@forgezero/agent 0.1.55 → 0.1.57

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.55";
+var VERSION3 = "0.1.57";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.55";
+var VERSION = "0.1.57";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,4 +1,11 @@
-import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokenFiles } from '../cloudflare-bootstrap';
+export interface CloudflareBootstrapCommandConfig {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-request';
+    checkpointPath: string;
+    coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
+    tokenFiles: CloudflareBootstrapTokenFiles;
+}
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
@@ -9,6 +16,15 @@ export interface CloudflareBootstrapFinalizeConfig {
     checkpointPath: string;
     acceptancePath: string;
 }
+/**
+ * Construct the exact reviewed JSON shape used by both the interactive CLI and
+ * the strict file reader. Token values are deliberately not accepted here.
+ */
+export declare function createCloudflareBootstrapCommandConfig(input: {
+    checkpointPath: string;
+    coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
+    tokenFiles: CloudflareBootstrapTokenFiles;
+}): CloudflareBootstrapCommandConfig;
 /**
  * Read reviewed non-secret coordinates and token-file paths for the attended
  * operator phase. Raw token values and a persisted mode are not schema fields.

package/dist/community-rehearsal-host.d.ts

@@ -2,6 +2,7 @@ import { type SoftwareExec } from './software';
 export declare const COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 export declare const COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 export declare const COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
+export declare const COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 export declare const COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 export type CommunityRehearsalApiOperation = 'health' | 'init' | 'write' | 'read' | 'query' | 'cluster';
 export type CommunityRehearsalHostRequest = {
@@ -13,6 +14,9 @@ export type CommunityRehearsalHostRequest = {
     archivePath: string;
     archiveSha256: string;
     jwt: string;
+} | {
+    action: 'cleanup';
+    node: string;
 } | {
     action: 'database-enable' | 'api-enable' | 'database-ready' | 'starter-ready' | 'api-ready' | 'database-status' | 'api-status';
     node: string;
@@ -25,7 +29,7 @@ export type CommunityRehearsalHostRequest = {
 };
 export type CommunityHostOperation = {
     kind: 'remove-tree';
-    path: typeof COMMUNITY_DATABASE_ROOT;
+    path: typeof COMMUNITY_DATABASE_ROOT | typeof COMMUNITY_REHEARSAL_ROOT | typeof COMMUNITY_CREDENTIAL_PARENT;
 } | {
     kind: 'write';
     path: string;
@@ -49,5 +53,7 @@ export declare function parseCommunityRehearsalHostRequest(value: unknown): Comm
 export declare function planCommunityRehearsalPrepare(request: Extract<CommunityRehearsalHostRequest, {
     action: 'prepare';
 }>): CommunityHostOperation[];
+/** Remove only the dedicated rehearsal units, credentials, release and data. */
+export declare function planCommunityRehearsalCleanup(): CommunityHostOperation[];
 /** Execute only the dedicated four-node rehearsal operation selected by a typed request. */
 export declare function runCommunityRehearsalHost(request: CommunityRehearsalHostRequest): Promise<Record<string, unknown>>;

package/dist/community-rehearsal-host.js

@@ -285,6 +285,7 @@ import { dirname } from "node:path";
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
+var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 var NODES = new Map([
   ["dev-fz-n1", { address: "10.42.0.21", agency: true }],
@@ -326,6 +327,12 @@ function parseCommunityRehearsalHostRequest(value) {
     }
     return row;
   }
+  if (action === "cleanup") {
+    if (Object.keys(row).some((key) => !["action", "node"].includes(key))) {
+      throw new Error("community rehearsal cleanup has unknown fields");
+    }
+    return { action, node: node.name };
+  }
   if (["database-enable", "api-enable", "database-ready", "starter-ready", "api-ready", "database-status", "api-status"].includes(String(action))) {
     if (Object.keys(row).some((key) => !["action", "node"].includes(key)))
       throw new Error("community rehearsal host action has unknown fields");
@@ -441,6 +448,19 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "unlink", path: request.archivePath }
   ];
 }
+function planCommunityRehearsalCleanup() {
+  return [
+    { kind: "exec", argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-community-api.service"], accepted: [0, 1, 5] },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] },
+    { kind: "unlink", path: "/etc/systemd/system/forgezero-community-api.service" },
+    { kind: "unlink", path: "/etc/systemd/system/forgezero-rehearsal-db.service" },
+    { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
+    { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
+    { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
+  ];
+}
 async function exec(argv, stdin) {
   const child = Bun.spawn([...argv], { stdin: stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
   if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -503,6 +523,10 @@ async function runCommunityRehearsalHost(request) {
   if ((process.getuid?.() ?? -1) !== 0)
     throw new Error("community-rehearsal must run as root");
   const node = exactNode(request.node);
+  if (request.action === "cleanup") {
+    await applyOperations(planCommunityRehearsalCleanup());
+    return { ok: true, action: request.action, node: node.name };
+  }
   if (request.action === "prepare") {
     const metadata = lstatSync(request.archivePath);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size < 1 || metadata.size > 64 * 1024 * 1024 || createHash2("sha256").update(readFileSync2(request.archivePath)).digest("hex") !== request.archiveSha256) {
@@ -554,10 +578,12 @@ async function runCommunityRehearsalHost(request) {
 export {
   runCommunityRehearsalHost,
   planCommunityRehearsalPrepare,
+  planCommunityRehearsalCleanup,
   parseCommunityRehearsalHostRequest,
   ensureCommunityRehearsalArango,
   COMMUNITY_REHEARSAL_VERSION,
   COMMUNITY_REHEARSAL_ROOT,
   COMMUNITY_DATABASE_ROOT,
-  COMMUNITY_CREDENTIAL_ROOT
+  COMMUNITY_CREDENTIAL_ROOT,
+  COMMUNITY_CREDENTIAL_PARENT
 };

package/dist/fz-agent.js

@@ -8448,7 +8448,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.55";
+var VERSION2 = "0.1.57";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -15003,6 +15003,7 @@ import { dirname as dirname11 } from "path";
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
+var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
 var NODES = new Map([
   ["dev-fz-n1", { address: "10.42.0.21", agency: true }],
@@ -15044,6 +15045,12 @@ function parseCommunityRehearsalHostRequest(value) {
     }
     return row2;
   }
+  if (action === "cleanup") {
+    if (Object.keys(row2).some((key) => !["action", "node"].includes(key))) {
+      throw new Error("community rehearsal cleanup has unknown fields");
+    }
+    return { action, node: node.name };
+  }
   if (["database-enable", "api-enable", "database-ready", "starter-ready", "api-ready", "database-status", "api-status"].includes(String(action))) {
     if (Object.keys(row2).some((key) => !["action", "node"].includes(key)))
       throw new Error("community rehearsal host action has unknown fields");
@@ -15159,6 +15166,19 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "unlink", path: request.archivePath }
   ];
 }
+function planCommunityRehearsalCleanup() {
+  return [
+    { kind: "exec", argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-community-api.service"], accepted: [0, 1, 5] },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] },
+    { kind: "unlink", path: "/etc/systemd/system/forgezero-community-api.service" },
+    { kind: "unlink", path: "/etc/systemd/system/forgezero-rehearsal-db.service" },
+    { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
+    { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
+    { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
+    { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
+  ];
+}
 async function exec(argv2, stdin) {
   const child = Bun.spawn([...argv2], { stdin: stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
   if (stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
@@ -15221,6 +15241,10 @@ async function runCommunityRehearsalHost(request) {
   if ((process.getuid?.() ?? -1) !== 0)
     throw new Error("community-rehearsal must run as root");
   const node = exactNode(request.node);
+  if (request.action === "cleanup") {
+    await applyOperations(planCommunityRehearsalCleanup());
+    return { ok: true, action: request.action, node: node.name };
+  }
   if (request.action === "prepare") {
     const metadata = lstatSync6(request.archivePath);
     if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size < 1 || metadata.size > 64 * 1024 * 1024 || createHash10("sha256").update(readFileSync17(request.archivePath)).digest("hex") !== request.archiveSha256) {

package/dist/fz.js

@@ -4830,7 +4830,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.55";
+var VERSION2 = "0.1.57";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -14347,6 +14347,26 @@ var record2 = (value, label) => {
     throw new Error(`${label} must be an object`);
   return value;
 };
+function createCloudflareBootstrapCommandConfig(input) {
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  for (const key of ["tunnelTokenFile", "apiTokenFile"]) {
+    if (typeof input.tokenFiles?.[key] !== "string" || !input.tokenFiles[key].trim()) {
+      throw new Error(`Cloudflare bootstrap tokenFiles.${key} is required and must be a non-empty file path`);
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-request",
+    checkpointPath: input.checkpointPath.trim(),
+    coordinates: validateCloudflareBootstrapCoordinates(input.coordinates),
+    tokenFiles: {
+      tunnelTokenFile: input.tokenFiles.tunnelTokenFile.trim(),
+      apiTokenFile: input.tokenFiles.apiTokenFile.trim()
+    }
+  };
+}
 function readOwnerConfig(path) {
   const absolute2 = resolve6(path);
   let descriptor;
@@ -15413,6 +15433,12 @@ var PLATFORM_GENESIS_FLEETS = {
     ...developmentShape
   }))
 };
+var DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST = {
+  name: "dev-fz-n4",
+  address: "10.42.0.24",
+  cpuPoolKey: "node7",
+  ...developmentShape
+};
 var publicKey = (value) => {
   const normalized = value.trim();
   if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
@@ -15451,6 +15477,36 @@ function platformGenesisClaims(environment, sshPublicKeys) {
     }
   }));
 }
+function platformCommunityRehearsalClaims(sshPublicKeys) {
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  const seed = platformGenesisClaims("development", keys);
+  const guest = DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST;
+  return [...seed, {
+    computeKey: `platform:${guest.name}`,
+    claimToken: "offline-platform-genesis",
+    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
+    attempt: 1,
+    action: "create",
+    bootstrap: { kind: "platform-genesis" },
+    access: { sshUser: "forgezero", sshPublicKeys: keys },
+    spec: {
+      reference: `platform:${guest.name}`,
+      imageKey: SUPPORTED_GUEST_IMAGE.key,
+      guestName: guest.name,
+      guestAddress: guest.address,
+      cpuPoolKey: guest.cpuPoolKey,
+      physicalCores: guest.physicalCores,
+      vcpu: guest.vcpu,
+      memoryGib: guest.memoryGib,
+      diskGib: guest.diskGib,
+      egressGuaranteedMbps: guest.egressGuaranteedMbps,
+      egressBurstMbps: guest.egressBurstMbps,
+      confidential: true
+    }
+  }];
+}
 
 // src/operator-bootstrap.ts
 var REQUEST_LIMIT = 64 * 1024;
@@ -15604,13 +15660,17 @@ function readOperatorMetalBootstrapRequest(path) {
 }
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
-  const claims = platformGenesisClaims(request.genesis.environment, request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path)));
+  if (mode === "rehearsal" && request.genesis.environment !== "development") {
+    throw new Error("the disposable four-node Community rehearsal is development-only");
+  }
+  const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
+  const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
   return {
     kind: "metal-remote",
     mode,
     mutation: mode !== "status",
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" ? ["verify pinned SSH transport", "send three fixed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -15905,10 +15965,11 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
-    if (mode === "genesis") {
+    if (mode === "genesis" || mode === "rehearsal") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       const outputs = [];
-      for (const claim of platformGenesisClaims(request.genesis.environment, keys)) {
+      const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+      for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
       }
@@ -17077,6 +17138,55 @@ function writeBootstrapConfig(path, config) {
 `, { mode: 384, flag: "wx" });
   return path;
 }
+function interactiveCloudflareBootstrap() {
+  if (!process.stdin.isTTY)
+    throw new Error("interactive Cloudflare config generation requires a terminal");
+  const nodeCount = bootstrapNumber("Number of public API nodes", "3");
+  if (nodeCount < 1 || nodeCount > 32)
+    throw new Error("Number of public API nodes must be between 1 and 32");
+  const realtimeEnabled = bootstrapAnswer("Configure existing Worker realtime fan-out? (yes/no)", "yes") === "yes";
+  const meshEnabled = bootstrapAnswer("Configure private Mesh/WARP routes? (yes/no)", "no") === "yes";
+  const meshDevicePolicyId = meshEnabled ? bootstrapAnswer("Existing Mesh device policy id") : undefined;
+  const nodes = Array.from({ length: nodeCount }, (_, index) => {
+    const ordinal = index + 1;
+    const nodeName = bootstrapAnswer(`Node ${ordinal} inventory name`);
+    const nodeMesh = meshEnabled && bootstrapAnswer(`Configure Mesh routes for ${nodeName}? (yes/no)`, "yes") === "yes";
+    return {
+      nodeName,
+      hostname: bootstrapAnswer(`${nodeName} public hostname`),
+      service: bootstrapAnswer(`${nodeName} loopback API service`, "http://127.0.0.1:3000"),
+      tunnelName: bootstrapAnswer(`${nodeName} Tunnel name`, nodeName),
+      ...nodeMesh ? {
+        mesh: {
+          connectorName: bootstrapAnswer(`${nodeName} Mesh connector name`, `${nodeName}-mesh`),
+          routes: bootstrapList(`${nodeName} private CIDR routes`),
+          highAvailability: bootstrapAnswer(`${nodeName} shares a highly available Mesh connector? (yes/no)`, "no") === "yes"
+        }
+      } : {}
+    };
+  });
+  return createCloudflareBootstrapCommandConfig({
+    checkpointPath: bootstrapAnswer("Owner-only resumable checkpoint path", "./cloudflare-handoff.json"),
+    coordinates: {
+      accountId: bootstrapAnswer("Cloudflare account id"),
+      zoneId: bootstrapAnswer("Cloudflare zone id"),
+      kvNamespaceId: bootstrapAnswer("Existing Worker-bound KV namespace id"),
+      ...meshDevicePolicyId ? { meshDevicePolicyId } : {},
+      ...realtimeEnabled ? {
+        realtime: {
+          workerScriptName: bootstrapAnswer("Existing Worker script name"),
+          endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
+          producer: bootstrapAnswer("Realtime producer identity", "platform-api")
+        }
+      } : {},
+      nodes
+    },
+    tokenFiles: {
+      tunnelTokenFile: bootstrapAnswer("Owner-only CF_TUNNEL_TOKEN file", "./CF_TUNNEL_TOKEN"),
+      apiTokenFile: bootstrapAnswer("Owner-only CF_API_TOKEN file", "./CF_API_TOKEN")
+    }
+  });
+}
 function genesisOutputDirectory(path) {
   if (!isAbsolute5(path) || resolve9(path) !== path)
     throw new Error("--output must be a canonical absolute directory");
@@ -17249,13 +17359,19 @@ async function cmdBootstrap(options, args) {
     const operation = args[0] ?? "status";
     if (operation === "config") {
       const kind = args[1];
-      if (kind !== "metal" && kind !== "platform" || args[2] !== undefined || !options.outputPath) {
-        throw new Error("Usage: fz bootstrap config metal --output <absolute-file> | fz bootstrap config platform --output <absolute-owner-only-directory>");
+      if (kind !== "metal" && kind !== "platform" && kind !== "cloudflare" || args[2] !== undefined || !options.outputPath) {
+        throw new Error("Usage: fz bootstrap config metal|cloudflare --output <absolute-file> | fz bootstrap config platform --output <absolute-owner-only-directory>");
       }
       if (kind === "platform") {
         out.line(JSON.stringify({ kind, ...writePlatformGenesisFleet(options.outputPath), mode: "0600" }, null, 2));
         return 0;
       }
+      if (kind === "cloudflare") {
+        const path = writeBootstrapConfig(options.outputPath, interactiveCloudflareBootstrap());
+        readCloudflareBootstrapCommandConfig(path, "plan");
+        out.line(JSON.stringify({ kind, path, mode: "0600" }, null, 2));
+        return 0;
+      }
       const config2 = interactiveMetalBootstrap();
       out.line(JSON.stringify({ kind, path: writeBootstrapConfig(options.outputPath, config2), mode: "0600" }, null, 2));
       return 0;
@@ -17279,8 +17395,8 @@ async function cmdBootstrap(options, args) {
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "genesis", "rehearsal", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|status> --bootstrap-config <owner-only-request.json> [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
@@ -17391,7 +17507,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -17956,9 +18072,9 @@ function usage() {
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host and caller-approved SSH agent
 	 fz bootstrap platform   Install/repair a typed elastic platform compute
-	 fz bootstrap config <metal|platform>
-	                         Write a validated owner-only metal file or strict
-	                         three-node platform genesis directory; never apply locally
+	 fz bootstrap config <metal|platform|cloudflare>
+	                         Write a validated owner-only metal/Cloudflare file or
+	                         strict three-node platform genesis directory; never apply locally
 	 fz bootstrap platform cloudflare
 	                         Plan/apply attended Tunnel and DNS reconciliation
 	                         using supplied management and KV/Worker runtime token files
@@ -17969,7 +18085,7 @@ function usage() {
 	                         Persist secret-free public-node acceptance, then remove
 	                         the capability-bearing checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|status>
+	 fz bootstrap metal remote <apply|genesis|rehearsal|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units

package/dist/metal-bootstrap.js

@@ -292,7 +292,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.55";
+var VERSION = "0.1.57";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -25,7 +25,7 @@ export interface OperatorMetalBootstrapRequest {
     };
 }
 export type OperatorPlatformBootstrapMode = 'prepare' | 'apply' | 'status';
-export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'status';
+export type OperatorMetalBootstrapMode = 'apply' | 'genesis' | 'rehearsal' | 'status';
 export interface OperatorPlatformBootstrapPlan {
     kind: 'platform-remote';
     mode: OperatorPlatformBootstrapMode;

package/dist/operator-bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.55";
+var VERSION = "0.1.57";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5273,6 +5273,12 @@ var PLATFORM_GENESIS_FLEETS = {
     ...developmentShape
   }))
 };
+var DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST = {
+  name: "dev-fz-n4",
+  address: "10.42.0.24",
+  cpuPoolKey: "node7",
+  ...developmentShape
+};
 var publicKey = (value) => {
   const normalized = value.trim();
   if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(normalized)) {
@@ -5311,6 +5317,36 @@ function platformGenesisClaims(environment, sshPublicKeys) {
     }
   }));
 }
+function platformCommunityRehearsalClaims(sshPublicKeys) {
+  const keys = [...new Set(sshPublicKeys.map(publicKey))];
+  if (keys.length === 0)
+    throw new Error("platform genesis requires at least one operator SSH public key");
+  const seed = platformGenesisClaims("development", keys);
+  const guest = DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST;
+  return [...seed, {
+    computeKey: `platform:${guest.name}`,
+    claimToken: "offline-platform-genesis",
+    claimExpiresAtTs: Number.MAX_SAFE_INTEGER,
+    attempt: 1,
+    action: "create",
+    bootstrap: { kind: "platform-genesis" },
+    access: { sshUser: "forgezero", sshPublicKeys: keys },
+    spec: {
+      reference: `platform:${guest.name}`,
+      imageKey: SUPPORTED_GUEST_IMAGE.key,
+      guestName: guest.name,
+      guestAddress: guest.address,
+      cpuPoolKey: guest.cpuPoolKey,
+      physicalCores: guest.physicalCores,
+      vcpu: guest.vcpu,
+      memoryGib: guest.memoryGib,
+      diskGib: guest.diskGib,
+      egressGuaranteedMbps: guest.egressGuaranteedMbps,
+      egressBurstMbps: guest.egressBurstMbps,
+      confidential: true
+    }
+  }];
+}
 
 // src/operator-bootstrap.ts
 var REQUEST_LIMIT = 64 * 1024;
@@ -5464,13 +5500,17 @@ function readOperatorMetalBootstrapRequest(path) {
 }
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
-  const claims = platformGenesisClaims(request.genesis.environment, request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path)));
+  if (mode === "rehearsal" && request.genesis.environment !== "development") {
+    throw new Error("the disposable four-node Community rehearsal is development-only");
+  }
+  const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
+  const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
   return {
     kind: "metal-remote",
     mode,
     mutation: mode !== "status",
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" ? ["verify pinned SSH transport", "send three fixed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -5765,10 +5805,11 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
-    if (mode === "genesis") {
+    if (mode === "genesis" || mode === "rehearsal") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       const outputs = [];
-      for (const claim of platformGenesisClaims(request.genesis.environment, keys)) {
+      const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+      for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
       }

package/dist/platform-fleet-verification.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.55";
+var VERSION3 = "0.1.57";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/platform-genesis.d.ts

@@ -14,4 +14,13 @@ export interface PlatformGenesisGuest {
 }
 /** Package-owned provisioning coordinates for the exact three-node platform seed. */
 export declare const PLATFORM_GENESIS_FLEETS: Record<PlatformGenesisEnvironment, readonly PlatformGenesisGuest[]>;
+/**
+ * The disposable Community acceptance fleet adds one ordinary post-genesis
+ * Coordinator/DBServer host. It is deliberately not part of the three-member
+ * platform seed and never acquires Agency authority from this provisioning
+ * claim. The rehearsal controller installs that database role later.
+ */
+export declare const DEVELOPMENT_COMMUNITY_REHEARSAL_GUEST: PlatformGenesisGuest;
 export declare function platformGenesisClaims(environment: PlatformGenesisEnvironment, sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];
+/** Exact disposable four-host development fleet: three seed guests plus n4. */
+export declare function platformCommunityRehearsalClaims(sshPublicKeys: readonly string[]): readonly RemoteProvisionClaim[];

package/dist/provision.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.55";
+var VERSION3 = "0.1.57";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.55";
+export declare const VERSION = "0.1.57";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",