocateCpuPool(profile, claim, rows) {
-  const prior = rows.find((row) => row.computeKey === claim.computeKey);
+  const prior = rows.find((row2) => row2.computeKey === claim.computeKey);
   if (prior) {
     const retained = profile.cpuPools.find((pool) => pool.key === prior.cpuPoolKey);
     if (!retained || retained.cpus !== prior.allowedCpus || retained.memoryNodes !== prior.allowedMemoryNodes) {
@@ -7980,7 +9418,7 @@ function allocateCpuPool(profile, claim, rows) {
     }
     return retained;
   }
-  const used = new Set(rows.map((row) => row.cpuPoolKey));
+  const used = new Set(rows.map((row2) => row2.cpuPoolKey));
   if (claim.spec.cpuPoolKey) {
     const requested = profile.cpuPools.find((pool) => pool.key === claim.spec.cpuPoolKey);
     if (!requested || used.has(requested.key)) {
@@ -8134,11 +9572,11 @@ async function provisionMetalGuest(profile, claim, exec) {
       throw new MetalProvisionError("invalid SSH public key list");
   }
   const name = claim.spec.guestName ?? guestNameFor(claim.computeKey);
-  const conflictingName = manifests.find((row) => row.name === name && row.computeKey !== claim.computeKey);
+  const conflictingName = manifests.find((row2) => row2.name === name && row2.computeKey !== claim.computeKey);
   if (conflictingName)
     throw new MetalProvisionError("requested guest name is already allocated");
   const manifestPath = join4(profile.stateDir, `${name}.json`);
-  const prior = manifests.find((row) => row.computeKey === claim.computeKey);
+  const prior = manifests.find((row2) => row2.computeKey === claim.computeKey);
   if (prior && prior.reference !== claim.spec.reference)
     throw new MetalProvisionError("compute identity conflicts with host inventory");
   const address = requestedAddress(profile, claim, manifests);
@@ -8221,7 +9659,7 @@ function legacyPlatformManifest(profile, claim, name) {
     return;
   const legacyDir = profile.legacyStateDir ?? "/etc/forgezero/guests";
   const legacyPath = join4(legacyDir, `${name}.conf`);
-  if (!existsSync5(legacyPath))
+  if (!existsSync6(legacyPath))
     return;
   const values = new Map;
   for (const line of readFileSync5(legacyPath, "utf8").split(/\r?\n/)) {
@@ -8258,7 +9696,7 @@ async function removeMetalGuest(profile, claim, exec) {
   const service = `forgezero-guest@${name}.service`;
   const unitPath = join4(profile.unitDir, service);
   const lv = `/dev/${profile.volumeGroup}/${name}`;
-  const manifest = existsSync5(manifestPath) ? JSON.parse(readFileSync5(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
+  const manifest = existsSync6(manifestPath) ? JSON.parse(readFileSync5(manifestPath, "utf8")) : legacyPlatformManifest(profile, claim, name);
   if (!manifest) {
     const seedBase = join4(profile.seedDir, name);
     const localArtifacts = [
@@ -8268,7 +9706,7 @@ async function removeMetalGuest(profile, claim, exec) {
       `${seedBase}-meta-data`,
       `${seedBase}-network-config`
     ];
-    if (localArtifacts.some(existsSync5)) {
+    if (localArtifacts.some(existsSync6)) {
       throw new MetalProvisionError("guest artifacts exist without owned inventory");
     }
     const [volume, active] = await Promise.all([
@@ -8285,7 +9723,7 @@ async function removeMetalGuest(profile, claim, exec) {
   if (!currentIdentity && !legacyPlatformIdentity) {
     throw new MetalProvisionError("compute identity conflicts with host inventory");
   }
-  if (existsSync5(unitPath))
+  if (existsSync6(unitPath))
     await checked2(exec, ["systemctl", "disable", "--now", service]);
   else if (legacyPlatformIdentity)
     await checked2(exec, ["systemctl", "disable", "--now", service]);
@@ -8302,14 +9740,14 @@ async function removeMetalGuest(profile, claim, exec) {
     join4(profile.seedDir, `${name}-network-config`),
     manifestPath
   ])
-    if (existsSync5(path2))
+    if (existsSync6(path2))
       unlinkSync5(path2);
   if (legacyPlatformIdentity) {
     const legacyConfig = join4(profile.legacyStateDir ?? "/etc/forgezero/guests", `${name}.conf`);
     const legacyDropIn = join4(profile.unitDir, `${service}.d`);
-    if (existsSync5(legacyConfig))
+    if (existsSync6(legacyConfig))
       unlinkSync5(legacyConfig);
-    if (existsSync5(legacyDropIn))
+    if (existsSync6(legacyDropIn))
       rmSync3(legacyDropIn, { recursive: true });
   }
   await checked2(exec, ["systemctl", "daemon-reload"]);
@@ -8348,7 +9786,7 @@ command exceeded ${COMMAND_TIMEOUT_MS}ms`.trim() : stderr
 function startMetalHelper(options) {
   validateMetalProfile(options.profile);
   const socketPath = options.socketPath ?? DEFAULT_METAL_HELPER_SOCKET;
-  if (existsSync6(socketPath))
+  if (existsSync7(socketPath))
     unlinkSync6(socketPath);
   let tail = Promise.resolve();
   const server = createServer3((socket) => {
@@ -8435,7 +9873,7 @@ function requestMetalProvision(claim, socketPath = DEFAULT_METAL_HELPER_SOCKET)
 }
 
 // src/deployment-runner.ts
-import { chmodSync as chmodSync8, existsSync as existsSync7, realpathSync, unlinkSync as unlinkSync7 } from "fs";
+import { chmodSync as chmodSync8, existsSync as existsSync8, realpathSync, unlinkSync as unlinkSync7 } from "fs";
 import { isAbsolute as isAbsolute4, resolve, sep } from "path";
 import { connect as connect3, createServer as createServer4 } from "net";
 var DEFAULT_DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
@@ -8552,7 +9990,7 @@ function startDeploymentRunner(options) {
   const root = resolve(options.root);
   const home = resolve(options.home);
   const socketPath = options.socketPath ?? DEFAULT_DEPLOYMENT_RUNNER_SOCKET;
-  if (existsSync7(socketPath))
+  if (existsSync8(socketPath))
     unlinkSync7(socketPath);
   const active = new Set;
   const server = createServer4((socket) => {
@@ -8648,7 +10086,7 @@ function requestDeploymentCommand(input, socketPath = DEFAULT_DEPLOYMENT_RUNNER_
 }
 
 // src/snp-attestation.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 
 // ../runtime/dist/snp.js
 var REPORT_BYTES = 1184;
@@ -8741,7 +10179,7 @@ function createSnpAttestationSource(options = {}) {
   const python = options.python ?? "python3";
   const timeoutMs = options.timeoutMs ?? 1e4;
   const spawn = options.spawn ?? Bun.spawn;
-  const exists = options.exists ?? existsSync8;
+  const exists = options.exists ?? existsSync9;
   return {
     name: "linux-sev-guest",
     async report(nonce) {
@@ -8949,7 +10387,7 @@ async function closeServerWithin(server, timeoutMs) {
 }
 
 // src/lifecycle-helper.ts
-import { chmodSync as chmodSync9, existsSync as existsSync9, readFileSync as readFileSync6, unlinkSync as unlinkSync8 } from "fs";
+import { chmodSync as chmodSync9, existsSync as existsSync10, readFileSync as readFileSync6, unlinkSync as unlinkSync8 } from "fs";
 import { connect as connect4, createConnection, createServer as createServer5, isIP as isIP3 } from "net";
 var DEFAULT_LIFECYCLE_HELPER_SOCKET = "/run/forgezero-lifecycle/helper.sock";
 var MAX_REQUEST_BYTES4 = 16 * 1024;
@@ -9090,7 +10528,7 @@ async function executeLifecycleAction(profile, claim, exec = spawnLifecycleComma
 function startLifecycleHelper(options) {
   validateLifecycleProfile(options.profile);
   const socketPath = options.socketPath ?? DEFAULT_LIFECYCLE_HELPER_SOCKET;
-  if (existsSync9(socketPath))
+  if (existsSync10(socketPath))
     unlinkSync8(socketPath);
   let tail = Promise.resolve();
   const server = createServer5((socket) => {
@@ -9252,11 +10690,11 @@ async function configureMeshConnector(input) {
 }
 
 // src/agent-update.ts
-import { createHash as createHash6, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash7, timingSafeEqual, randomUUID as randomUUID2 } from "crypto";
 import {
   chmodSync as chmodSync11,
   closeSync as closeSync2,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   fsyncSync,
   mkdirSync as mkdirSync7,
   openSync as openSync2,
@@ -9271,7 +10709,7 @@ import { dirname as dirname4, join as join7, resolve as resolve2 } from "path";
 var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
 var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
 var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
-var VERSION2 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var VERSION3 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 var REGISTRY = "registry.npmjs.org";
 var syncPath = (path2) => {
   const descriptor = openSync2(path2, "r");
@@ -9296,7 +10734,7 @@ var syncReleaseDirectory = (directory) => {
 function validateAgentRelease(release) {
   if (release?.package !== "@forgezero/agent")
     throw new Error("agent update package is fixed");
-  if (!VERSION2.test(release.version))
+  if (!VERSION3.test(release.version))
     throw new Error("agent update version must be exact semver");
   const expectedTarball = `/@forgezero/agent/-/agent-${release.version}.tgz`;
   let url;
@@ -9314,7 +10752,7 @@ function validateAgentRelease(release) {
   return release;
 }
 function compareVersions(left, right) {
-  if (!VERSION2.test(left) || !VERSION2.test(right))
+  if (!VERSION3.test(left) || !VERSION3.test(right))
     throw new Error("agent version must be exact semver");
   const a = left.split(".").map(Number);
   const b = right.split(".").map(Number);
@@ -9396,7 +10834,7 @@ async function stageAgentRelease(releaseInput, options) {
       throw new Error("agent update tarball is empty or exceeds the size limit");
     }
     const expected = Buffer.from(release.integrity.slice("sha512-".length), "base64");
-    const actual = createHash6("sha512").update(bytes).digest();
+    const actual = createHash7("sha512").update(bytes).digest();
     if (!timingSafeEqual(actual, expected))
       throw new Error("agent update integrity mismatch");
     writeFileSync8(archive, bytes, { mode: 384, flag: "wx" });
@@ -9415,19 +10853,19 @@ async function stageAgentRelease(releaseInput, options) {
       writeFileSync8(destination, extracted.output, { mode: 384, flag: "wx" });
     }
     await validateReleaseDirectory(unpacked, release, run2);
-    if (!existsSync10(finalDirectory)) {
+    if (!existsSync11(finalDirectory)) {
       renameSync5(unpacked, finalDirectory);
       syncReleaseDirectory(finalDirectory);
     } else
       await validateReleaseDirectory(finalDirectory, release, run2);
-    if (!existsSync10(currentLink)) {
+    if (!existsSync11(currentLink)) {
       throw new Error("agent update requires an active immutable release to roll back to");
     }
     const previousTarget = readlinkSync(currentLink);
     if (previousTarget !== join7("versions", options.currentVersion)) {
       throw new Error("agent update current release does not match the running version");
     }
-    if (!existsSync10(join7(root, previousTarget))) {
+    if (!existsSync11(join7(root, previousTarget))) {
       throw new Error("agent update rollback release is missing");
     }
     return {
@@ -9468,7 +10906,7 @@ import { randomUUID as randomUUID3 } from "crypto";
 import {
   chmodSync as chmodSync12,
   closeSync as closeSync3,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   fsyncSync as fsyncSync2,
   mkdirSync as mkdirSync8,
   openSync as openSync3,
@@ -9491,7 +10929,7 @@ var COMPUTE_HELPER_UNITS = [
   "forgezero-lifecycle-helper.service",
   "forgezero-software-helper.service"
 ];
-var VERSION3 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var VERSION4 = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
 var ATTEMPT_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 var REASON_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
 var MAX_REASON_BYTES = 512;
@@ -9514,9 +10952,9 @@ function validateReceipt(value) {
   const receipt = value;
   if (!receipt.attemptId || !ATTEMPT_ID.test(receipt.attemptId))
     throw new Error("Agent update attempt ID is invalid");
-  if (!receipt.fromVersion || !VERSION3.test(receipt.fromVersion))
+  if (!receipt.fromVersion || !VERSION4.test(receipt.fromVersion))
     throw new Error("Agent update source version is invalid");
-  if (!receipt.targetVersion || !VERSION3.test(receipt.targetVersion))
+  if (!receipt.targetVersion || !VERSION4.test(receipt.targetVersion))
     throw new Error("Agent update target version is invalid");
   if (!["activating", "active", "rolled-back", "failed"].includes(receipt.outcome ?? "")) {
     throw new Error("Agent update outcome is invalid");
@@ -9549,7 +10987,7 @@ function validateJournal(value, root) {
     throw new Error("Agent update journal is malformed");
   const legacy = value;
   if (legacy.schemaVersion === undefined) {
-    if (typeof legacy.version === "string" && VERSION3.test(legacy.version) && legacy.outcome === "active" && validTime(legacy.updatedAtTs) && Object.keys(value).every((key) => ["version", "outcome", "updatedAtTs"].includes(key)))
+    if (typeof legacy.version === "string" && VERSION4.test(legacy.version) && legacy.outcome === "active" && validTime(legacy.updatedAtTs) && Object.keys(value).every((key) => ["version", "outcome", "updatedAtTs"].includes(key)))
       return;
     throw new Error("Agent update legacy receipt is malformed");
   }
@@ -9574,7 +11012,7 @@ function validateJournal(value, root) {
   return journal;
 }
 function readJournal(path2, root) {
-  if (!existsSync11(path2))
+  if (!existsSync12(path2))
     return;
   return validateJournal(JSON.parse(readFileSync9(path2, "utf8")), root);
 }
@@ -9632,7 +11070,7 @@ function writeUpdateState(journalPath, receiptPath, journal) {
 }
 function readAgentUpdateReceipt(path2 = AGENT_UPDATE_RECEIPT) {
   try {
-    if (!existsSync11(path2))
+    if (!existsSync12(path2))
       return;
     return validateReceipt(JSON.parse(readFileSync9(path2, "utf8")));
   } catch {
@@ -9788,7 +11226,7 @@ async function recoverInterruptedAgentUpdate(options = {}) {
     return publicReceipt(journal);
   }
   const staged = stagedFromJournal(journal, root);
-  if (!existsSync11(join8(root, journal.previousTarget))) {
+  if (!existsSync12(join8(root, journal.previousTarget))) {
     throw new Error("Agent update rollback release is missing");
   }
   const run2 = options.run ?? runCommand;
@@ -9818,7 +11256,7 @@ async function recoverInterruptedAgentUpdate(options = {}) {
 }
 function startAgentUpdateHelper(options = {}) {
   const socketPath = options.socketPath ?? DEFAULT_AGENT_UPDATE_SOCKET;
-  if (existsSync11(socketPath))
+  if (existsSync12(socketPath))
     unlinkSync10(socketPath);
   mkdirSync8(dirname5(socketPath), { recursive: true, mode: 488 });
   const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
@@ -9935,7 +11373,7 @@ var remoteOutcome4 = (cause) => cause instanceof SignedNodeHttpError && cause.st
 
 class AgentUpdateRefusedError extends Error {
 }
-function observeAgentHost(version = VERSION, mode = "enrolled", osRelease = readFileSync10("/etc/os-release", "utf8"), architecture = process.arch) {
+function observeAgentHost(version = VERSION2, mode = "enrolled", osRelease = readFileSync10("/etc/os-release", "utf8"), architecture = process.arch) {
   const values = Object.fromEntries(osRelease.split(`
 `).flatMap((line) => {
     const separator = line.indexOf("=");
@@ -9949,7 +11387,7 @@ function observeAgentHost(version = VERSION, mode = "enrolled", osRelease = read
   };
 }
 async function heartbeatAgentOnce(options) {
-  let observation = (options.observation ?? (() => observeAgentHost(options.version ?? VERSION, options.mode)))();
+  let observation = (options.observation ?? (() => observeAgentHost(options.version ?? VERSION2, options.mode)))();
   const update = observation.update ?? readAgentUpdateReceipt(options.receiptPath ?? AGENT_UPDATE_RECEIPT);
   if (update)
     observation = { ...observation, update };
@@ -10053,19 +11491,19 @@ function startAgentHeartbeat(options) {
 }
 
 // src/software-helper.ts
-import { chmodSync as chmodSync13, existsSync as existsSync13, mkdirSync as mkdirSync10, unlinkSync as unlinkSync11 } from "fs";
+import { chmodSync as chmodSync13, existsSync as existsSync15, mkdirSync as mkdirSync11, unlinkSync as unlinkSync11 } from "fs";
 import { connect as connect6, createServer as createServer7 } from "net";
-import { dirname as dirname7 } from "path";
+import { dirname as dirname8 } from "path";
 
 // src/service-supervisor.ts
-import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync11, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync10 } from "fs";
+import { createHash as createHash8 } from "crypto";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync11, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname6, join as join9, resolve as resolve4, sep as sep2 } from "path";
 var SERVICE_STATE_DIRECTORY = "/var/lib/forgezero/services";
 var SERVICE_CONFIG_DIRECTORY = "/etc/forgezero/services";
 var SERVICE_UNIT_DIRECTORY = "/etc/systemd/system";
 var SERVICE_NGINX_DIRECTORY = "/etc/nginx/conf.d";
-var idFor = (key) => createHash7("sha256").update(key).digest("hex").slice(0, 24);
+var idFor = (key) => createHash8("sha256").update(key).digest("hex").slice(0, 24);
 var statePath = (id2) => `${SERVICE_STATE_DIRECTORY}/${id2}.json`;
 var within2 = (root, path2) => path2 === root || path2.startsWith(`${root}${sep2}`);
 var defaultHost = {
@@ -10076,8 +11514,8 @@ var defaultHost = {
     renameSync7(next, path2);
   },
   read: (path2) => readFileSync11(path2, "utf8"),
-  exists: existsSync12,
-  list: (path2) => existsSync12(path2) ? readdirSync2(path2) : [],
+  exists: existsSync13,
+  list: (path2) => existsSync13(path2) ? readdirSync2(path2) : [],
   realpath: realpathSync2,
   mkdir: (path2, mode) => mkdirSync9(path2, { recursive: true, mode }),
   remove: (path2) => rmSync6(path2, { force: true }),
@@ -10138,7 +11576,7 @@ function allocatedPorts(request, id2, previous, states) {
   if (previous && previous.applicationPorts.length === required && previous.applicationPorts.every((port) => port >= allocation.from && port <= allocation.to && !occupied.has(port)))
     return [...previous.applicationPorts];
   const width = allocation.to - allocation.from + 1;
-  const start = Number.parseInt(createHash7("sha256").update(request.key).digest("hex").slice(0, 8), 16) % width;
+  const start = Number.parseInt(createHash8("sha256").update(request.key).digest("hex").slice(0, 8), 16) % width;
   for (let offset = 0;offset < width; offset += 1) {
     const first = allocation.from + (start + offset) % width;
     const candidate = Array.from({ length: required }, (_, index) => first + index);
@@ -10274,6 +11712,297 @@ async function activateSupervisedService(request, host = defaultHost) {
   return state;
 }
 
+// src/container-supervisor.ts
+import { createHash as createHash9 } from "crypto";
+import { existsSync as existsSync14, mkdirSync as mkdirSync10, readFileSync as readFileSync12, readdirSync as readdirSync3, realpathSync as realpathSync3, renameSync as renameSync8, rmSync as rmSync7, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname7, resolve as resolve5, sep as sep3 } from "path";
+var defaultHost2 = {
+  realpath: realpathSync3,
+  exists: existsSync14,
+  read: (path2) => readFileSync12(path2, "utf8"),
+  write(path2, content, mode) {
+    mkdirSync10(dirname7(path2), { recursive: true, mode: 493 });
+    const next = `${path2}.next`;
+    writeFileSync11(next, content, { mode });
+    renameSync8(next, path2);
+  },
+  remove: (path2) => rmSync7(path2, { force: true }),
+  list: (path2) => existsSync14(path2) ? readdirSync3(path2) : [],
+  mkdir: (path2, mode) => mkdirSync10(path2, { recursive: true, mode }),
+  async exec(argv2) {
+    const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  async health(port, path2, timeoutMs, method, expectedStatus) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path2}`, { method, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return expectedStatus.includes(response.status);
+    } catch {
+      return false;
+    }
+  },
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
+var within3 = (root, path2) => path2 === root || path2.startsWith(`${root}${sep3}`);
+var idFor2 = (key) => createHash9("sha256").update(key).digest("hex").slice(0, 24);
+var statePath2 = (id2) => `${SERVICE_STATE_DIRECTORY}/${id2}.json`;
+var nameFor = (id2, slot) => `forgezero-${id2}-slot${slot}`;
+function validateRequest(request, host) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/.test(request.key) || !/^[a-f0-9]{40}$/.test(request.revision) || !/^[a-z][A-Za-z0-9-]{0,62}$/.test(request.component))
+    throw new Error("CONTAINER_IDENTITY_INVALID");
+  const root = host.realpath(resolve5(request.root));
+  const release = host.realpath(resolve5(request.release));
+  if (!within3(root, release))
+    throw new Error("CONTAINER_RELEASE_OUTSIDE_ROOT");
+  const application = request.application;
+  if (application.kind !== "application" || application.runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  if (!application.resources.cpu || !application.resources.memory || !application.resources.pids)
+    throw new Error("CONTAINER_LIMITS_REQUIRED");
+  if (application.runtime.security.privileged !== false || application.runtime.security.noNewPrivileges !== true || !application.runtime.security.dropCapabilities.includes("ALL"))
+    throw new Error("CONTAINER_SECURITY_INVALID");
+  if (!application.network?.container || !["bridge", "host"].includes(application.network.container.mode))
+    throw new Error("CONTAINER_NETWORK_INVALID");
+  if (!application.network.ingress?.stablePort)
+    throw new Error("CONTAINER_STABLE_PORT_REQUIRED");
+  return { ...request, root, release };
+}
+async function checked6(host, argv2, code) {
+  const result = await host.exec(argv2);
+  if (result.exitCode !== 0)
+    throw new Error(`${code}: ${result.output.slice(0, 512)}`);
+  return result.output.trim();
+}
+async function buildContainerImage(requestValue, host = defaultHost2) {
+  const request = validateRequest(requestValue, host);
+  const runtime = request.application.runtime;
+  if (runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  const source = runtime.image.source;
+  if (source.kind === "registry") {
+    if (!source.reference.includes("@sha256:"))
+      throw new Error("CONTAINER_IMAGE_DIGEST_REQUIRED");
+    await checked6(host, ["/usr/bin/docker", "pull", "--quiet", source.reference], "CONTAINER_PULL_FAILED");
+    const digest2 = await checked6(host, ["/usr/bin/docker", "image", "inspect", "--format={{.Id}}", source.reference], "CONTAINER_INSPECT_FAILED");
+    if (!/^sha256:[a-f0-9]{64}$/.test(digest2))
+      throw new Error("CONTAINER_DIGEST_INVALID");
+    return { image: source.reference, digest: digest2 };
+  }
+  const context = host.realpath(resolve5(request.release, source.context));
+  const dockerfile = host.realpath(resolve5(request.release, source.dockerfile));
+  if (!within3(request.release, context) || !within3(context, dockerfile))
+    throw new Error("CONTAINER_BUILD_PATH_INVALID");
+  const tag = `forgezero/${idFor2(request.key)}:${request.revision}`;
+  await checked6(host, [
+    "/usr/bin/docker",
+    "build",
+    "--pull",
+    ...request.noCache ? ["--no-cache"] : [],
+    "--file",
+    dockerfile,
+    "--tag",
+    tag,
+    "--label",
+    `net.forgezero.revision=${request.revision}`,
+    "--label",
+    `net.forgezero.component=${request.component}`,
+    context
+  ], "CONTAINER_BUILD_FAILED");
+  const digest = await checked6(host, ["/usr/bin/docker", "image", "inspect", "--format={{.Id}}", tag], "CONTAINER_INSPECT_FAILED");
+  if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+    throw new Error("CONTAINER_DIGEST_INVALID");
+  return { image: tag, digest };
+}
+function readState2(host, id2) {
+  if (!host.exists(statePath2(id2)))
+    return null;
+  try {
+    const value = JSON.parse(host.read(statePath2(id2)));
+    return value.format === 1 ? value : null;
+  } catch {
+    return null;
+  }
+}
+function usedPorts(host, exceptId) {
+  const ports = new Set;
+  for (const name of host.list(SERVICE_STATE_DIRECTORY).filter((entry) => /^[a-f0-9]{24}\.json$/.test(entry))) {
+    try {
+      const state = JSON.parse(host.read(`${SERVICE_STATE_DIRECTORY}/${name}`));
+      if (state.id !== exceptId) {
+        ports.add(state.publicPort);
+        state.applicationPorts.forEach((port) => ports.add(port));
+      }
+    } catch {}
+  }
+  return ports;
+}
+function allocatePorts(host, id2, count, stablePort, previous) {
+  const used = usedPorts(host, id2);
+  if (used.has(stablePort))
+    throw new Error("CONTAINER_PUBLIC_PORT_CONFLICT");
+  if (previous?.applicationPorts.length === count && previous.applicationPorts.every((port) => !used.has(port)))
+    return [...previous.applicationPorts];
+  const from = 20000;
+  const to = 49999;
+  const width = to - from + 1;
+  const start = Number.parseInt(id2.slice(0, 8), 16) % width;
+  for (let offset = 0;offset < width; offset += 1) {
+    const first = from + (start + offset) % width;
+    const values = Array.from({ length: count }, (_, index) => first + index);
+    if (values.at(-1) <= to && values.every((port) => port !== stablePort && !used.has(port)))
+      return values;
+  }
+  throw new Error("CONTAINER_PORTS_EXHAUSTED");
+}
+function nginx2(request, id2, port) {
+  const service = request.application.service;
+  const stablePort = request.application.network.ingress.stablePort;
+  return `# ForgeZero container ${id2}
+${service.maximumConnections ? `limit_conn_zone $server_name zone=fz_${id2}:64k;
+` : ""}server {
+  listen 127.0.0.1:${stablePort};
+  server_name _;
+${service.maximumConnections ? `  limit_conn fz_${id2} ${service.maximumConnections};
+  limit_conn_status 503;
+` : ""}  location / {
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+${service.websocket ? `    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+` : ""}    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+`;
+}
+function runArgv(request, id2, slot, port, networkName) {
+  const { application } = request;
+  const resources = application.resources;
+  const runtime = application.runtime;
+  if (runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  const memory = resources.memory;
+  const network = application.network.container;
+  const argv2 = [
+    "/usr/bin/docker",
+    "run",
+    "--detach",
+    "--name",
+    nameFor(id2, slot),
+    "--restart",
+    "unless-stopped",
+    "--label",
+    `net.forgezero.key=${request.key}`,
+    "--label",
+    `net.forgezero.revision=${request.revision}`,
+    "--cpus",
+    String(resources.cpu.limit),
+    "--cpu-shares",
+    String(resources.cpu.weight ?? 100),
+    "--memory",
+    `${memory.limitMiB}m`,
+    ...memory.reservationMiB ? ["--memory-reservation", `${memory.reservationMiB}m`] : [],
+    ...memory.swap === "disabled" ? ["--memory-swap", `${memory.limitMiB}m`] : [],
+    "--pids-limit",
+    String(resources.pids.limit),
+    "--security-opt",
+    "no-new-privileges=true",
+    "--cap-drop",
+    "ALL",
+    ...runtime.security.root === "read-only" ? ["--read-only"] : [],
+    ...network.mode === "host" ? ["--network", "host", "--env", `FZ_APP_PORT=${port}`] : ["--network", networkName, "--publish", `127.0.0.1:${port}:${application.service.port}`]
+  ];
+  for (const mount of application.storage ?? []) {
+    if (mount.class === "ephemeral")
+      argv2.push("--tmpfs", `${mount.path}:rw,noexec,nosuid,size=${mount.sizeMiB}m`);
+    else
+      argv2.push("--volume", `forgezero-${id2}-${mount.name}:${mount.path}`);
+  }
+  argv2.push(request.image, ...runtime.entrypoint ?? []);
+  return argv2;
+}
+async function activateContainer(requestValue, host = defaultHost2) {
+  const request = validateRequest(requestValue, host);
+  if (!/^sha256:[a-f0-9]{64}$/.test(request.image) && !/^forgezero\/[a-f0-9]{24}:[a-f0-9]{40}$/.test(request.image) && !request.image.includes("@sha256:"))
+    throw new Error("CONTAINER_IMAGE_INVALID");
+  const id2 = idFor2(request.key);
+  host.mkdir(SERVICE_STATE_DIRECTORY, 448);
+  host.mkdir(SERVICE_NGINX_DIRECTORY, 493);
+  const previous = readState2(host, id2);
+  const slots = request.application.rollout.strategy === "blue-green" ? 2 : 1;
+  if (!["direct", "blue-green"].includes(request.application.rollout.strategy))
+    throw new Error("CONTAINER_ROLLOUT_REQUIRES_CONTROL_PLANE");
+  const containerNetwork = request.application.network.container;
+  let networkName = "host";
+  if (containerNetwork.mode === "bridge") {
+    networkName = containerNetwork.network ? `forgezero-${id2}-${containerNetwork.network}` : "bridge";
+    if (networkName !== "bridge") {
+      const inspected = await host.exec(["/usr/bin/docker", "network", "inspect", '--format={{index .Labels "net.forgezero.owner"}}', networkName]);
+      if (inspected.exitCode !== 0) {
+        await checked6(host, ["/usr/bin/docker", "network", "create", "--driver", "bridge", "--label", `net.forgezero.owner=${id2}`, networkName], "CONTAINER_NETWORK_CREATE_FAILED");
+      } else if (inspected.output.trim() !== id2)
+        throw new Error("CONTAINER_NETWORK_OWNERSHIP_INVALID");
+    }
+  }
+  const ports = allocatePorts(host, id2, slots, request.application.network.ingress.stablePort, previous);
+  const nextSlot = slots === 2 && previous?.activeSlot === 0 ? 1 : 0;
+  const port = ports[nextSlot];
+  const name = nameFor(id2, nextSlot);
+  await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+  await checked6(host, runArgv(request, id2, nextSlot, port, networkName), "CONTAINER_START_FAILED");
+  let healthy = false;
+  const health = request.application.service.health;
+  for (let attempt = 0;attempt < (health.attempts ?? 30); attempt += 1) {
+    if (await host.health(port, health.path, health.timeoutMs, health.method, health.expectedStatus)) {
+      healthy = true;
+      break;
+    }
+    await host.sleep(health.intervalMs ?? 1000);
+  }
+  if (!healthy) {
+    await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+    throw new Error("CONTAINER_HEALTH_FAILED");
+  }
+  const nginxPath = `${SERVICE_NGINX_DIRECTORY}/forgezero-${id2}.conf`;
+  const previousNginx = host.exists(nginxPath) ? host.read(nginxPath) : null;
+  host.write(nginxPath, nginx2(request, id2, port), 420);
+  try {
+    await checked6(host, ["/usr/sbin/nginx", "-t"], "CONTAINER_NGINX_INVALID");
+    await checked6(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "CONTAINER_NGINX_RELOAD_FAILED");
+  } catch (cause) {
+    if (previousNginx === null)
+      host.remove(nginxPath);
+    else
+      host.write(nginxPath, previousNginx, 420);
+    await host.exec(["/usr/sbin/nginx", "-t"]);
+    await host.exec(["/usr/bin/systemctl", "reload", "nginx.service"]);
+    await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+    throw cause;
+  }
+  const state = {
+    format: 1,
+    id: id2,
+    key: request.key,
+    revision: request.revision,
+    strategy: request.application.rollout.strategy,
+    publicPort: request.application.network.ingress.stablePort,
+    applicationPorts: ports,
+    activeSlot: nextSlot,
+    healthPath: health.path,
+    updatedAtTs: host.now()
+  };
+  host.write(statePath2(id2), `${JSON.stringify(state, null, 2)}
+`, 384);
+  if (previous && previous.activeSlot !== nextSlot) {
+    await host.sleep(request.application.rollout.drainMs ?? 30000);
+    await host.exec(["/usr/bin/docker", "rm", "--force", nameFor(id2, previous.activeSlot)]);
+  }
+  return state;
+}
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -10282,11 +12011,13 @@ var MAX_REQUEST_BYTES6 = 128 * 1024;
 var MAX_PENDING_REQUESTS = 128;
 function startSoftwareHelper(options = {}) {
   const socketPath = options.socketPath ?? DEFAULT_SOFTWARE_HELPER_SOCKET;
-  if (existsSync13(socketPath))
+  if (existsSync15(socketPath))
     unlinkSync11(socketPath);
-  mkdirSync10(dirname7(socketPath), { recursive: true, mode: 488 });
+  mkdirSync11(dirname8(socketPath), { recursive: true, mode: 488 });
   const ensure = options.ensure ?? ensureSoftwareRequirements;
   const activate = options.activate ?? activateSupervisedService;
+  const buildContainer = options.buildContainer ?? buildContainerImage;
+  const activateTypedContainer = options.activateContainer ?? activateContainer;
   let tail = Promise.resolve();
   let pending = 0;
   const server = createServer7((socket) => {
@@ -10319,10 +12050,29 @@ function startSoftwareHelper(options = {}) {
           return;
         }
         if (request.op === "activate-service" && request.request) {
-          if (!options.allowedRoot || request.request.root !== options.allowedRoot) {
+          const serviceRequest = request.request;
+          if (!options.allowedRoot || serviceRequest.root !== options.allowedRoot) {
             throw new Error("service deployment root is not owned by this helper");
           }
-          const state = await activate(request.request);
+          const state = await activate(serviceRequest);
+          socket.end(`${JSON.stringify({ ok: true, state })}
+`);
+          return;
+        }
+        if (request.op === "build-container" && request.request) {
+          const containerRequest = request.request;
+          if (!options.allowedRoot || containerRequest.root !== options.allowedRoot)
+            throw new Error("container deployment root is not owned by this helper");
+          const result = await buildContainer(containerRequest);
+          socket.end(`${JSON.stringify({ ok: true, result })}
+`);
+          return;
+        }
+        if (request.op === "activate-container" && request.request) {
+          const containerRequest = request.request;
+          if (!options.allowedRoot || containerRequest.root !== options.allowedRoot)
+            throw new Error("container deployment root is not owned by this helper");
+          const state = await activateTypedContainer(containerRequest);
           socket.end(`${JSON.stringify({ ok: true, state })}
 `);
           return;
@@ -10346,8 +12096,43 @@ function startSoftwareHelper(options = {}) {
   server.listen(socketPath, () => chmodSync13(socketPath, 432));
   return server;
 }
+function requestContainer(op, request, socketPath, timeoutMs) {
+  return new Promise((resolve6, reject) => {
+    const socket = connect6(socketPath, () => socket.write(`${JSON.stringify({ op, request })}
+`));
+    let buffer = "";
+    socket.setTimeout(timeoutMs, () => {
+      socket.destroy();
+      reject(new Error("container helper timed out"));
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      socket.end();
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        const result = response.result ?? response.state;
+        if (!response.ok || !result)
+          throw new Error(response.error?.message ?? "container helper refused request");
+        resolve6(result);
+      } catch (cause) {
+        reject(cause);
+      }
+    });
+    socket.on("error", reject);
+  });
+}
+function requestContainerBuild(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 30 * 60000) {
+  return requestContainer("build-container", request, socketPath, timeoutMs);
+}
+function requestContainerActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
+  return requestContainer("activate-container", request, socketPath, timeoutMs);
+}
 function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 10 * 60000) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const socket = connect6(socketPath, () => socket.write(`${JSON.stringify({ op: "activate-service", request })}
 `));
     let buffer = "";
@@ -10366,7 +12151,7 @@ function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_
         const response = JSON.parse(buffer.slice(0, newline));
         if (!response.ok || !response.state)
           throw new Error(response.error?.message ?? "service helper refused activation");
-        resolve5(response.state);
+        resolve6(response.state);
       } catch (cause) {
         reject(cause);
       }
@@ -10376,7 +12161,7 @@ function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_
 }
 function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
   validateSoftwareRequirements(requirements);
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const socket = connect6(socketPath, () => socket.write(`${JSON.stringify({ op: "ensure", requirements })}
 `));
     let buffer = "";
@@ -10395,7 +12180,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
         const response = JSON.parse(buffer.slice(0, newline));
         if (!response.ok || !response.results)
           throw new Error(response.error?.message ?? "software helper refused the request");
-        resolve5(response.results);
+        resolve6(response.results);
       } catch (cause) {
         reject(cause);
       }
@@ -10405,7 +12190,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/egress-policy.ts
-import { realpathSync as realpathSync3 } from "fs";
+import { realpathSync as realpathSync4 } from "fs";
 var AGENT_EGRESS_TABLE = "forgezero_agent_egress";
 var SYSTEMD_RESOLVED_STUB = "/run/systemd/resolve/stub-resolv.conf";
 var SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
@@ -10569,7 +12354,7 @@ function resolveServiceUid(user, command2 = systemCommand) {
   assertUid(uid);
   return uid;
 }
-function assertResolvedStub(realpath = realpathSync3) {
+function assertResolvedStub(realpath = realpathSync4) {
   let source;
   try {
     source = realpath("/etc/resolv.conf");
@@ -10680,7 +12465,7 @@ async function superviseAgentEgressPolicy(options) {
     if (result.exitCode !== 0)
       throw new Error("Could not notify systemd that Agent egress is ready.");
   }))();
-  const wait = options.wait ?? ((milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)));
+  const wait = options.wait ?? ((milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds)));
   const intervalMs = options.intervalMs ?? 1000;
   if (!Number.isSafeInteger(intervalMs) || intervalMs < 100 || intervalMs > 60000) {
     throw new Error("Agent egress monitor interval is invalid.");
@@ -10901,7 +12686,7 @@ function createAgentTelemetry(input, options = {}) {
   const warn = options.warn ?? ((message) => console.warn(`[telemetry] ${message}`));
   const now = options.now ?? Date.now;
   const random = options.random ?? Math.random;
-  const wait = options.wait ?? ((milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds)));
+  const wait = options.wait ?? ((milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds)));
   const processStartedAtMs = Math.max(0, Math.floor(now()));
   const processInstanceId = randomHex(16);
   const resource = {
@@ -10971,10 +12756,10 @@ function createAgentTelemetry(input, options = {}) {
         if (!transient || attempt + 1 >= AGENT_OTLP_MAX_ATTEMPTS)
           throw new PermanentExportError;
         const retryAfter2 = cause instanceof RetryableExportError ? cause.retryAfterMs : null;
-        const backoff = AGENT_OTLP_RETRY_BASE_MS * 2 ** attempt;
+        const backoff2 = AGENT_OTLP_RETRY_BASE_MS * 2 ** attempt;
         const randomValue = random();
-        const jitter = Math.floor((Number.isFinite(randomValue) ? Math.max(0, Math.min(1, randomValue)) : 0) * backoff);
-        await wait(Math.min(AGENT_OTLP_MAX_RETRY_DELAY_MS, Math.max(retryAfter2 ?? 0, backoff + jitter)));
+        const jitter = Math.floor((Number.isFinite(randomValue) ? Math.max(0, Math.min(1, randomValue)) : 0) * backoff2);
+        await wait(Math.min(AGENT_OTLP_MAX_RETRY_DELAY_MS, Math.max(retryAfter2 ?? 0, backoff2 + jitter)));
       }
     }
     throw new PermanentExportError;
@@ -11109,8 +12894,8 @@ function createAgentTelemetry(input, options = {}) {
         } }, { name: "forgezero.agent.operations", sum: {
           aggregationTemporality: 2,
           isMonotonic: true,
-          dataPoints: metricRows.map((row, index) => ({
-            attributes: row.attributes,
+          dataPoints: metricRows.map((row2, index) => ({
+            attributes: row2.attributes,
             asInt: String(metricValues[index].count),
             startTimeUnixNano,
             timeUnixNano
@@ -11340,17 +13125,17 @@ import {
   chmodSync as chmodSync14,
   chownSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync14,
+  existsSync as existsSync16,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync11,
-  readFileSync as readFileSync12,
-  readdirSync as readdirSync3,
-  realpathSync as realpathSync4,
-  renameSync as renameSync8,
-  rmSync as rmSync7,
+  mkdirSync as mkdirSync12,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync4,
+  realpathSync as realpathSync5,
+  renameSync as renameSync9,
+  rmSync as rmSync8,
   statSync as statSync3,
   symlinkSync as symlinkSync4,
-  writeFileSync as writeFileSync11
+  writeFileSync as writeFileSync12
 } from "fs";
 import { join as join10 } from "path";
 var boundedInteger2 = (name, value, minimum, maximum) => {
@@ -11404,13 +13189,13 @@ var platformExec = async (argv2) => {
 };
 var replaceLink = (path2, target2) => {
   const pending = `${path2}.next`;
-  rmSync7(pending, { force: true });
+  rmSync8(pending, { force: true });
   if (!target2) {
-    rmSync7(path2, { force: true });
+    rmSync8(path2, { force: true });
     return;
   }
   symlinkSync4(target2, pending);
-  renameSync8(pending, path2);
+  renameSync9(pending, path2);
 };
 var secureRelease = (path2, uid, gid) => {
   const visit = (current) => {
@@ -11420,7 +13205,7 @@ var secureRelease = (path2, uid, gid) => {
     chownSync(current, uid, gid);
     chmodSync14(current, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
-      for (const name of readdirSync3(current))
+      for (const name of readdirSync4(current))
         visit(join10(current, name));
   };
   visit(path2);
@@ -11428,28 +13213,28 @@ var secureRelease = (path2, uid, gid) => {
 async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const rendered = renderPlatformActivationFiles(config);
   const normalized = JSON.parse(rendered.helper);
-  const releases = realpathSync4(join10(normalized.root, "releases"));
-  const release = realpathSync4(requestedRelease);
+  const releases = realpathSync5(join10(normalized.root, "releases"));
+  const release = realpathSync5(requestedRelease);
   if (!release.startsWith(`${releases}/`) || release === releases)
     throw new Error("release is outside configured releases directory");
-  for (const required of [".fz/deploy.json", "src/index.ts", "bun.lock"]) {
+  for (const required of ["forgezero.deploy.ts", ".fz/deploy.plan.json", "src/index.ts", "bun.lock"]) {
     const metadata = statSync3(join10(release, required));
     if (!metadata.isFile() || metadata.size < 1)
       throw new Error(`release is incomplete: ${required}`);
   }
   const exec = options.exec ?? platformExec;
   const request = options.fetch ?? fetch;
-  const sleep = options.sleep ?? Bun.sleep;
+  const sleep2 = options.sleep ?? Bun.sleep;
   const slots = join10(normalized.root, "slots");
-  mkdirSync11(slots, { recursive: true, mode: 493 });
+  mkdirSync12(slots, { recursive: true, mode: 493 });
   const slotFile = join10(normalized.root, ".forge-slot");
-  const previousSlot = existsSync14(slotFile) ? readFileSync12(slotFile, "utf8").trim() : undefined;
+  const previousSlot = existsSync16(slotFile) ? readFileSync13(slotFile, "utf8").trim() : undefined;
   const target2 = previousSlot === "blue" ? "green" : "blue";
   const port = target2 === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join10(slots, target2);
   let previousTarget;
   try {
-    previousTarget = realpathSync4(targetLink);
+    previousTarget = realpathSync5(targetLink);
   } catch {}
   const user = await exec(["/usr/bin/id", "-u", normalized.serviceUser]);
   const group = await exec(["/usr/bin/id", "-g", normalized.serviceUser]);
@@ -11471,7 +13256,7 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
     } catch {}
     if (healthy)
       break;
-    await sleep(1000);
+    await sleep2(1000);
   }
   const stopTarget = async () => {
     await exec(["/usr/bin/systemctl", "stop", service]);
@@ -11483,40 +13268,40 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   }
   const upstream = "/etc/nginx/conf.d/forgezero-upstream.conf";
   const backup = `${upstream}.forgezero-backup`;
-  if (existsSync14(upstream))
+  if (existsSync16(upstream))
     copyFileSync2(upstream, backup);
   else
-    rmSync7(backup, { force: true });
-  writeFileSync11(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
+    rmSync8(backup, { force: true });
+  writeFileSync12(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
 `, { mode: 420 });
   const test = await exec(["/usr/sbin/nginx", "-t"]);
   const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
   if (reload.exitCode !== 0) {
-    if (existsSync14(backup))
-      renameSync8(backup, upstream);
+    if (existsSync16(backup))
+      renameSync9(backup, upstream);
     else
-      rmSync7(upstream, { force: true });
+      rmSync8(upstream, { force: true });
     await exec(["/usr/sbin/nginx", "-t"]);
     await exec(["/usr/sbin/nginx", "-s", "reload"]);
     await stopTarget();
     throw new Error("nginx refused the promoted upstream");
   }
-  rmSync7(backup, { force: true });
-  writeFileSync11(slotFile, `${target2}
+  rmSync8(backup, { force: true });
+  writeFileSync12(slotFile, `${target2}
 `, { mode: 420 });
   if (previousSlot && previousSlot !== target2) {
-    await sleep(normalized.drainDeadlineMs);
+    await sleep2(normalized.drainDeadlineMs);
     await exec(["/usr/bin/systemctl", "stop", `forgezero@${previousSlot}.service`]);
   }
-  const old = readdirSync3(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join10(releases, entry.name)).sort((left, right) => statSync3(right).mtimeMs - statSync3(left).mtimeMs).slice(normalized.keepReleases);
+  const old = readdirSync4(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join10(releases, entry.name)).sort((left, right) => statSync3(right).mtimeMs - statSync3(left).mtimeMs).slice(normalized.keepReleases);
   for (const path2 of old)
     if (path2 !== release)
-      rmSync7(path2, { recursive: true, force: true });
+      rmSync8(path2, { recursive: true, force: true });
   return { release, slot: target2 };
 }
 
 // src/recovery-host.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13, statSync as statSync4 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync14, statSync as statSync4 } from "fs";
 import { hostname } from "os";
 import { join as join11 } from "path";
 var execute2 = async (argv2) => {
@@ -11524,25 +13309,25 @@ var execute2 = async (argv2) => {
   const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
   return { stdout, stderr, exitCode };
 };
-var checked6 = async (run2, argv2, expected = 0) => {
+var checked7 = async (run2, argv2, expected = 0) => {
   const result = await run2(argv2);
   if (result.exitCode !== expected)
     throw new Error(`${argv2[0]} failed (${result.exitCode})`);
   return result;
 };
 var activeSlot = () => {
-  const slot = readFileSync13("/opt/forgezero/.forge-slot", "utf8").trim();
+  const slot = readFileSync14("/opt/forgezero/.forge-slot", "utf8").trim();
   if (slot !== "blue" && slot !== "green")
     throw new Error("invalid active slot");
   return slot;
 };
 var exactState = (path2, expected) => {
-  if (!readFileSync13(path2, "utf8").split(`
+  if (!readFileSync14(path2, "utf8").split(`
 `).includes(expected))
     throw new Error(`state mismatch: ${expected}`);
 };
 var nonEmpty = (path2) => {
-  if (!existsSync15(path2) || !statSync4(path2).isFile() || statSync4(path2).size < 1)
+  if (!existsSync17(path2) || !statSync4(path2).isFile() || statSync4(path2).size < 1)
     throw new Error(`required file missing: ${path2}`);
 };
 var option = (args, name) => {
@@ -11586,29 +13371,29 @@ async function runRecoveryHost(args, run2 = execute2) {
     const slot = activeSlot();
     nonEmpty(join11("/opt/forgezero/slots", slot, "src/server/maintenance/restore-backup.ts"));
     nonEmpty(join11("/opt/forgezero/slots", slot, "src/server/maintenance/verify-recovery-cluster.ts"));
-    await checked6(run2, ["/usr/bin/test", "-x", "/usr/local/bin/fz"]);
-    await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero-db.service"], hasDatabase ? 0 : 3);
+    await checked7(run2, ["/usr/bin/test", "-x", "/usr/local/bin/fz"]);
+    await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero-db.service"], hasDatabase ? 0 : 3);
     if (args.includes("--require-stopped")) {
-      await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@blue.service"], 3);
-      await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@green.service"], 3);
+      await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@blue.service"], 3);
+      await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@green.service"], 3);
     }
     return;
   }
   if (action === "fence") {
-    await checked6(run2, ["/usr/bin/systemctl", "stop", "forgezero@blue.service", "forgezero@green.service"]);
-    await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@blue.service"], 3);
-    await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@green.service"], 3);
+    await checked7(run2, ["/usr/bin/systemctl", "stop", "forgezero@blue.service", "forgezero@green.service"]);
+    await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@blue.service"], 3);
+    await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero@green.service"], 3);
     const role = option(args, "db-role");
-    await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero-db.service"], role === "none" ? 3 : 0);
+    await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", "forgezero-db.service"], role === "none" ? 3 : 0);
     return;
   }
   if (action === "start-active") {
     const slot = activeSlot();
     const inactive = slot === "blue" ? "green" : "blue";
-    await checked6(run2, ["/usr/bin/systemctl", "stop", `forgezero@${inactive}.service`]);
-    await checked6(run2, ["/usr/bin/systemctl", "start", `forgezero@${slot}.service`]);
-    await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${slot}.service`]);
-    await checked6(run2, ["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${inactive}.service`], 3);
+    await checked7(run2, ["/usr/bin/systemctl", "stop", `forgezero@${inactive}.service`]);
+    await checked7(run2, ["/usr/bin/systemctl", "start", `forgezero@${slot}.service`]);
+    await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${slot}.service`]);
+    await checked7(run2, ["/usr/bin/systemctl", "is-active", "--quiet", `forgezero@${inactive}.service`], 3);
     return;
   }
   if (action === "maintenance") {
@@ -11631,7 +13416,7 @@ async function runRecoveryHost(args, run2 = execute2) {
         "--property=LoadCredentialEncrypted=backup-recovery-root:/etc/forgezero/creds/backup-recovery-root.cred"
       ] : []
     ];
-    await checked6(run2, ["/usr/bin/systemd-run", "--quiet", "--wait", "--pipe", "--collect", `--unit=${unit2(option(args, "unit"))}`, ...properties, "/usr/local/bin/fz", ...fzArgs]);
+    await checked7(run2, ["/usr/bin/systemd-run", "--quiet", "--wait", "--pipe", "--collect", `--unit=${unit2(option(args, "unit"))}`, ...properties, "/usr/local/bin/fz", ...fzArgs]);
     return;
   }
   throw new Error("unknown recovery-host action");
@@ -11643,15 +13428,15 @@ import { lstatSync as lstatSync5 } from "fs";
 // src/bootstrap.ts
 import {
   chmodSync as chmodSync16,
-  existsSync as existsSync17,
+  existsSync as existsSync19,
   lstatSync as lstatSync4,
-  mkdirSync as mkdirSync13,
-  readFileSync as readFileSync15,
-  renameSync as renameSync10,
-  rmSync as rmSync9,
-  writeFileSync as writeFileSync13
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync16,
+  renameSync as renameSync11,
+  rmSync as rmSync10,
+  writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/provision.ts
@@ -12354,7 +14139,7 @@ fz-agent egress-policy-check`;
     return "/usr/bin/apt-get install -y cloudflare-warp";
   return "/usr/bin/warp-cli --accept-tos status";
 };
-var step = (label, operation, optional = false) => ({
+var step2 = (label, operation, optional = false) => ({
   label,
   operation,
   optional: optional || undefined,
@@ -12477,44 +14262,44 @@ function planProvision(options) {
     socketPath: options.socketPath,
     user,
     steps: [
-      ...options.enforceEgress ? [step("Ubuntu Agent egress prerequisites", { kind: "commands", commands: [
+      ...options.enforceEgress ? [step2("Ubuntu Agent egress prerequisites", { kind: "commands", commands: [
         { argv: ["/usr/bin/apt-get", "update", "-qq"] },
         { argv: ["/usr/bin/apt-get", "install", "-y", "nftables"] },
         { argv: ["/usr/bin/systemctl", "enable", "--now", "systemd-resolved.service"] }
-      ] }), step("prove systemd-resolved stub ownership", { kind: "verify-resolved-stub" })] : [],
-      step("vault socket access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", VAULT_GROUP], acceptedExitCodes: [0, 9] }] }),
-      step("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
-      ...sourceBinPath && binPath ? [step("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION })] : [],
-      ...warpEnabled ? [step("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
-      ...deploymentEnabled ? [step("deployment isolation group", { kind: "commands", commands: [
+      ] }), step2("prove systemd-resolved stub ownership", { kind: "verify-resolved-stub" })] : [],
+      step2("vault socket access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", VAULT_GROUP], acceptedExitCodes: [0, 9] }] }),
+      step2("Agent update helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", AGENT_UPDATE_GROUP], acceptedExitCodes: [0, 9] }] }),
+      ...sourceBinPath && binPath ? [step2("root-owned agent runtime", { kind: "install-runtime", source: sourceBinPath, binary: binPath, version: VERSION2 })] : [],
+      ...warpEnabled ? [step2("Cloudflare One client for Ubuntu 26.04", { kind: "install-warp" })] : [],
+      ...deploymentEnabled ? [step2("deployment isolation group", { kind: "commands", commands: [
         { argv: ["/usr/sbin/groupadd", "--system", DEPLOYMENT_GROUP], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/groupadd", "--system", SOFTWARE_HELPER_GROUP], acceptedExitCodes: [0, 9] }
       ] })] : [],
-      ...lifecycleEnabled ? [step("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
-      step("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
-      step("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
-      step("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
-      ...lifecycleEnabled ? [step("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
-      ...deploymentEnabled ? [step("credential-free deployment account", { kind: "commands", commands: [
+      ...lifecycleEnabled ? [step2("lifecycle helper access group", { kind: "commands", commands: [{ argv: ["/usr/sbin/groupadd", "--system", LIFECYCLE_GROUP], acceptedExitCodes: [0, 9] }] })] : [],
+      step2("service account", { kind: "commands", commands: [{ argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", user], acceptedExitCodes: [0, 9] }] }),
+      step2("bind service account to vault group", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-g", VAULT_GROUP, user] }] }),
+      step2("grant verified Agent update access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", AGENT_UPDATE_GROUP, user] }] }),
+      ...lifecycleEnabled ? [step2("grant lifecycle helper socket access", { kind: "commands", commands: [{ argv: ["/usr/sbin/usermod", "-a", "-G", LIFECYCLE_GROUP, user] }] })] : [],
+      ...deploymentEnabled ? [step2("credential-free deployment account", { kind: "commands", commands: [
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", DEPLOYMENT_GROUP, DEPLOYMENT_RUNNER_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", "--gid", VAULT_GROUP, APPLICATION_RUNTIME_USER], acceptedExitCodes: [0, 9] },
         { argv: ["/usr/sbin/usermod", "-a", "-G", DEPLOYMENT_GROUP, APPLICATION_RUNTIME_USER] },
         { argv: ["/usr/sbin/usermod", "-a", "-G", `${DEPLOYMENT_GROUP},${SOFTWARE_HELPER_GROUP}`, user] }
       ] })] : [],
-      step("credential and state directories", { kind: "directories", directories: [
+      step2("credential and state directories", { kind: "directories", directories: [
         { path: credentialDir, mode: 448, owner: "root", group: "root" },
         { path: "/var/lib/forgezero", mode: 488, owner: "root", group: "root" }
       ] }),
-      step("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
+      step2("encrypted node identity", { kind: "ensure-seed", credential: seedCredentialPath }),
       ...options.generateGitIdentity && gitCredentialPath && gitPublicKeyPath ? [
-        step("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
-        step("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
+        step2("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
+        step2("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
       ] : [],
       ...bootstrapEnabled ? [
-        step("bootstrap SSH public identity directory", { kind: "directories", directories: [
+        step2("bootstrap SSH public identity directory", { kind: "directories", directories: [
           { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
         ] }),
-        step("unique encrypted bootstrap SSH identity", {
+        step2("unique encrypted bootstrap SSH identity", {
           kind: "ensure-bootstrap-ssh-identity",
           credential: bootstrapSshCredentialPath,
           publicKey: bootstrapSshPublicKeyPath,
@@ -12522,10 +14307,10 @@ function planProvision(options) {
         })
       ] : [],
       ...enrolmentEnabled ? [
-        step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        step2("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
+        step2("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
       ] : [],
-      ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
+      ...deploymentEnabled ? [step2("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },
         { path: `${deployRoot}/releases`, mode: 2040, owner: "root", group: DEPLOYMENT_GROUP },
         { path: `${deployRoot}/cache`, mode: 488, owner: user, group: user },
@@ -12535,13 +14320,13 @@ function planProvision(options) {
         { path: `${deployRoot}/runner-home/cache`, mode: 448, owner: DEPLOYMENT_RUNNER_USER, group: DEPLOYMENT_GROUP },
         { path: `${deployRoot}/app-home`, mode: 448, owner: APPLICATION_RUNTIME_USER, group: VAULT_GROUP }
       ] })] : [],
-      step("reload units", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "daemon-reload"] }] }),
-      ...deploymentEnabled ? [step("remove unsupported deployment socket activation", { kind: "commands", commands: [
+      step2("reload units", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "daemon-reload"] }] }),
+      ...deploymentEnabled ? [step2("remove unsupported deployment socket activation", { kind: "commands", commands: [
         { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-deploy-runner.socket"], acceptedExitCodes: [0, 1, 5] },
         { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
         { argv: ["/usr/bin/systemctl", "daemon-reload"] }
       ] })] : [],
-      step("enable and converge services", { kind: "commands", commands: [
+      step2("enable and converge services", { kind: "commands", commands: [
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         ...restartedUnits.length ? [{ argv: ["/usr/bin/systemctl", "restart", ...restartedUnits] }] : [],
@@ -12549,19 +14334,19 @@ function planProvision(options) {
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
         { argv: ["/usr/bin/systemctl", "restart", "forgezero-agent.service"] }
       ] }),
-      ...enrolmentEnabled ? [step("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
-      ...options.enforceEgress ? [step("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
-      step("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
-      step("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
-      step("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
-      step("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
+      ...enrolmentEnabled ? [step2("prove the compute binding is durable", { kind: "verify-file", path: enrolStatePath })] : [],
+      ...options.enforceEgress ? [step2("prove the Agent egress policy is active", { kind: "verify-egress", runnerPublicTcpPorts, runnerLoopbackPorts })] : [],
+      step2("prove it is running", { kind: "commands", commands: [{ argv: ["/usr/bin/systemctl", "is-active", "forgezero-agent.service"] }] }),
+      step2("prove the public Vault socket exists", { kind: "wait-socket", path: options.socketPath, attempts: 100, intervalMs: 100 }),
+      step2("prove the Agent Vault backend exists", { kind: "wait-socket", path: agentBackendSocketPath(options.socketPath), attempts: 100, intervalMs: 100 }),
+      step2("prove the Agent update helper exists", { kind: "wait-socket", path: DEFAULT_AGENT_UPDATE_SOCKET, attempts: 100, intervalMs: 100 }),
       ...deploymentEnabled ? [
-        step("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
-        step("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
+        step2("prove the deployment runner socket exists", { kind: "wait-socket", path: DEPLOYMENT_RUNNER_SOCKET, attempts: 100, intervalMs: 100 }),
+        step2("prove the software strategy helper socket exists", { kind: "wait-socket", path: DEFAULT_SOFTWARE_HELPER_SOCKET, attempts: 100, intervalMs: 100 })
       ] : [],
-      ...lifecycleEnabled ? [step("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
-      ...warpEnabled ? [step("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
-      ...options.repository ? [step("prove the deployment control socket exists", { kind: "wait-socket", path: options.controlSocketPath ?? "/run/forgezero/control.sock", attempts: 100, intervalMs: 100 })] : []
+      ...lifecycleEnabled ? [step2("prove the lifecycle helper socket exists", { kind: "wait-socket", path: lifecycleHelperSocketPath, attempts: 100, intervalMs: 100 })] : [],
+      ...warpEnabled ? [step2("prove Cloudflare WARP is connected", { kind: "verify-warp" })] : [],
+      ...options.repository ? [step2("prove the deployment control socket exists", { kind: "wait-socket", path: options.controlSocketPath ?? "/run/forgezero/control.sock", attempts: 100, intervalMs: 100 })] : []
     ]
   };
 }
@@ -12571,17 +14356,17 @@ import { randomBytes as randomBytes5 } from "crypto";
 import {
   chmodSync as chmodSync15,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync16,
+  existsSync as existsSync18,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync14,
-  realpathSync as realpathSync5,
-  renameSync as renameSync9,
-  rmSync as rmSync8,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync15,
+  realpathSync as realpathSync6,
+  renameSync as renameSync10,
+  rmSync as rmSync9,
   symlinkSync as symlinkSync5,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname8 } from "path";
+import { dirname as dirname9 } from "path";
 async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -12640,28 +14425,28 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync12(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync12(dirname8(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync13(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync13(dirname9(operation.binary), { recursive: true, mode: 493 });
     copyFileSync3(operation.source, `${release}/dist/fz-agent.js`);
     chmodSync15(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname8(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync16(gitSshSource))
+    const gitSshSource = `${dirname9(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync18(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync3(gitSshSource, `${release}/dist/fz-git-ssh.js`);
     chmodSync15(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync8(pending, { force: true });
+    rmSync9(pending, { force: true });
     symlinkSync5(`versions/${operation.version}`, pending);
-    renameSync9(pending, "/opt/forgezero/agent/current");
-    rmSync8(operation.binary, { force: true });
+    renameSync10(pending, "/opt/forgezero/agent/current");
+    rmSync9(operation.binary, { force: true });
     symlinkSync5("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync8(gitSshBinary, { force: true });
+    rmSync9(gitSshBinary, { force: true });
     symlinkSync5("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync16(operation.credential) && lstatSync3(operation.credential).size > 0)
+    if (existsSync18(operation.credential) && lstatSync3(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
     const seed = randomBytes5(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
@@ -12673,9 +14458,9 @@ var runProvisionOperation = async (operation) => {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync16(operation.credential) || lstatSync3(operation.credential).size < 1) {
-        rmSync8(key, { force: true });
-        rmSync8(publicKey, { force: true });
+      if (!existsSync18(operation.credential) || lstatSync3(operation.credential).size < 1) {
+        rmSync9(key, { force: true });
+        rmSync9(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
@@ -12684,8 +14469,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync15(operation.credential, 256);
       }
-      if (!existsSync16(operation.publicKey) || lstatSync3(operation.publicKey).size < 1) {
-        if (!existsSync16(key)) {
+      if (!existsSync18(operation.publicKey) || lstatSync3(operation.publicKey).size < 1) {
+        if (!existsSync18(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -12693,25 +14478,25 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync12(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync13(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync8(key, { force: true });
-      rmSync8(publicKey, { force: true });
+      rmSync9(key, { force: true });
+      rmSync9(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync16(operation.credential) || lstatSync3(operation.credential).size < 1) {
-        rmSync8(key, { force: true });
-        rmSync8(generatedPublicKey, { force: true });
+      if (!existsSync18(operation.credential) || lstatSync3(operation.credential).size < 1) {
+        rmSync9(key, { force: true });
+        rmSync9(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync16(operation.source) ? lstatSync3(operation.source) : undefined;
+          const source = existsSync18(operation.source) ? lstatSync3(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
@@ -12731,8 +14516,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync15(operation.credential, 256);
       }
-      if (!existsSync16(operation.publicKey) || lstatSync3(operation.publicKey).size < 1) {
-        if (!existsSync16(key)) {
+      if (!existsSync18(operation.publicKey) || lstatSync3(operation.publicKey).size < 1) {
+        if (!existsSync18(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -12742,28 +14527,28 @@ var runProvisionOperation = async (operation) => {
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync12(dirname8(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync12(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync13(dirname9(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync13(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync15(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync8(operation.source, { force: true });
+        rmSync9(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync8(key, { force: true });
-      rmSync8(generatedPublicKey, { force: true });
+      rmSync9(key, { force: true });
+      rmSync9(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync16(operation.state) && lstatSync3(operation.state).size > 0 || existsSync16(operation.credential) && lstatSync3(operation.credential).size > 0)
+    if (existsSync18(operation.state) && lstatSync3(operation.state).size > 0 || existsSync18(operation.credential) && lstatSync3(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync16(operation.source))
+    if (!existsSync18(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
       chmodSync15(operation.credential, 256);
-      rmSync8(operation.source, { force: true });
+      rmSync9(operation.source, { force: true });
     }
     return result;
   }
@@ -12778,7 +14563,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync16(operation.path) && lstatSync3(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync18(operation.path) && lstatSync3(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -12794,31 +14579,31 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "verify-resolved-stub") {
     try {
       const expected = "/run/systemd/resolve/stub-resolv.conf";
-      return realpathSync5("/etc/resolv.conf") === expected && realpathSync5(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+      return realpathSync6("/etc/resolv.conf") === expected && realpathSync6(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
     } catch {
       return { stdout: "resolver stub missing", exitCode: 1 };
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync14("/etc/os-release", "utf8");
+    const os = readFileSync15("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync12("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync12("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync12("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync13("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync13("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync13("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync12(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync13(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync8(key, { force: true });
+    rmSync9(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync12("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync13("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -12849,11 +14634,11 @@ function planInstall(options) {
 }
 async function applyPlan(plan, run2) {
   const transcript = [];
-  for (const step2 of plan.steps) {
-    const result = await run2(step2.operation);
-    transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
-    if (result.exitCode !== 0 && !step2.optional) {
-      throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
+  for (const step3 of plan.steps) {
+    const result = await run2(step3.operation);
+    transcript.push({ label: step3.label, command: step3.command, exitCode: result.exitCode });
+    if (result.exitCode !== 0 && !step3.optional) {
+      throw new Error(`${step3.label} failed (exit ${result.exitCode}): ${step3.command}`);
     }
   }
   return transcript;
@@ -13024,9 +14809,9 @@ async function bootstrapStatus(host = localBootstrapHost()) {
       if (health.exitCode !== 0)
         problems.push("platform API health check failed");
     }
-    const nginx2 = await host.exec(["nginx", "-t"]);
-    services["nginx-config"] = nginx2.exitCode === 0;
-    if (nginx2.exitCode !== 0)
+    const nginx3 = await host.exec(["nginx", "-t"]);
+    services["nginx-config"] = nginx3.exitCode === 0;
+    if (nginx3.exitCode !== 0)
       problems.push("nginx configuration is invalid");
     if (state.databaseRole !== "none") {
       const unitPath = "/etc/systemd/system/forgezero-db.service";
@@ -13071,17 +14856,17 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync17,
-    read: (path2) => readFileSync15(path2, "utf8"),
+    exists: existsSync19,
+    read: (path2) => readFileSync16(path2, "utf8"),
     write(path2, content, mode) {
-      mkdirSync13(dirname9(path2), { recursive: true, mode: 493 });
+      mkdirSync14(dirname10(path2), { recursive: true, mode: 493 });
       const temporary = `${path2}.next.${process.pid}`;
-      writeFileSync13(temporary, content, { mode });
+      writeFileSync14(temporary, content, { mode });
       chmodSync16(temporary, mode);
-      renameSync10(temporary, path2);
+      renameSync11(temporary, path2);
     },
-    mkdir: (path2, mode) => mkdirSync13(path2, { recursive: true, mode }),
-    remove: (path2) => rmSync9(path2, { force: true }),
+    mkdir: (path2, mode) => mkdirSync14(path2, { recursive: true, mode }),
+    remove: (path2) => rmSync10(path2, { force: true }),
     inspect(path2) {
       const value = lstatSync4(path2);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
@@ -13105,7 +14890,7 @@ function localBootstrapHost() {
     async installAgent(config, enrolTokenSourcePath) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync17("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync19("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -13117,8 +14902,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync13(dirname9(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync13(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync14(dirname10(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync14(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -13159,8 +14944,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit3 of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync13(dirname9(unit3.path), { recursive: true, mode: 493 });
-        writeFileSync13(unit3.path, unit3.unit, { mode: 420 });
+        mkdirSync14(dirname10(unit3.path), { recursive: true, mode: 493 });
+        writeFileSync14(unit3.path, unit3.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;
@@ -13194,8 +14979,8 @@ async function verifyPlatformFleetHost(expectedVersion, runtime = localRuntime()
     throw new Error("expected Agent version is invalid");
   if (runtime.uid() !== 0)
     throw new Error("platform-fleet-verify must run as root");
-  if (expectedVersion !== VERSION) {
-    throw new Error(`Agent version ${VERSION} does not match expected ${expectedVersion}`);
+  if (expectedVersion !== VERSION2) {
+    throw new Error(`Agent version ${VERSION2} does not match expected ${expectedVersion}`);
   }
   const status = await runtime.bootstrapStatus();
   if (!status.initialized || status.problems.length > 0) {
@@ -13208,16 +14993,17 @@ async function verifyPlatformFleetHost(expectedVersion, runtime = localRuntime()
     throw new Error("could not inspect failed systemd units");
   if (failed.output.trim())
     throw new Error(`failed systemd units are present: ${failed.output.trim()}`);
-  return { ok: true, agentVersion: VERSION, bootstrap: status, sevGuest: true, failedUnits: [] };
+  return { ok: true, agentVersion: VERSION2, bootstrap: status, sevGuest: true, failedUnits: [] };
 }
 
 // src/community-rehearsal-host.ts
-import { createHash as createHash8 } from "crypto";
-import { lstatSync as lstatSync6, mkdirSync as mkdirSync14, readFileSync as readFileSync16, rmSync as rmSync10, symlinkSync as symlinkSync6, unlinkSync as unlinkSync12, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname10 } from "path";
+import { createHash as createHash10 } from "crypto";
+import { lstatSync as lstatSync6, mkdirSync as mkdirSync15, readFileSync as readFileSync17, rmSync as rmSync11, symlinkSync as symlinkSync6, unlinkSync as unlinkSync12, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname11 } from "path";
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
+var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 var NODES = new Map([
   ["dev-fz-n1", { address: "10.42.0.21", agency: true }],
@@ -13227,11 +15013,11 @@ var NODES = new Map([
 ]);
 var RELEASE = /^[a-f0-9]{64}$/;
 async function ensureCommunityRehearsalArango(execute3 = executeSoftwareOperation) {
-  const requirement = { software: "arangodb", version: COMMUNITY_REHEARSAL_VERSION };
-  if ((await execute3({ kind: "check", ...requirement })).exitCode === 0)
+  const requirement2 = { software: "arangodb", version: COMMUNITY_REHEARSAL_VERSION };
+  if ((await execute3({ kind: "check", ...requirement2 })).exitCode === 0)
     return;
-  const installed = await execute3({ kind: "install", ...requirement });
-  if (installed.exitCode !== 0 || (await execute3({ kind: "check", ...requirement })).exitCode !== 0) {
+  const installed = await execute3({ kind: "install", ...requirement2 });
+  if (installed.exitCode !== 0 || (await execute3({ kind: "check", ...requirement2 })).exitCode !== 0) {
     throw new Error(`unable to install and verify ArangoDB ${COMMUNITY_REHEARSAL_VERSION}`);
   }
 }
@@ -13249,30 +15035,36 @@ var exactNode = (node) => {
   return { name: node, ...expected };
 };
 function parseCommunityRehearsalHostRequest(value) {
-  const row = exactObject(value);
-  const node = exactNode(row.node);
-  const action = row.action;
+  const row2 = exactObject(value);
+  const node = exactNode(row2.node);
+  const action = row2.action;
   if (action === "prepare") {
     const allowed = ["action", "node", "address", "agency", "release", "archivePath", "archiveSha256", "jwt"];
-    if (Object.keys(row).some((key) => !allowed.includes(key)) || row.address !== node.address || row.agency !== node.agency || typeof row.release !== "string" || !RELEASE.test(row.release) || row.archiveSha256 !== row.release || row.archivePath !== `/tmp/forgezero-community-${row.release}.tar.gz` || typeof row.jwt !== "string" || !/^[a-f0-9]{64}$/.test(row.jwt)) {
+    if (Object.keys(row2).some((key) => !allowed.includes(key)) || row2.address !== node.address || row2.agency !== node.agency || typeof row2.release !== "string" || !RELEASE.test(row2.release) || row2.archiveSha256 !== row2.release || row2.archivePath !== `/tmp/forgezero-community-${row2.release}.tar.gz` || typeof row2.jwt !== "string" || !/^[a-f0-9]{64}$/.test(row2.jwt)) {
       throw new Error("community rehearsal prepare request does not match the dedicated fleet contract");
     }
-    return row;
+    return row2;
+  }
+  if (action === "cleanup") {
+    if (Object.keys(row2).some((key) => !["action", "node"].includes(key))) {
+      throw new Error("community rehearsal cleanup has unknown fields");
+    }
+    return { action, node: node.name };
   }
   if (["database-enable", "api-enable", "database-ready", "starter-ready", "api-ready", "database-status", "api-status"].includes(String(action))) {
-    if (Object.keys(row).some((key) => !["action", "node"].includes(key)))
+    if (Object.keys(row2).some((key) => !["action", "node"].includes(key)))
       throw new Error("community rehearsal host action has unknown fields");
     return { action, node: node.name };
   }
   if (action === "api") {
-    if (Object.keys(row).some((key) => !["action", "node", "operation", "key", "value"].includes(key)) || !["health", "init", "write", "read", "query", "cluster"].includes(String(row.operation)) || row.key !== undefined && (typeof row.key !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(row.key)) || row.value !== undefined && (typeof row.value !== "string" || row.value.length > 4096)) {
+    if (Object.keys(row2).some((key) => !["action", "node", "operation", "key", "value"].includes(key)) || !["health", "init", "write", "read", "query", "cluster"].includes(String(row2.operation)) || row2.key !== undefined && (typeof row2.key !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(row2.key)) || row2.value !== undefined && (typeof row2.value !== "string" || row2.value.length > 4096)) {
       throw new Error("community rehearsal API request is invalid");
     }
-    if ((row.operation === "write" || row.operation === "read") && typeof row.key !== "string")
+    if ((row2.operation === "write" || row2.operation === "read") && typeof row2.key !== "string")
       throw new Error("community rehearsal API key is required");
-    if ((row.operation === "write" || row.operation === "query") && typeof row.value !== "string")
+    if ((row2.operation === "write" || row2.operation === "query") && typeof row2.value !== "string")
       throw new Error("community rehearsal API value is required");
-    return row;
+    return row2;
   }
   throw new Error("unsupported community rehearsal host action");
 }
@@ -13374,6 +15166,19 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "unlink", path: request.archivePath }
   ];
 }
+function planCommunityRehearsalCleanup() {
+  return [
+    { kind: "exec", argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-community-api.service"], accepted: [0, 1, 5] },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] },
+    { kind: "unlink", path: "/etc/systemd/system/forgezero-community-api.service" },
+    { kind: "unlink", path: "/etc/systemd/system/forgezero-rehearsal-db.service" },
+    { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
+    { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
+    { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
+  ];
+}
 async function exec(argv2, stdin) {
   const child = Bun.spawn([...argv2], { stdin: stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
   if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -13390,10 +15195,10 @@ async function exec(argv2, stdin) {
 async function applyOperations(operations) {
   for (const operation of operations) {
     if (operation.kind === "remove-tree")
-      rmSync10(operation.path, { recursive: true, force: true });
+      rmSync11(operation.path, { recursive: true, force: true });
     else if (operation.kind === "write") {
-      mkdirSync14(dirname10(operation.path), { recursive: true });
-      writeFileSync14(operation.path, operation.content, { mode: operation.mode });
+      mkdirSync15(dirname11(operation.path), { recursive: true });
+      writeFileSync15(operation.path, operation.content, { mode: operation.mode });
     } else if (operation.kind === "unlink") {
       try {
         unlinkSync12(operation.path);
@@ -13436,9 +15241,13 @@ async function runCommunityRehearsalHost(request) {
   if ((process.getuid?.() ?? -1) !== 0)
     throw new Error("community-rehearsal must run as root");
   const node = exactNode(request.node);
+  if (request.action === "cleanup") {
+    await applyOperations(planCommunityRehearsalCleanup());
+    return { ok: true, action: request.action, node: node.name };
+  }
   if (request.action === "prepare") {
     const metadata = lstatSync6(request.archivePath);
-    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size < 1 || metadata.size > 64 * 1024 * 1024 || createHash8("sha256").update(readFileSync16(request.archivePath)).digest("hex") !== request.archiveSha256) {
+    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size < 1 || metadata.size > 64 * 1024 * 1024 || createHash10("sha256").update(readFileSync17(request.archivePath)).digest("hex") !== request.archiveSha256) {
       throw new Error("community rehearsal archive is not the declared bounded release");
     }
     await ensureCommunityRehearsalArango();
@@ -13486,13 +15295,13 @@ async function runCommunityRehearsalHost(request) {
 }
 
 // src/supervised-app.ts
-import { lstatSync as lstatSync7, readFileSync as readFileSync17 } from "fs";
+import { lstatSync as lstatSync7, readFileSync as readFileSync18 } from "fs";
 function readConfig(path2) {
   const stat = lstatSync7(path2);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== 0 || (stat.mode & 18) !== 0 || stat.size > 128 * 1024) {
     throw new Error("supervised app config is unsafe");
   }
-  const value = JSON.parse(readFileSync17(path2, "utf8"));
+  const value = JSON.parse(readFileSync18(path2, "utf8"));
   if (value.format !== 1 || typeof value.root !== "string" || !value.root.startsWith("/") || typeof value.release !== "string" || !value.release.startsWith(`${value.root}/releases/`) || typeof value.home !== "string" || value.home !== `${value.root}/app-home` || !Array.isArray(value.argv) || value.argv.length < 1 || value.argv.length > 256 || value.argv.some((argument) => typeof argument !== "string" || !argument || argument.includes("\x00")) || !value.environment || typeof value.environment !== "object" || Array.isArray(value.environment) || Object.entries(value.environment).some(([name, item]) => !/^FZ_(?:APP_PORT|RELEASE)$/.test(name) || typeof item !== "string" || /[\r\n\0]/.test(item))) {
     throw new Error("supervised app config is malformed");
   }
@@ -13538,16 +15347,16 @@ function agentCommandArgs(args, command2) {
   return args.slice(index + 1);
 }
 function loadOrCreateSeed(path2) {
-  if (existsSync18(path2)) {
-    const seed2 = new Uint8Array(Buffer.from(readFileSync18(path2, "utf8").trim(), "base64url"));
+  if (existsSync20(path2)) {
+    const seed2 = new Uint8Array(Buffer.from(readFileSync19(path2, "utf8").trim(), "base64url"));
     if (seed2.length < 32) {
       throw new Error(`agent: the seed at ${path2} is too short to derive a key from.`);
     }
     return seed2;
   }
-  mkdirSync15(dirname11(path2), { recursive: true });
+  mkdirSync16(dirname12(path2), { recursive: true });
   const seed = new Uint8Array(randomBytes6(32));
-  writeFileSync15(path2, Buffer.from(seed).toString("base64url"), { mode: 384 });
+  writeFileSync16(path2, Buffer.from(seed).toString("base64url"), { mode: 384 });
   chmodSync17(path2, 384);
   return seed;
 }
@@ -13577,9 +15386,9 @@ function loadSeedCredential(name = DEFAULT_SEED_CREDENTIAL, directory = process.
   if (!directory)
     throw new Error("agent: CREDENTIALS_DIRECTORY is missing; systemd did not load the node identity.");
   const path2 = `${directory}/${name}`;
-  if (!existsSync18(path2))
+  if (!existsSync20(path2))
     throw new Error(`agent: the systemd credential ${name} is missing at ${path2}.`);
-  const seed = new Uint8Array(Buffer.from(readFileSync18(path2, "utf8").trim(), "base64url"));
+  const seed = new Uint8Array(Buffer.from(readFileSync19(path2, "utf8").trim(), "base64url"));
   if (seed.length < 32)
     throw new Error(`agent: the systemd credential ${name} is too short to derive a key from.`);
   return seed;
@@ -13589,7 +15398,7 @@ function loadTextCredential(name, directory = process.env.CREDENTIALS_DIRECTORY)
     throw new Error("agent: CREDENTIALS_DIRECTORY is missing; systemd did not load the credential.");
   if (!/^[A-Za-z0-9_.-]+$/.test(name))
     throw new Error("agent: invalid systemd credential name.");
-  const value = readFileSync18(`${directory}/${name}`, "utf8").trim();
+  const value = readFileSync19(`${directory}/${name}`, "utf8").trim();
   if (!value)
     throw new Error(`agent: systemd credential ${name} is empty.`);
   return value;
@@ -13669,7 +15478,7 @@ if (import.meta.main) {
   const args = process.argv.slice(2);
   if (args.includes("--help") || args.includes("-h")) {
     console.log([
-      `fz-agent ${VERSION}`,
+      `fz-agent ${VERSION2}`,
       "",
       "Runs inside managed compute and answers secret requests over a local socket.",
       "It holds no configuration of its own \u2014 everything comes from the",
@@ -13702,7 +15511,7 @@ if (import.meta.main) {
     process.exit(0);
   }
   if (args.includes("--version") || args.includes("-v")) {
-    console.log(VERSION);
+    console.log(VERSION2);
     process.exit(0);
   }
   const command2 = args.find((arg) => !arg.startsWith("-"));
@@ -13714,7 +15523,7 @@ if (import.meta.main) {
     if (configPath !== "/etc/forgezero/deploy-activation.json" || !release) {
       throw new Error("platform-activate requires the fixed config and one absolute release path");
     }
-    const config = JSON.parse(readFileSync18(configPath, "utf8"));
+    const config = JSON.parse(readFileSync19(configPath, "utf8"));
     const result = await activatePlatformRelease(config, release);
     console.log(`promoted ${result.release} on ${result.slot}`);
     process.exit(0);
@@ -13745,7 +15554,7 @@ if (import.meta.main) {
       }
     }
     for (const relative of ["package.json", "bun.lock"]) {
-      const contents = readFileSync18(join12(process.cwd(), relative), "utf8");
+      const contents = readFileSync19(join12(process.cwd(), relative), "utf8");
       if (/(?:workspace|file):/.test(contents)) {
         throw new Error(`project release ${relative} contains a local dependency`);
       }
@@ -13790,8 +15599,8 @@ if (import.meta.main) {
       keys: keys2,
       label: process.env.FZ_NODE_LABEL,
       edgeHostname: process.env.FZ_NODE_HOSTNAME,
-      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync18(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
-      bootstrapSshPublicKey: process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE ? readFileSync18(process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
+      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync19(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
+      bootstrapSshPublicKey: process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE ? readFileSync19(process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
       privateNetworkAttachment: privateNetworkAttachmentFromEnvironment()
     });
     console.log(`[agent] enrolled ${binding2.computeReference} in project ${binding2.projectKey}/${binding2.environmentKey}`);
@@ -13833,7 +15642,7 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-helper requires --profile=/absolute/path.json");
-    const profile2 = JSON.parse(readFileSync18(profilePath, "utf8"));
+    const profile2 = JSON.parse(readFileSync19(profilePath, "utf8"));
     const helper = startMetalHelper({
       profile: profile2,
       socketPath: process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET
@@ -13928,7 +15737,7 @@ if (import.meta.main) {
       if (stopping)
         return;
       stopping = true;
-      await new Promise((resolve5) => helper.close(() => resolve5()));
+      await new Promise((resolve6) => helper.close(() => resolve6()));
       process.exit(0);
     };
     process.on("SIGTERM", () => void stop());
@@ -13950,7 +15759,7 @@ if (import.meta.main) {
       if (stopping)
         return;
       stopping = true;
-      await new Promise((resolve5) => helper.close(() => resolve5()));
+      await new Promise((resolve6) => helper.close(() => resolve6()));
       process.exit(0);
     };
     process.on("SIGTERM", () => void stop());
@@ -13983,7 +15792,7 @@ if (import.meta.main) {
     const profilePath = args.find((arg) => arg.startsWith("--profile="))?.slice("--profile=".length);
     if (!profilePath)
       throw new Error("metal-isolation requires --profile=/absolute/path.json");
-    const profile2 = JSON.parse(readFileSync18(profilePath, "utf8"));
+    const profile2 = JSON.parse(readFileSync19(profilePath, "utf8"));
     await applyMetalIsolation(profile2);
     console.log("[metal-isolation] host and guest cgroup boundaries active");
     process.exit(0);
@@ -14028,7 +15837,7 @@ if (import.meta.main) {
     if (claimArg !== "-" && !claimArg.startsWith("/")) {
       throw new Error("metal-apply claim path must be absolute");
     }
-    const raw = readFileSync18(claimArg === "-" ? "/dev/stdin" : claimArg, "utf8");
+    const raw = readFileSync19(claimArg === "-" ? "/dev/stdin" : claimArg, "utf8");
     if (Buffer.byteLength(raw) > 32 * 1024)
       throw new Error("metal-apply claim exceeds 32 KiB");
     const claim = JSON.parse(raw);
@@ -14053,7 +15862,7 @@ if (import.meta.main) {
     if (commandArgs.length !== 1 || commandArgs[0] !== "--request=-") {
       throw new Error("community-rehearsal requires exactly --request=-");
     }
-    const raw = readFileSync18("/dev/stdin", "utf8");
+    const raw = readFileSync19("/dev/stdin", "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024)
       throw new Error("community rehearsal request exceeds 128 KiB");
     const request = parseCommunityRehearsalHostRequest(JSON.parse(raw));
@@ -14064,7 +15873,7 @@ if (import.meta.main) {
     if (args.length !== 1 || args[0] !== "--request=-") {
       throw new Error("metal-admission-proof requires exactly --request=-");
     }
-    const raw = readFileSync18("/dev/stdin", "utf8");
+    const raw = readFileSync19("/dev/stdin", "utf8");
     if (Buffer.byteLength(raw) > 32 * 1024)
       throw new Error("metal admission proof request exceeds 32 KiB");
     const request = JSON.parse(raw);
@@ -14074,7 +15883,7 @@ if (import.meta.main) {
     const seed = configuredAgentSeed({ credential: process.env.FZ_SEED_CREDENTIAL, allowFileSeed: false });
     const keys2 = deriveKeysFromSeed(seed);
     seed.fill(0);
-    const filesystem = statfsSync("/var/lib/forgezero");
+    const filesystem = statfsSync2("/var/lib/forgezero");
     const body = {
       ...request,
       publicKeys: { ed25519: keys2.ed25519.publicKey, mlDsa: keys2.mlDsa.publicKey },
@@ -14082,9 +15891,9 @@ if (import.meta.main) {
         vcpu: cpus().length,
         memoryGib: Math.max(1, Math.floor(totalmem() / 1024 ** 3)),
         diskGib: Math.max(1, Math.floor(Number(filesystem.blocks) * Number(filesystem.bsize) / 1024 ** 3)),
-        kvm: existsSync18("/dev/kvm"),
-        snpHost: existsSync18("/dev/sev"),
-        helper: existsSync18(process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET)
+        kvm: existsSync20("/dev/kvm"),
+        snpHost: existsSync20("/dev/sev"),
+        helper: existsSync20(process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET)
       }
     };
     const envelope = signRequest(keys2, keys2.ed25519.publicKey, {
@@ -14119,9 +15928,9 @@ if (import.meta.main) {
       metalHostname: process.env.FZ_METAL_HOSTNAME,
       run: (claim) => requestMetalProvision(claim, process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET),
       metalPreflight: () => ({
-        snpHost: existsSync18("/dev/sev"),
-        kvm: existsSync18("/dev/kvm"),
-        helper: existsSync18(process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET)
+        snpHost: existsSync20("/dev/sev"),
+        kvm: existsSync20("/dev/kvm"),
+        helper: existsSync20(process.env.FZ_METAL_HELPER_SOCKET ?? DEFAULT_METAL_HELPER_SOCKET)
       }),
       onEvent: (event, detail) => console.log(`[metal-agent] ${event}${detail ? ` ${JSON.stringify(detail)}` : ""}`)
     });
@@ -14204,7 +16013,7 @@ if (import.meta.main) {
   const telemetry = new AgentTelemetryRuntime(createAgentTelemetry(resolveAgentTelemetryConfig()));
   telemetry.event("agent.started");
   telemetry.setDraining(false);
-  const attestationSource = existsSync18("/dev/sev-guest") ? createSnpAttestationSource() : undefined;
+  const attestationSource = existsSync20("/dev/sev-guest") ? createSnpAttestationSource() : undefined;
   const running = runAgent({
     socketPath: process.env.FZ_SOCKET_PATH ?? DEFAULT_SOCKET_PATH,
     seedCredential: process.env.FZ_SEED_CREDENTIAL,
@@ -14215,12 +16024,12 @@ if (import.meta.main) {
     record: (entry) => console.log(`[agent] ${entry.op} ${entry.outcome}${entry.detail ? ` ${entry.detail}` : ""}`)
   });
   const { nodeKey, keys, server } = running;
-  console.log(`[agent] ${VERSION} signing as ${nodeKey}`);
+  console.log(`[agent] ${VERSION2} signing as ${nodeKey}`);
   const enrolmentStatePath = process.env.FZ_ENROL_STATE_FILE ?? DEFAULT_ENROLMENT_STATE_PATH;
   let binding = loadGuestBinding(enrolmentStatePath, nodeKey);
   const enrolmentCredential = process.env.FZ_ENROL_TOKEN_CREDENTIAL;
-  const enrolmentCredentialAvailable = Boolean(enrolmentCredential && process.env.CREDENTIALS_DIRECTORY && existsSync18(`${process.env.CREDENTIALS_DIRECTORY}/${enrolmentCredential}`));
-  const legacyEnrolmentFileAvailable = Boolean(process.env.FZ_ENROL_TOKEN_FILE && existsSync18(process.env.FZ_ENROL_TOKEN_FILE));
+  const enrolmentCredentialAvailable = Boolean(enrolmentCredential && process.env.CREDENTIALS_DIRECTORY && existsSync20(`${process.env.CREDENTIALS_DIRECTORY}/${enrolmentCredential}`));
+  const legacyEnrolmentFileAvailable = Boolean(process.env.FZ_ENROL_TOKEN_FILE && existsSync20(process.env.FZ_ENROL_TOKEN_FILE));
   if (!binding && (enrolmentCredentialAvailable || legacyEnrolmentFileAvailable) && process.env.FZ_API) {
     binding = await enrolGuestIdentity({
       apiUrl: process.env.FZ_API,
@@ -14231,8 +16040,8 @@ if (import.meta.main) {
       keys,
       label: process.env.FZ_NODE_LABEL,
       edgeHostname: process.env.FZ_NODE_HOSTNAME,
-      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync18(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
-      bootstrapSshPublicKey: process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE ? readFileSync18(process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
+      gitDeployPublicKey: process.env.FZ_GIT_PUBLIC_KEY_FILE ? readFileSync19(process.env.FZ_GIT_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
+      bootstrapSshPublicKey: process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE ? readFileSync19(process.env.FZ_BOOTSTRAP_SSH_PUBLIC_KEY_FILE, "utf8").trim() : undefined,
       privateNetworkAttachment: privateNetworkAttachmentFromEnvironment()
     });
     console.log(`[agent] enrolled ${binding.computeReference} in project ${binding.projectKey}/${binding.environmentKey}`);
@@ -14298,7 +16107,7 @@ if (import.meta.main) {
   const bootstrapEnabled = process.env.FZ_BOOTSTRAP_PULL === "true";
   const bootstrapCredential = process.env.FZ_BOOTSTRAP_SSH_KEY_CREDENTIAL;
   const bootstrapKeyPath = bootstrapCredential && process.env.CREDENTIALS_DIRECTORY ? `${process.env.CREDENTIALS_DIRECTORY}/${bootstrapCredential}` : undefined;
-  if (bootstrapEnabled && (!binding || !nodeApiUrl || !process.env.FZ_API || !bootstrapKeyPath || !existsSync18(bootstrapKeyPath) || !process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT)) {
+  if (bootstrapEnabled && (!binding || !nodeApiUrl || !process.env.FZ_API || !bootstrapKeyPath || !existsSync20(bootstrapKeyPath) || !process.env.FZ_BOOTSTRAP_TARGET_OTLP_ENDPOINT)) {
     throw new Error("agent: bootstrap runner requires enrolment, API, local SSH credential and target OTLP coordinate");
   }
   const bootstrapPull = bootstrapEnabled ? startSshBootstrapPull({
@@ -14363,6 +16172,8 @@ if (import.meta.main) {
       capacityEvidenceDirectory: process.env.FZ_CAPACITY_EVIDENCE_DIR ?? join12(root, "cache", "capacity"),
       ensureSoftware: (requirements) => requestSoftware(requirements, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
       activateService: (request) => requestServiceActivation(request, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
+      buildContainer: (request) => requestContainerBuild(request, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
+      activateContainer: (request) => requestContainerActivation(request, process.env.FZ_SOFTWARE_HELPER_SOCKET ?? DEFAULT_SOFTWARE_HELPER_SOCKET),
       projectExec: process.env.FZ_DEPLOY_RUNNER_SOCKET ? (input) => requestDeploymentCommand(input, process.env.FZ_DEPLOY_RUNNER_SOCKET) : undefined
     });
     const staticManager = repository && branch && profile ? createDeploymentManager(managerOptions({ repository, branch, profile }, process.env.FZ_DEPLOY_KEY ?? `${repository}:${branch}:${profile}`)) : undefined;
@@ -14454,7 +16265,7 @@ if (import.meta.main) {
       const deadlineMs = Math.max(1, Number(process.env.FZ_DRAIN_DEADLINE_MS ?? 30000));
       const deadline = Date.now() + deadlineMs;
       const remaining = () => Math.max(1, deadline - Date.now());
-      const controlClosed = control ? await settleWithin(new Promise((resolve5) => control.close(() => resolve5())), remaining()) : true;
+      const controlClosed = control ? await settleWithin(new Promise((resolve6) => control.close(() => resolve6())), remaining()) : true;
       const pullDrain = pull?.stop() ?? Promise.resolve();
       const vaultDrain = vaultSync?.stop() ?? Promise.resolve();
       const attestationDrain = attestationLoop?.stop() ?? Promise.resolve();
@@ -14639,7 +16450,7 @@ export {
   allocateAddress,
   agentCommandArgs,
   activateAgentRelease,
-  VERSION,
+  VERSION2 as VERSION,
   SYSTEMD_RESOLVED_STUB,
   SYSTEMD_RESOLVED_ADDRESS,
   SUPPORTED_GUEST_IMAGE,