@forgezero/agent 0.1.57 → 0.1.59

package/dist/operator-bootstrap.js

@@ -22,7 +22,7 @@ function privateDatabaseHostRoute(value) {
   return `${address}/${isIP(address) === 4 ? 32 : 128}`;
 }
 var endpoint = "https://api.cloudflare.com/client/v4";
-async function cf(config, path, init = {}, fetcher = fetch) {
+async function cfEnvelope(config, path, init = {}, fetcher = fetch) {
   const response = await fetcher(`${endpoint}${path}`, {
     ...init,
     headers: {
@@ -35,7 +35,68 @@ async function cf(config, path, init = {}, fetcher = fetch) {
   if (!response.ok || body.success !== true) {
     throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
   }
-  return body.result;
+  return body;
+}
+async function cf(config, path, init = {}, fetcher = fetch) {
+  return (await cfEnvelope(config, path, init, fetcher)).result;
+}
+async function cfPages(config, path, perPage, fetcher) {
+  const output = [];
+  for (let page = 1;page <= 100; page += 1) {
+    const separator = path.includes("?") ? "&" : "?";
+    const envelope = await cfEnvelope(config, `${path}${separator}page=${page}&per_page=${perPage}`, {}, fetcher);
+    const result = Array.isArray(envelope.result) ? envelope.result : [];
+    output.push(...result);
+    const totalPages = envelope.result_info?.total_pages;
+    if (Number.isInteger(totalPages) ? page >= totalPages : result.length < perPage)
+      return output;
+  }
+  throw new Error("Cloudflare pagination exceeded the reviewed 100-page bound");
+}
+var exactHexId = (value, label) => {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (!/^[a-f0-9]{32}$/.test(normalized))
+    throw new Error(`${label} is malformed`);
+  return normalized;
+};
+async function discoverCloudflareBootstrapResources(config, fetcher = fetch) {
+  const zoneName = config.zoneName.trim().toLowerCase().replace(/\.$/, "");
+  const kvNamespaceTitle = config.kvNamespaceTitle.trim();
+  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(zoneName)) {
+    throw new Error("Cloudflare zone name is invalid");
+  }
+  if (!kvNamespaceTitle || kvNamespaceTitle.length > 512) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const [managementStatus, runtimeStatus] = await Promise.all([
+    cf({ apiToken: config.tunnelToken }, "/user/tokens/verify", {}, fetcher),
+    cf({ apiToken: config.apiToken }, "/user/tokens/verify", {}, fetcher)
+  ]);
+  if (managementStatus.status !== "active")
+    throw new Error("CF_TUNNEL_TOKEN is not active");
+  if (runtimeStatus.status !== "active")
+    throw new Error("CF_API_TOKEN is not active");
+  const zones = await cfPages({ apiToken: config.tunnelToken }, `/zones?name=${encodeURIComponent(zoneName)}&match=all&status=active`, 50, fetcher);
+  const matchingZones = zones.filter(({ name }) => name?.trim().toLowerCase() === zoneName);
+  if (matchingZones.length !== 1) {
+    throw new Error(`Cloudflare zone ${zoneName} must resolve to exactly one active zone`);
+  }
+  const zoneId = exactHexId(matchingZones[0].id, "Cloudflare zone id");
+  const accountId = exactHexId(matchingZones[0].account?.id, "Cloudflare account id");
+  const namespaces = await cfPages({ apiToken: config.apiToken }, `/accounts/${accountId}/storage/kv/namespaces?order=title&direction=asc`, 1000, fetcher);
+  const matchingNamespaces = namespaces.filter(({ title }) => title === kvNamespaceTitle);
+  if (matchingNamespaces.length !== 1) {
+    throw new Error(`Cloudflare KV namespace ${kvNamespaceTitle} must resolve to exactly one namespace`);
+  }
+  const kvNamespaceId = exactHexId(matchingNamespaces[0].id, "Cloudflare KV namespace id");
+  if (config.workerScriptName) {
+    await verifyCloudflareWorkerDurableObjects({
+      accountId,
+      scriptName: config.workerScriptName,
+      apiToken: config.apiToken
+    }, fetcher);
+  }
+  return { accountId, zoneId, kvNamespaceId };
 }
 async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
   const [address, prefixText, ...extra] = config.network.split("/");
@@ -211,7 +272,7 @@ async function verifyCloudflareWorkerDurableObjects(config, fetcher = fetch) {
   if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/.test(config.scriptName)) {
     throw new Error("Cloudflare Worker script name is invalid");
   }
-  const namespaces = await cf(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces?per_page=1000`, {}, fetcher);
+  const namespaces = await cfPages(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces`, 1000, fetcher);
   const owned = namespaces.filter(({ script }) => script === config.scriptName);
   if (!owned.length)
     throw new Error(`Cloudflare Worker ${config.scriptName} has no Durable Object namespace`);
@@ -283,18 +344,28 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
   }
   return { tunnel, connectorToken, created };
 }
+async function retrieveCloudflareConnectorTokens(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId) || !/^[0-9a-f-]{36}$/i.test(config.tunnelId) || config.meshConnectorId && !/^[0-9a-f-]{36}$/i.test(config.meshConnectorId)) {
+    throw new Error("Cloudflare connector retrieval coordinates are invalid");
+  }
+  const connectorToken = await cf(config, `/accounts/${config.accountId}/cfd_tunnel/${encodeURIComponent(config.tunnelId)}/token`, {}, fetcher);
+  const meshConnectorToken = config.meshConnectorId ? await cf(config, `/accounts/${config.accountId}/warp_connector/${encodeURIComponent(config.meshConnectorId)}/token`, {}, fetcher) : undefined;
+  for (const value of [connectorToken, meshConnectorToken]) {
+    if (value !== undefined && (!value || value.length > 16384))
+      throw new Error("Cloudflare returned an invalid connector token");
+  }
+  return { connectorToken, ...meshConnectorToken ? { meshConnectorToken } : {} };
+}
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { randomBytes, randomUUID } from "crypto";
+import { createHmac, randomUUID } from "crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
 import { dirname, join, resolve } from "path";
 import { isIP as isIP2 } from "net";
 var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
-var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
-var REALTIME_SECRET = /^[A-Za-z0-9_-]{64,128}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -328,26 +399,17 @@ async function readOwnerOnlyFile(path, maximumBytes) {
     await handle?.close();
   }
 }
-async function readOwnerApiToken(path) {
-  const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!TOKEN.test(token))
-    throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
-  return token;
-}
-async function readCloudflareBootstrapTokens(files) {
-  const unsupported = Object.keys(files).filter((key) => ![
-    "tunnelTokenFile",
-    "apiTokenFile"
-  ].includes(key));
+function validateCloudflareBootstrapTokens(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Cloudflare bootstrap tokens must be an object");
+  const source = input;
+  const unsupported = Object.keys(source).filter((key) => !["tunnelToken", "apiToken"].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap token files contain unsupported field ${unsupported[0]}`);
-  if (!files.tunnelTokenFile?.trim() || !files.apiTokenFile?.trim()) {
-    throw new Error("Cloudflare bootstrap requires exactly tunnelTokenFile and apiTokenFile");
-  }
-  const [tunnelToken, apiToken] = await Promise.all([
-    readOwnerApiToken(files.tunnelTokenFile),
-    readOwnerApiToken(files.apiTokenFile)
-  ]);
+    throw new Error(`Cloudflare bootstrap tokens contain unsupported field ${unsupported[0]}`);
+  const tunnelToken = typeof source.tunnelToken === "string" ? source.tunnelToken.trim() : "";
+  const apiToken = typeof source.apiToken === "string" ? source.apiToken.trim() : "";
+  if (!TOKEN.test(tunnelToken) || !TOKEN.test(apiToken))
+    throw new Error("Cloudflare bootstrap requires two valid API tokens");
   if (tunnelToken === apiToken) {
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege tokens");
   }
@@ -523,7 +585,7 @@ function planCloudflareBootstrap(input, outputPath) {
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-plan",
-    mode: "attended-token-file",
+    mode: "attended-hidden-input",
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
@@ -531,19 +593,19 @@ function planCloudflareBootstrap(input, outputPath) {
       ...coordinates.realtime ? [
         "prove the existing Worker owns a Durable Object namespace and install its publish/ticket secrets with CF_API_TOKEN"
       ] : [],
-      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint only its non-secret id",
       ...coordinates.nodes.some(({ mesh }) => mesh) ? [
-        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint its registration token",
+        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint only its non-secret id",
         "reconcile every unique private CIDR to its Mesh connector and include all declared CIDRs in the dedicated Mesh device profile"
       ] : [],
       "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
       "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
-      "write one node-specific handoff containing the connector token and owner-supplied KV/Worker runtime token"
+      "write one secret-free node handoff containing only bound Cloudflare ids and public coordinates"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never placed in argv or stdout",
-      "CF_TUNNEL_TOKEN is never persisted; cloudflared, Mesh, CF_API_TOKEN and generated realtime capabilities are atomically checkpointed with mode 0600",
-      "the normal API process receives only CF_API_TOKEN and never Tunnel, DNS or Mesh management authority"
+      "API tokens are accepted only from a hidden prompt and are never placed in JSON, files, argv or stdout",
+      "checkpoint and host handoffs contain no connector, management, runtime or realtime secret",
+      "the target Agent retrieves its connector tokens and seals both Vault fallback tokens directly"
     ]
   };
 }
@@ -608,25 +670,15 @@ async function readExistingOutput(path) {
   const resources = output.resources;
   const unsupportedResource = Object.keys(resources).filter((key) => ![
     "kvNamespaceId",
-    "apiToken",
-    "realtime",
     "nodes"
   ].includes(key));
   if (unsupportedResource.length) {
     throw new Error(`${resolve(path)} resources contain unsupported field ${unsupportedResource[0]}`);
   }
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
-  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !TOKEN.test(String(resources.apiToken ?? "")) || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
+  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
     throw new Error(`${resolve(path)} has malformed Cloudflare bootstrap resources`);
   }
-  if (coordinates.realtime) {
-    const realtime = resources.realtime;
-    if (!realtime || !REALTIME_SECRET.test(String(realtime.publishSecret ?? "")) || !REALTIME_SECRET.test(String(realtime.ticketSecret ?? "")) || realtime.publishSecret === realtime.ticketSecret) {
-      throw new Error(`${resolve(path)} has malformed Cloudflare realtime resources`);
-    }
-  } else if (resources.realtime !== undefined) {
-    throw new Error(`${resolve(path)} contains undeclared Cloudflare realtime resources`);
-  }
   const seen = new Set;
   for (const item of resources.nodes) {
     if (!item || typeof item !== "object" || Array.isArray(item)) {
@@ -639,16 +691,15 @@ async function readExistingOutput(path) {
       "service",
       "tunnelName",
       "tunnelId",
-      "connectorToken",
       "mesh"
     ].includes(key));
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
-    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? "")) || !CONNECTOR_TOKEN.test(String(node.connectorToken ?? ""))) {
+    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? ""))) {
       throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare node resource`);
     }
     if (expected.mesh) {
       const mesh = node.mesh;
-      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? "")) || !CONNECTOR_TOKEN.test(String(mesh.connectorToken ?? ""))) {
+      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? ""))) {
         throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare Mesh resource`);
       }
     } else if (node.mesh !== undefined) {
@@ -689,7 +740,7 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
   }
   const resource = matches[0];
-  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId) || !CONNECTOR_TOKEN.test(resource.connectorToken)) {
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId)) {
     throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
   }
   return {
@@ -697,10 +748,8 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     hostname: resource.hostname,
     service: resource.service,
     tunnelId: resource.tunnelId,
-    connectorToken: resource.connectorToken,
     ...resource.mesh ? { mesh: {
       connectorId: resource.mesh.connectorId,
-      connectorToken: resource.mesh.connectorToken,
       routes: resource.mesh.routes
     } } : {}
   };
@@ -724,11 +773,9 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     "hostname",
     "service",
     "tunnelId",
-    "connectorToken",
     "accountId",
     "zoneId",
     "kvNamespaceId",
-    "apiToken",
     "mesh",
     "realtime"
   ].includes(key));
@@ -739,11 +786,11 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   try {
     service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.apiToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
   if (output.mesh !== undefined) {
-    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !CONNECTOR_TOKEN.test(output.mesh.connectorToken) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
+    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
       try {
         return privateMeshCidr(route) !== route;
       } catch {
@@ -772,7 +819,7 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     } catch {
       throw new Error("Cloudflare host handoff contains malformed realtime coordinates");
     }
-    if (!REALTIME_SECRET.test(output.realtime.publishSecret) || !REALTIME_SECRET.test(output.realtime.ticketSecret) || output.realtime.publishSecret === output.realtime.ticketSecret || realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
+    if (realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
       throw new Error("Cloudflare host handoff contains malformed realtime credentials");
     }
   }
@@ -837,18 +884,12 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       hostname: node.hostname,
       service: node.service,
       tunnelId: node.tunnelId,
-      connectorToken: node.connectorToken,
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      apiToken: output.resources.apiToken,
-      ...output.coordinates.realtime && output.resources.realtime ? { realtime: {
-        ...output.coordinates.realtime,
-        ...output.resources.realtime
-      } } : {},
+      ...output.coordinates.realtime ? { realtime: output.coordinates.realtime } : {},
       ...node.mesh ? { mesh: {
         connectorId: node.mesh.connectorId,
-        connectorToken: node.mesh.connectorToken,
         routes: node.mesh.routes
       } } : {}
     };
@@ -856,7 +897,10 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
   }
 }
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-var newRealtimeSecret = () => randomBytes(48).toString("base64url");
+var deriveCloudflareRealtimeSecrets = (apiToken) => ({
+  publishSecret: createHmac("sha512", apiToken).update("forgezero/realtime/publish/v1").digest("base64url"),
+  ticketSecret: createHmac("sha512", apiToken).update("forgezero/realtime/ticket/v1").digest("base64url")
+});
 async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
@@ -874,10 +918,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege capabilities");
   }
   await preflightCloudflareKvRuntime(coordinates, apiToken, fetcher);
-  const realtime = coordinates.realtime ? existing?.resources.realtime ?? {
-    publishSecret: newRealtimeSecret(),
-    ticketSecret: newRealtimeSecret()
-  } : undefined;
+  const realtime = coordinates.realtime ? deriveCloudflareRealtimeSecrets(apiToken) : undefined;
   if (coordinates.realtime && realtime) {
     await verifyCloudflareWorkerDurableObjects({
       accountId: coordinates.accountId,
@@ -892,8 +933,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        realtime,
         nodes: existing?.resources.nodes ?? []
       }
     });
@@ -912,7 +951,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     let resource;
     let created = false;
     if (checkpointed) {
-      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId)) {
         throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
       }
       resource = checkpointed;
@@ -933,15 +972,13 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         }, fetcher);
         mesh = {
           ...node.mesh,
-          connectorId: ensured.connector.id,
-          connectorToken: ensured.connectorToken
+          connectorId: ensured.connector.id
         };
       }
       const { mesh: _declaredMesh, ...publicNode } = node;
       resource = {
         ...publicNode,
         tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken,
         ...mesh ? { mesh } : {}
       };
     }
@@ -955,8 +992,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        ...realtime ? { realtime } : {},
         nodes: [...nodeResources]
       }
     });
@@ -1000,8 +1035,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     coordinates,
     resources: {
       kvNamespaceId: coordinates.kvNamespaceId,
-      apiToken,
-      ...realtime ? { realtime } : {},
       nodes: nodeResources
     },
     created: {
@@ -1023,10 +1056,10 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
-  if (!request.tokenFiles) {
-    throw new Error("Cloudflare apply requires exactly two owner-only token file paths");
+  if (!request.tokens) {
+    throw new Error("Cloudflare apply requires exactly two attended API tokens");
   }
-  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const tokens = validateCloudflareBootstrapTokens(request.tokens);
   const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
@@ -1177,7 +1210,7 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 }
 
 // src/bootstrap.ts
-import { createHash, createHmac, randomBytes as randomBytes3 } from "crypto";
+import { createHash, createHmac as createHmac2, randomBytes as randomBytes2 } from "crypto";
 import {
   chmodSync as chmodSync2,
   existsSync as existsSync4,
@@ -1207,7 +1240,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.57";
+var VERSION = "0.1.59";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -2117,10 +2150,11 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
+    throw new Error("direct enrolment credential and state paths must be supplied together");
+  }
+  const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
   const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
@@ -2248,7 +2282,12 @@ function planProvision(options) {
       ] : [],
       ...enrolmentEnabled ? [
         step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        ...enrolTokenSourcePath ? [step("encrypted one-time enrolment capability", {
+          kind: "ensure-enrolment",
+          state: enrolStatePath,
+          source: enrolTokenSourcePath,
+          credential: enrolTokenCredentialPath
+        })] : []
       ] : [],
       ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },
@@ -2292,7 +2331,7 @@ function planProvision(options) {
 }
 
 // src/cli/agent-install.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes } from "crypto";
 import {
   chmodSync,
   copyFileSync,
@@ -2388,7 +2427,7 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "ensure-seed") {
     if (existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    const seed = randomBytes2(32).toString("base64url");
+    const seed = randomBytes(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
     if (result.exitCode === 0)
       chmodSync(operation.credential, 256);
@@ -2781,9 +2820,10 @@ function renderPlatformSharedEnvironment(input) {
 }
 function platformApiCredentialSpecs(options) {
   const optional = [
-    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
-    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["fz_smtp.password", options.emailProvider === "smtp"],
+    ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
     ["CF_API_TOKEN", options.cloudflareKv],
+    ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
     ["REALTIME_TICKET_SECRET", options.realtime]
   ];
@@ -3118,6 +3158,78 @@ var PLATFORM_BOOTSTRAP_PROFILES = [
   "platform-db-api",
   "platform-api"
 ];
+function validateCloudflareBootstrapSecretPair(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Cloudflare credential input must be an object");
+  const source = input;
+  const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : "";
+  const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : "";
+  if (!/^[A-Za-z0-9._-]{40,80}$/.test(cloudflareTunnelToken) || !/^[A-Za-z0-9._-]{40,80}$/.test(cloudflareApiToken) || cloudflareTunnelToken === cloudflareApiToken) {
+    throw new Error("Cloudflare bootstrap credentials must be distinct valid API tokens");
+  }
+  return { cloudflareTunnelToken, cloudflareApiToken };
+}
+function validateEnrolledComputeBootstrapSecrets(config, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("compute activation credential input must be an object");
+  const source = input;
+  const allowed = ["enrolmentToken", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`compute activation credential input contains unsupported field ${unknown[0]}`);
+  const enrolmentToken = typeof source.enrolmentToken === "string" ? source.enrolmentToken.trim() : "";
+  if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolmentToken))
+    throw new Error("compute enrolment token is malformed");
+  const cloudflareConfigured = Boolean(config.cloudflareHandoff);
+  if (cloudflareConfigured !== Boolean(source.cloudflareTunnelToken && source.cloudflareApiToken)) {
+    throw new Error("Cloudflare compute activation requires CF_TUNNEL_TOKEN and CF_API_TOKEN together");
+  }
+  return {
+    enrolmentToken,
+    ...cloudflareConfigured ? validateCloudflareBootstrapSecretPair(source) : {}
+  };
+}
+function validatePlatformBootstrapSecrets(config, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("bootstrap credential input must be an object");
+  const source = input;
+  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
+  const clusterBootstrapCode = typeof source.clusterBootstrapCode === "string" ? source.clusterBootstrapCode.trim() : "";
+  const emailSecret = typeof source.emailSecret === "string" ? source.emailSecret.trim() : "";
+  const enrolmentToken = typeof source.enrolmentToken === "string" ? source.enrolmentToken.trim() : undefined;
+  const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
+  const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
+  const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
+  if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
+    throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
+  if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
+    throw new Error("bootstrap email credential is malformed");
+  if (config.enrolment.source === "api-token" !== Boolean(enrolmentToken) || enrolmentToken && !/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolmentToken)) {
+    throw new Error("platform enrolment source and attended token disagree");
+  }
+  if (Boolean(config.runtime.environment.backup) !== Boolean(backupS3Secret)) {
+    throw new Error("backup configuration and its attended credential must be supplied together");
+  }
+  if (backupS3Secret && (backupS3Secret.length > 16384 || /[\r\n\0]/.test(backupS3Secret))) {
+    throw new Error("backup credential is malformed");
+  }
+  const cloudflareConfigured = Boolean(config.cloudflareHandoff || config.runtime.environment.cloudflare);
+  if (cloudflareConfigured !== Boolean(cloudflareTunnelToken && cloudflareApiToken)) {
+    throw new Error("Cloudflare configuration requires attended CF_TUNNEL_TOKEN and CF_API_TOKEN together");
+  }
+  if (cloudflareTunnelToken)
+    validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
+  return {
+    clusterBootstrapCode,
+    emailSecret,
+    ...enrolmentToken ? { enrolmentToken } : {},
+    ...backupS3Secret ? { backupS3Secret } : {},
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
+  };
+}
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
 function resolveInstalledBootstrapKind(states) {
   if (states.compute && states.metal) {
@@ -3133,6 +3245,7 @@ var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var CF_TUNNEL_API_CREDENTIAL = `${CREDS}/CF_TUNNEL_TOKEN.cred`;
 var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
 var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
 var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
@@ -3141,7 +3254,6 @@ var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
 var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
 var GIT_PUBLIC_KEY = "/etc/forgezero/git/deploy.pub";
-var PLATFORM_ENROL_SOURCE = "/run/forgezero-platform-enrol-token";
 var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
 var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
 var CONTROL_SOCKET = "/run/forgezero/control.sock";
@@ -3219,8 +3331,6 @@ function validateBootstrapConfig(value) {
     if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
       throw new Error("tenant API must be public HTTPS or loopback HTTP");
     }
-    if (!value.enrolTokenFile)
-      throw new Error("enrolled-compute activation requires an enrolment-token file");
     if (value.bootstrapRunner) {
       if (value.bootstrapRunner.sshPrivateKeyFile !== undefined && (!value.bootstrapRunner.sshPrivateKeyFile.startsWith("/") || /[\r\n]/.test(value.bootstrapRunner.sshPrivateKeyFile))) {
         throw new Error("bootstrap runner SSH private-key file must be absolute");
@@ -3264,8 +3374,6 @@ function validateBootstrapConfig(value) {
   if (!/^[a-z0-9](?:[a-z0-9:_-]{0,126}[a-z0-9])?$/.test(value.computeReference)) {
     throw new Error("platform compute reference is malformed");
   }
-  if (!value.database.bootstrapSecretFile)
-    throw new Error("platform bootstrap requires the shared cluster bootstrap-code file");
   const write = value.database.coordinators.map(privateOrigin);
   if (write.length < 1 || write.length > 16 || new Set(write).size !== write.length) {
     throw new Error("database coordinators must contain 1-16 unique private origins");
@@ -3280,12 +3388,6 @@ function validateBootstrapConfig(value) {
   }
   if (runtime.deployProfile !== value.environment)
     throw new Error("runtime deployment profile disagrees with bootstrap environment");
-  if (Boolean(runtime.email) !== Boolean(value.runtime.credentialFiles?.emailSecret)) {
-    throw new Error("Bootstrap email configuration and its owner-only credential file must be supplied together");
-  }
-  if (value.runtime.credentialFiles?.emailSecret && (!value.runtime.credentialFiles.emailSecret.startsWith("/") || /[\r\n]/.test(value.runtime.credentialFiles.emailSecret))) {
-    throw new Error("Bootstrap email credential file must be an absolute single-line path");
-  }
   if (value.database.address !== runtime.databaseAddress || value.database.master !== runtime.databaseMaster) {
     throw new Error("runtime database topology disagrees with bootstrap topology");
   }
@@ -3296,9 +3398,8 @@ function validateBootstrapConfig(value) {
   if (value.firewall.enabled && (value.firewall.privateCidrs.length < 1 || new Set(value.firewall.privateCidrs).size !== value.firewall.privateCidrs.length)) {
     throw new Error("enabled firewall requires unique private cluster CIDRs");
   }
-  if (!["genesis-derived", "api-token"].includes(value.enrolment.source) || value.enrolment.source === "api-token" && !value.enrolment.tokenFile || value.enrolment.source === "genesis-derived" && value.enrolment.tokenFile) {
-    throw new Error("platform enrolment source and token file disagree");
-  }
+  if (!["genesis-derived", "api-token"].includes(value.enrolment.source))
+    throw new Error("platform enrolment source is invalid");
   value.runtime.environment = runtime;
   return value;
 }
@@ -3512,7 +3613,7 @@ async function waitForCloudflaredTunnel(host, expectedTunnelId) {
 var derive = (root, label) => {
   if (!/^[a-f0-9]{64}$/i.test(root))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
-  return createHmac("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
+  return createHmac2("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
 };
 async function seal(host, name, destination2, value) {
   if (host.exists(destination2))
@@ -3802,15 +3903,10 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     problems.push("durable Agent enrolment state is missing");
   return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
 }
-async function applyBootstrap(input, host = localBootstrapHost()) {
+async function applyBootstrap(input, host = localBootstrapHost(), secrets, dependencies = {}) {
   const config = validateBootstrapConfig(structuredClone(input));
   if (host.uid() !== 0)
     throw new Error("fz bootstrap --apply must run as root");
-  if (config.kind === "enrolled-compute") {
-    const token = privateFile(host, config.enrolTokenFile, "tenant enrolment token");
-    if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(token))
-      throw new Error("tenant enrolment token is malformed");
-  }
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
@@ -3868,11 +3964,21 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
   }
-  const platformPrivate = config.kind === "platform" ? {
-    root: privateFile(host, config.database.bootstrapSecretFile, "database bootstrap secret"),
-    email: config.runtime.credentialFiles?.emailSecret && !host.exists(`${CREDS}/${config.runtime.environment.email?.provider === "jetemail" ? "bootstrap-jetemail-api-key" : "bootstrap-smtp-password"}.cred`) ? privateFile(host, config.runtime.credentialFiles.emailSecret, "bootstrap email credential") : undefined,
-    backup: config.runtime.credentialFiles?.backupS3Secret && !host.exists(`${CREDS}/backup-s3-secret.cred`) ? privateFile(host, config.runtime.credentialFiles.backupS3Secret, "backup S3 credential") : undefined
-  } : undefined;
+  const platformPrivate = config.kind === "platform" ? (() => {
+    if (!secrets)
+      throw new Error("platform apply requires attended credentials on stdin");
+    const checked3 = validatePlatformBootstrapSecrets(config, secrets);
+    return {
+      root: checked3.clusterBootstrapCode,
+      email: checked3.emailSecret,
+      enrolmentToken: checked3.enrolmentToken,
+      backup: checked3.backupS3Secret,
+      cloudflareTunnelToken: checked3.cloudflareTunnelToken,
+      cloudflareApiToken: checked3.cloudflareApiToken
+    };
+  })() : undefined;
+  const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
+  const cloudflarePrivate = cloudflare ? config.kind === "platform" ? { cloudflareTunnelToken: platformPrivate.cloudflareTunnelToken, cloudflareApiToken: platformPrivate.cloudflareApiToken } : validateCloudflareBootstrapSecretPair(enrolledPrivate) : undefined;
   if (config.kind === "enrolled-compute" && config.bootstrapRunner?.sshPrivateKeyFile && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
     privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key");
   }
@@ -3881,17 +3987,31 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
-  if (cloudflare && !host.exists(CF_API_CREDENTIAL)) {
-    await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflare.apiToken);
+  if (!alreadyEnrolled && !host.exists(ENROL_CREDENTIAL)) {
+    const enrolmentToken = config.kind === "platform" ? config.enrolment.source === "api-token" ? platformPrivate.enrolmentToken : `fze_${derive(derive(platformPrivate.root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}` : enrolledPrivate.enrolmentToken;
+    await seal(host, "enrol-token", ENROL_CREDENTIAL, enrolmentToken);
+  }
+  const connectorCapabilities = cloudflare ? await retrieveCloudflareConnectorTokens({
+    accountId: cloudflare.accountId,
+    tunnelId: cloudflare.tunnelId,
+    ...cloudflare.mesh ? { meshConnectorId: cloudflare.mesh.connectorId } : {},
+    apiToken: cloudflarePrivate.cloudflareTunnelToken
+  }, dependencies.fetcher ?? fetch) : undefined;
+  if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
+    await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
+  }
+  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+    await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
-  if (cloudflare?.realtime && !host.exists(REALTIME_PUBLISH_CREDENTIAL)) {
-    await seal(host, "REALTIME_PUBLISH_SECRET", REALTIME_PUBLISH_CREDENTIAL, cloudflare.realtime.publishSecret);
+  const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
+  if (realtimeSecrets && !host.exists(REALTIME_PUBLISH_CREDENTIAL)) {
+    await seal(host, "REALTIME_PUBLISH_SECRET", REALTIME_PUBLISH_CREDENTIAL, realtimeSecrets.publishSecret);
   }
-  if (cloudflare?.realtime && !host.exists(REALTIME_TICKET_CREDENTIAL)) {
-    await seal(host, "REALTIME_TICKET_SECRET", REALTIME_TICKET_CREDENTIAL, cloudflare.realtime.ticketSecret);
+  if (realtimeSecrets && !host.exists(REALTIME_TICKET_CREDENTIAL)) {
+    await seal(host, "REALTIME_TICKET_SECRET", REALTIME_TICKET_CREDENTIAL, realtimeSecrets.ticketSecret);
   }
-  if (cloudflare?.mesh && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
-    await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, cloudflare.mesh.connectorToken);
+  if (connectorCapabilities?.meshConnectorToken && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
+    await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, connectorCapabilities.meshConnectorToken);
   }
   await host.installAgent(config);
   if (config.kind === "platform" && config.firewall.enabled) {
@@ -3918,22 +4038,15 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     }
     await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
     await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
-    const credentialFiles = config.runtime.credentialFiles ?? {};
-    const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "bootstrap-smtp-password" : config.runtime.environment.email?.provider === "jetemail" ? "bootstrap-jetemail-api-key" : undefined;
-    if (Boolean(config.runtime.environment.email) !== Boolean(credentialFiles.emailSecret)) {
-      throw new Error("Bootstrap email configuration and its owner-only credential file must be supplied together");
-    }
+    const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup-s3-secret": platformPrivate.backup
+      "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
         const destination2 = `${CREDS}/${name}.cred`;
         if (!host.exists(destination2)) {
           await seal(host, name, destination2, source);
-          const sourcePath = name === "backup-s3-secret" ? credentialFiles.backupS3Secret : credentialFiles.emailSecret;
-          if (sourcePath)
-            host.remove(sourcePath);
         }
       }
     }
@@ -4003,7 +4116,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
-        host.write(invite, `plt_${randomBytes3(24).toString("hex")}
+        host.write(invite, `plt_${randomBytes2(24).toString("hex")}
 `, 384);
         await checked2(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
       }
@@ -4023,13 +4136,6 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
         verifiedAt: new Date().toISOString()
       };
       host.write(DB_MODE_EVIDENCE, `${JSON.stringify(evidence, null, 2)}
-`, 384);
-    }
-    if (!alreadyEnrolled) {
-      const enrolToken = config.enrolment.source === "api-token" ? privateFile(host, config.enrolment.tokenFile, "platform enrolment token") : `fze_${derive(derive(root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}`;
-      if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolToken))
-        throw new Error("platform enrolment token is malformed");
-      host.write(PLATFORM_ENROL_SOURCE, `${enrolToken}
 `, 384);
     }
     await checked2(host, [
@@ -4041,15 +4147,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       "deploy",
       ...config.database.role === "master" ? ["--release-executor"] : []
     ], "initial Agent deployment");
-    if (!alreadyEnrolled) {
-      await host.installAgent(config, PLATFORM_ENROL_SOURCE);
-      if (config.enrolment.source === "api-token")
-        host.remove(config.enrolment.tokenFile);
-    }
   }
   if (config.cloudflareHandoff) {
-    if (!host.exists(TUNNEL_CREDENTIAL) && cloudflare) {
-      await seal(host, "CF_TUNNEL_CONNECTOR_TOKEN", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
+    if (!host.exists(TUNNEL_CREDENTIAL) && connectorCapabilities) {
+      await seal(host, "CF_TUNNEL_CONNECTOR_TOKEN", TUNNEL_CREDENTIAL, connectorCapabilities.connectorToken);
     }
     if (!host.exists(TUNNEL_CREDENTIAL))
       throw new Error("sealed cloudflared connector credential is missing");
@@ -4123,7 +4224,6 @@ function strictBootstrapDocument(value) {
     "installWarp",
     "cloudflareHandoff",
     "realm",
-    "enrolTokenFile",
     "software",
     "deploymentCredentials",
     "bootstrapRunner"
@@ -4132,8 +4232,8 @@ function strictBootstrapDocument(value) {
     exactKeys(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
-    exactKeys(root.database, ["role", "agency", "serverMode", "address", "master", "coordinators", "bootstrapSecretFile"], "database config");
-    exactKeys(root.enrolment, ["source", "tokenFile"], "platform enrolment config");
+    exactKeys(root.database, ["role", "agency", "serverMode", "address", "master", "coordinators"], "database config");
+    exactKeys(root.enrolment, ["source"], "platform enrolment config");
     const runtime = exactKeys(root.runtime, [
       "environment",
       "serviceUser",
@@ -4141,8 +4241,7 @@ function strictBootstrapDocument(value) {
       "bluePort",
       "greenPort",
       "healthPath",
-      "keepReleases",
-      "credentialFiles"
+      "keepReleases"
     ], "runtime config");
     exactKeys(runtime.environment, [
       "softwareProfile",
@@ -4180,8 +4279,6 @@ function strictBootstrapDocument(value) {
       "cloudflare",
       "realtime"
     ], "runtime environment");
-    if (runtime.credentialFiles !== undefined)
-      exactKeys(runtime.credentialFiles, ["emailSecret", "backupS3Secret"], "runtime credential files");
     const environment = runtime.environment;
     if (environment.email !== undefined) {
       const email = exactKeys(environment.email, ["provider", "host", "port", "user", "from", "eu"], "email config");
@@ -4265,10 +4362,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config, enrolTokenSourcePath) {
+    async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync4("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || existsSync4(ENROL_CREDENTIAL) || existsSync4("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -4311,8 +4408,7 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
-        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
-          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
+        ...hasBinding ? {
           enrolTokenCredentialPath: ENROL_CREDENTIAL,
           enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,
@@ -4332,7 +4428,7 @@ function localBootstrapHost() {
 }
 
 // src/metal-bootstrap.ts
-import { createHash as createHash2, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync3,
   chownSync,
@@ -5068,7 +5164,7 @@ async function applyMetalBootstrap(config, options) {
   atomicWrite(PROFILE_PATH, `${JSON.stringify(persistedProfile, null, 2)}
 `, 384);
   if (!existsSync5(SEED_CREDENTIAL_PATH)) {
-    const seed = config.agentSeedFile ? readFileSync5(config.agentSeedFile, "utf8").trim() : randomBytes4(32).toString("base64url");
+    const seed = config.agentSeedFile ? readFileSync5(config.agentSeedFile, "utf8").trim() : randomBytes3(32).toString("base64url");
     if (seed.length < 32 || /[\0\r\n]/.test(seed))
       throw new MetalBootstrapError("metal Agent seed is invalid");
     await runChecked(exec, ["/usr/bin/systemd-creds", "encrypt", "--name=metal-agent-seed", "-", SEED_CREDENTIAL_PATH], `${seed}
@@ -5234,7 +5330,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
-import { createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
 import { lstatSync as lstatSync4, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
@@ -5522,12 +5618,15 @@ function planOperatorMetalBootstrap(request, mode) {
   };
 }
 var secretSources = (config) => [
-  ["cluster-code", config.database.bootstrapSecretFile],
-  ...config.enrolment.tokenFile ? [["enrol-token", config.enrolment.tokenFile]] : [],
-  ...config.runtime.credentialFiles?.emailSecret ? [["email-secret", config.runtime.credentialFiles.emailSecret]] : [],
-  ...config.runtime.credentialFiles?.backupS3Secret ? [["backup-s3-secret", config.runtime.credentialFiles.backupS3Secret]] : [],
   ...config.cloudflareHandoff ? [["cloudflare-handoff", config.cloudflareHandoff.handoffFile]] : []
 ];
+var attendedSecretNames = (config) => [
+  "cluster-bootstrap-code",
+  config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : "fz_smtp.password",
+  ...config.enrolment.source === "api-token" ? ["enrol-token"] : [],
+  ...config.runtime.environment.backup ? ["backup.s3.secretAccessKey"] : [],
+  ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? ["CF_TUNNEL_TOKEN", "CF_API_TOKEN"] : []
+];
 function planOperatorPlatformBootstrap(request, mode) {
   const config = readBootstrapConfig(request.platformConfigFile);
   if (config.kind !== "platform")
@@ -5549,7 +5648,7 @@ function planOperatorPlatformBootstrap(request, mode) {
       `run typed fz bootstrap platform${mode === "prepare" ? " prepare" : ""} --apply`,
       "remove transient local and remote staging data"
     ],
-    secretInputs: secretSources(config).map(([name]) => name)
+    secretInputs: mode === "apply" ? [...attendedSecretNames(config), ...secretSources(config).map(([name]) => name)] : []
   };
 }
 var defaultExec3 = async (argv, options = {}) => {
@@ -5666,15 +5765,7 @@ function stageConfig(config, directory) {
     writeFileSync7(local, bytes, { mode: 384, flag: "wx" });
     staged.push(name);
     const remotePath = `${REMOTE_STAGE}/${name}`;
-    if (name === "cluster-code")
-      rewritten.database.bootstrapSecretFile = remotePath;
-    else if (name === "enrol-token")
-      rewritten.enrolment.tokenFile = remotePath;
-    else if (name === "email-secret")
-      rewritten.runtime.credentialFiles.emailSecret = remotePath;
-    else if (name === "backup-s3-secret")
-      rewritten.runtime.credentialFiles.backupS3Secret = remotePath;
-    else if (name === "cloudflare-handoff")
+    if (name === "cloudflare-handoff")
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
   const path = join6(directory, "platform-config.json");
@@ -5758,7 +5849,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
   const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-bootstrap-"));
-  const remoteTemp = `/tmp/forgezero-operator-${randomBytes5(12).toString("hex")}`;
+  const remoteTemp = `/tmp/forgezero-operator-${randomBytes4(12).toString("hex")}`;
   let knownHosts = "";
   try {
     knownHosts = writeKnownHosts(request, directory);
@@ -5769,6 +5860,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const config = readBootstrapConfig(request.platformConfigFile);
     if (config.kind !== "platform")
       throw new Error("operator bootstrap requires a platform config");
+    const secrets = mode === "apply" ? validatePlatformBootstrapSecrets(config, options.secrets) : undefined;
     const staged = stageConfig(config, directory);
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
@@ -5779,8 +5871,11 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform"];
     if (mode === "prepare")
       command.push("prepare");
+    else
+      command.push("credentials-stdin");
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
-    const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap");
+    const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
+` : undefined);
     return { plan, output };
   } finally {
     if (knownHosts) {
@@ -5797,7 +5892,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
   const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-metal-"));
-  const remoteTemp = `/tmp/forgezero-operator-${randomBytes5(12).toString("hex")}`;
+  const remoteTemp = `/tmp/forgezero-operator-${randomBytes4(12).toString("hex")}`;
   let knownHosts = "";
   try {
     knownHosts = writeKnownHosts(request, directory);