@forgezero/agent 0.1.58 → 0.1.60

package/dist/fz.js

@@ -4811,8 +4811,7 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 
 // src/cli/index.ts
 init_dist();
-import { existsSync as existsSync11, lstatSync as lstatSync9, mkdirSync as mkdirSync11, readFileSync as readFileSync14, statSync as statSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync12 } from "fs";
-import { randomBytes as randomBytes10 } from "crypto";
+import { existsSync as existsSync11, lstatSync as lstatSync9, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync12 } from "fs";
 import { basename as basename3, dirname as dirname12, isAbsolute as isAbsolute5, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { hostname } from "os";
@@ -4830,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.58";
+var VERSION2 = "0.1.60";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -6099,10 +6098,11 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
+    throw new Error("direct enrolment credential and state paths must be supplied together");
+  }
+  const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
   const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
@@ -6230,7 +6230,12 @@ function planProvision(options) {
       ] : [],
       ...enrolmentEnabled ? [
         step("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        ...enrolTokenSourcePath ? [step("encrypted one-time enrolment capability", {
+          kind: "ensure-enrolment",
+          state: enrolStatePath,
+          source: enrolTokenSourcePath,
+          credential: enrolTokenCredentialPath
+        })] : []
       ] : [],
       ...deploymentEnabled ? [step("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },
@@ -11550,7 +11555,7 @@ function removeSession(api, realm, path = defaultSessionPath()) {
 }
 
 // src/bootstrap.ts
-import { createHash as createHash3, createHmac, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash3, createHmac as createHmac2, randomBytes as randomBytes6 } from "crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync8,
@@ -11761,9 +11766,10 @@ function renderPlatformSharedEnvironment(input) {
 }
 function platformApiCredentialSpecs(options) {
   const optional = [
-    ["bootstrap-smtp-password", options.emailProvider === "smtp"],
-    ["bootstrap-jetemail-api-key", options.emailProvider === "jetemail"],
+    ["fz_smtp.password", options.emailProvider === "smtp"],
+    ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
     ["CF_API_TOKEN", options.cloudflareKv],
+    ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
     ["REALTIME_TICKET_SECRET", options.realtime]
   ];
@@ -11937,7 +11943,7 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { randomBytes as randomBytes6, randomUUID } from "crypto";
+import { createHmac, randomUUID } from "crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
 import { dirname as dirname7, join as join6, resolve as resolve5 } from "path";
 import { isIP as isIP3 } from "net";
@@ -12218,13 +12224,23 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
   }
   return { tunnel, connectorToken, created };
 }
+async function retrieveCloudflareConnectorTokens(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId) || !/^[0-9a-f-]{36}$/i.test(config.tunnelId) || config.meshConnectorId && !/^[0-9a-f-]{36}$/i.test(config.meshConnectorId)) {
+    throw new Error("Cloudflare connector retrieval coordinates are invalid");
+  }
+  const connectorToken = await cf(config, `/accounts/${config.accountId}/cfd_tunnel/${encodeURIComponent(config.tunnelId)}/token`, {}, fetcher);
+  const meshConnectorToken = config.meshConnectorId ? await cf(config, `/accounts/${config.accountId}/warp_connector/${encodeURIComponent(config.meshConnectorId)}/token`, {}, fetcher) : undefined;
+  for (const value of [connectorToken, meshConnectorToken]) {
+    if (value !== undefined && (!value || value.length > 16384))
+      throw new Error("Cloudflare returned an invalid connector token");
+  }
+  return { connectorToken, ...meshConnectorToken ? { meshConnectorToken } : {} };
+}
 
 // src/cloudflare-bootstrap.ts
 var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
-var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
-var REALTIME_SECRET = /^[A-Za-z0-9_-]{64,128}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -12258,26 +12274,17 @@ async function readOwnerOnlyFile(path, maximumBytes) {
     await handle?.close();
   }
 }
-async function readOwnerApiToken(path) {
-  const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!TOKEN.test(token))
-    throw new Error(`${resolve5(path)} must contain exactly one Cloudflare API token`);
-  return token;
-}
-async function readCloudflareBootstrapTokens(files) {
-  const unsupported = Object.keys(files).filter((key) => ![
-    "tunnelTokenFile",
-    "apiTokenFile"
-  ].includes(key));
+function validateCloudflareBootstrapTokens(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Cloudflare bootstrap tokens must be an object");
+  const source = input;
+  const unsupported = Object.keys(source).filter((key) => !["tunnelToken", "apiToken"].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap token files contain unsupported field ${unsupported[0]}`);
-  if (!files.tunnelTokenFile?.trim() || !files.apiTokenFile?.trim()) {
-    throw new Error("Cloudflare bootstrap requires exactly tunnelTokenFile and apiTokenFile");
-  }
-  const [tunnelToken, apiToken] = await Promise.all([
-    readOwnerApiToken(files.tunnelTokenFile),
-    readOwnerApiToken(files.apiTokenFile)
-  ]);
+    throw new Error(`Cloudflare bootstrap tokens contain unsupported field ${unsupported[0]}`);
+  const tunnelToken = typeof source.tunnelToken === "string" ? source.tunnelToken.trim() : "";
+  const apiToken = typeof source.apiToken === "string" ? source.apiToken.trim() : "";
+  if (!TOKEN.test(tunnelToken) || !TOKEN.test(apiToken))
+    throw new Error("Cloudflare bootstrap requires two valid API tokens");
   if (tunnelToken === apiToken) {
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege tokens");
   }
@@ -12453,7 +12460,7 @@ function planCloudflareBootstrap(input, outputPath) {
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-plan",
-    mode: "attended-token-file",
+    mode: "attended-hidden-input",
     outputFile: resolve5(outputPath),
     coordinates,
     operations: [
@@ -12461,19 +12468,19 @@ function planCloudflareBootstrap(input, outputPath) {
       ...coordinates.realtime ? [
         "prove the existing Worker owns a Durable Object namespace and install its publish/ticket secrets with CF_API_TOKEN"
       ] : [],
-      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint only its non-secret id",
       ...coordinates.nodes.some(({ mesh }) => mesh) ? [
-        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint its registration token",
+        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint only its non-secret id",
         "reconcile every unique private CIDR to its Mesh connector and include all declared CIDRs in the dedicated Mesh device profile"
       ] : [],
       "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
       "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
-      "write one node-specific handoff containing the connector token and owner-supplied KV/Worker runtime token"
+      "write one secret-free node handoff containing only bound Cloudflare ids and public coordinates"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never placed in argv or stdout",
-      "CF_TUNNEL_TOKEN is never persisted; cloudflared, Mesh, CF_API_TOKEN and generated realtime capabilities are atomically checkpointed with mode 0600",
-      "the normal API process receives only CF_API_TOKEN and never Tunnel, DNS or Mesh management authority"
+      "API tokens are accepted only from a hidden prompt and are never placed in JSON, files, argv or stdout",
+      "checkpoint and host handoffs contain no connector, management, runtime or realtime secret",
+      "the target Agent retrieves its connector tokens and seals both Vault fallback tokens directly"
     ]
   };
 }
@@ -12538,25 +12545,15 @@ async function readExistingOutput(path) {
   const resources = output.resources;
   const unsupportedResource = Object.keys(resources).filter((key) => ![
     "kvNamespaceId",
-    "apiToken",
-    "realtime",
     "nodes"
   ].includes(key));
   if (unsupportedResource.length) {
     throw new Error(`${resolve5(path)} resources contain unsupported field ${unsupportedResource[0]}`);
   }
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
-  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !TOKEN.test(String(resources.apiToken ?? "")) || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
+  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
     throw new Error(`${resolve5(path)} has malformed Cloudflare bootstrap resources`);
   }
-  if (coordinates.realtime) {
-    const realtime = resources.realtime;
-    if (!realtime || !REALTIME_SECRET.test(String(realtime.publishSecret ?? "")) || !REALTIME_SECRET.test(String(realtime.ticketSecret ?? "")) || realtime.publishSecret === realtime.ticketSecret) {
-      throw new Error(`${resolve5(path)} has malformed Cloudflare realtime resources`);
-    }
-  } else if (resources.realtime !== undefined) {
-    throw new Error(`${resolve5(path)} contains undeclared Cloudflare realtime resources`);
-  }
   const seen = new Set;
   for (const item of resources.nodes) {
     if (!item || typeof item !== "object" || Array.isArray(item)) {
@@ -12569,16 +12566,15 @@ async function readExistingOutput(path) {
       "service",
       "tunnelName",
       "tunnelId",
-      "connectorToken",
       "mesh"
     ].includes(key));
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
-    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? "")) || !CONNECTOR_TOKEN.test(String(node.connectorToken ?? ""))) {
+    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? ""))) {
       throw new Error(`${resolve5(path)} has a malformed or unbound Cloudflare node resource`);
     }
     if (expected.mesh) {
       const mesh = node.mesh;
-      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? "")) || !CONNECTOR_TOKEN.test(String(mesh.connectorToken ?? ""))) {
+      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? ""))) {
         throw new Error(`${resolve5(path)} has a malformed or unbound Cloudflare Mesh resource`);
       }
     } else if (node.mesh !== undefined) {
@@ -12622,11 +12618,9 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     "hostname",
     "service",
     "tunnelId",
-    "connectorToken",
     "accountId",
     "zoneId",
     "kvNamespaceId",
-    "apiToken",
     "mesh",
     "realtime"
   ].includes(key));
@@ -12637,11 +12631,11 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   try {
     service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.apiToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
   if (output.mesh !== undefined) {
-    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !CONNECTOR_TOKEN.test(output.mesh.connectorToken) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
+    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
       try {
         return privateMeshCidr(route) !== route;
       } catch {
@@ -12670,7 +12664,7 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     } catch {
       throw new Error("Cloudflare host handoff contains malformed realtime coordinates");
     }
-    if (!REALTIME_SECRET.test(output.realtime.publishSecret) || !REALTIME_SECRET.test(output.realtime.ticketSecret) || output.realtime.publishSecret === output.realtime.ticketSecret || realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
+    if (realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
       throw new Error("Cloudflare host handoff contains malformed realtime credentials");
     }
   }
@@ -12735,18 +12729,12 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       hostname: node.hostname,
       service: node.service,
       tunnelId: node.tunnelId,
-      connectorToken: node.connectorToken,
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      apiToken: output.resources.apiToken,
-      ...output.coordinates.realtime && output.resources.realtime ? { realtime: {
-        ...output.coordinates.realtime,
-        ...output.resources.realtime
-      } } : {},
+      ...output.coordinates.realtime ? { realtime: output.coordinates.realtime } : {},
       ...node.mesh ? { mesh: {
         connectorId: node.mesh.connectorId,
-        connectorToken: node.mesh.connectorToken,
         routes: node.mesh.routes
       } } : {}
     };
@@ -12754,7 +12742,10 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
   }
 }
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-var newRealtimeSecret = () => randomBytes6(48).toString("base64url");
+var deriveCloudflareRealtimeSecrets = (apiToken) => ({
+  publishSecret: createHmac("sha512", apiToken).update("forgezero/realtime/publish/v1").digest("base64url"),
+  ticketSecret: createHmac("sha512", apiToken).update("forgezero/realtime/ticket/v1").digest("base64url")
+});
 async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve5(outputPath);
@@ -12772,10 +12763,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege capabilities");
   }
   await preflightCloudflareKvRuntime(coordinates, apiToken, fetcher);
-  const realtime = coordinates.realtime ? existing?.resources.realtime ?? {
-    publishSecret: newRealtimeSecret(),
-    ticketSecret: newRealtimeSecret()
-  } : undefined;
+  const realtime = coordinates.realtime ? deriveCloudflareRealtimeSecrets(apiToken) : undefined;
   if (coordinates.realtime && realtime) {
     await verifyCloudflareWorkerDurableObjects({
       accountId: coordinates.accountId,
@@ -12790,8 +12778,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        realtime,
         nodes: existing?.resources.nodes ?? []
       }
     });
@@ -12810,7 +12796,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     let resource;
     let created = false;
     if (checkpointed) {
-      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId)) {
         throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
       }
       resource = checkpointed;
@@ -12831,15 +12817,13 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         }, fetcher);
         mesh = {
           ...node.mesh,
-          connectorId: ensured.connector.id,
-          connectorToken: ensured.connectorToken
+          connectorId: ensured.connector.id
         };
       }
       const { mesh: _declaredMesh, ...publicNode } = node;
       resource = {
         ...publicNode,
         tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken,
         ...mesh ? { mesh } : {}
       };
     }
@@ -12853,8 +12837,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        ...realtime ? { realtime } : {},
         nodes: [...nodeResources]
       }
     });
@@ -12898,8 +12880,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     coordinates,
     resources: {
       kvNamespaceId: coordinates.kvNamespaceId,
-      apiToken,
-      ...realtime ? { realtime } : {},
       nodes: nodeResources
     },
     created: {
@@ -12921,10 +12901,10 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
-  if (!request.tokenFiles) {
-    throw new Error("Cloudflare apply requires exactly two owner-only token file paths");
+  if (!request.tokens) {
+    throw new Error("Cloudflare apply requires exactly two attended API tokens");
   }
-  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const tokens = validateCloudflareBootstrapTokens(request.tokens);
   const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
@@ -13182,6 +13162,78 @@ var PLATFORM_BOOTSTRAP_PROFILES = [
   "platform-db-api",
   "platform-api"
 ];
+function validateCloudflareBootstrapSecretPair(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Cloudflare credential input must be an object");
+  const source = input;
+  const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : "";
+  const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : "";
+  if (!/^[A-Za-z0-9._-]{40,80}$/.test(cloudflareTunnelToken) || !/^[A-Za-z0-9._-]{40,80}$/.test(cloudflareApiToken) || cloudflareTunnelToken === cloudflareApiToken) {
+    throw new Error("Cloudflare bootstrap credentials must be distinct valid API tokens");
+  }
+  return { cloudflareTunnelToken, cloudflareApiToken };
+}
+function validateEnrolledComputeBootstrapSecrets(config, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("compute activation credential input must be an object");
+  const source = input;
+  const allowed = ["enrolmentToken", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`compute activation credential input contains unsupported field ${unknown[0]}`);
+  const enrolmentToken = typeof source.enrolmentToken === "string" ? source.enrolmentToken.trim() : "";
+  if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolmentToken))
+    throw new Error("compute enrolment token is malformed");
+  const cloudflareConfigured = Boolean(config.cloudflareHandoff);
+  if (cloudflareConfigured !== Boolean(source.cloudflareTunnelToken && source.cloudflareApiToken)) {
+    throw new Error("Cloudflare compute activation requires CF_TUNNEL_TOKEN and CF_API_TOKEN together");
+  }
+  return {
+    enrolmentToken,
+    ...cloudflareConfigured ? validateCloudflareBootstrapSecretPair(source) : {}
+  };
+}
+function validatePlatformBootstrapSecrets(config, input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("bootstrap credential input must be an object");
+  const source = input;
+  const allowed = ["clusterBootstrapCode", "emailSecret", "enrolmentToken", "backupS3Secret", "cloudflareTunnelToken", "cloudflareApiToken"];
+  const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`bootstrap credential input contains unsupported field ${unknown[0]}`);
+  const clusterBootstrapCode = typeof source.clusterBootstrapCode === "string" ? source.clusterBootstrapCode.trim() : "";
+  const emailSecret = typeof source.emailSecret === "string" ? source.emailSecret.trim() : "";
+  const enrolmentToken = typeof source.enrolmentToken === "string" ? source.enrolmentToken.trim() : undefined;
+  const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
+  const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
+  const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
+  if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
+    throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
+  if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
+    throw new Error("bootstrap email credential is malformed");
+  if (config.enrolment.source === "api-token" !== Boolean(enrolmentToken) || enrolmentToken && !/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolmentToken)) {
+    throw new Error("platform enrolment source and attended token disagree");
+  }
+  if (Boolean(config.runtime.environment.backup) !== Boolean(backupS3Secret)) {
+    throw new Error("backup configuration and its attended credential must be supplied together");
+  }
+  if (backupS3Secret && (backupS3Secret.length > 16384 || /[\r\n\0]/.test(backupS3Secret))) {
+    throw new Error("backup credential is malformed");
+  }
+  const cloudflareConfigured = Boolean(config.cloudflareHandoff || config.runtime.environment.cloudflare);
+  if (cloudflareConfigured !== Boolean(cloudflareTunnelToken && cloudflareApiToken)) {
+    throw new Error("Cloudflare configuration requires attended CF_TUNNEL_TOKEN and CF_API_TOKEN together");
+  }
+  if (cloudflareTunnelToken)
+    validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
+  return {
+    clusterBootstrapCode,
+    emailSecret,
+    ...enrolmentToken ? { enrolmentToken } : {},
+    ...backupS3Secret ? { backupS3Secret } : {},
+    ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {}
+  };
+}
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
 function resolveInstalledBootstrapKind(states) {
   if (states.compute && states.metal) {
@@ -13197,6 +13249,7 @@ var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var CF_TUNNEL_API_CREDENTIAL = `${CREDS}/CF_TUNNEL_TOKEN.cred`;
 var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
 var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
 var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
@@ -13205,7 +13258,6 @@ var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
 var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
 var GIT_PUBLIC_KEY = "/etc/forgezero/git/deploy.pub";
-var PLATFORM_ENROL_SOURCE = "/run/forgezero-platform-enrol-token";
 var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
 var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
 var CONTROL_SOCKET = "/run/forgezero/control.sock";
@@ -13283,8 +13335,6 @@ function validateBootstrapConfig(value) {
     if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
       throw new Error("tenant API must be public HTTPS or loopback HTTP");
     }
-    if (!value.enrolTokenFile)
-      throw new Error("enrolled-compute activation requires an enrolment-token file");
     if (value.bootstrapRunner) {
       if (value.bootstrapRunner.sshPrivateKeyFile !== undefined && (!value.bootstrapRunner.sshPrivateKeyFile.startsWith("/") || /[\r\n]/.test(value.bootstrapRunner.sshPrivateKeyFile))) {
         throw new Error("bootstrap runner SSH private-key file must be absolute");
@@ -13328,8 +13378,6 @@ function validateBootstrapConfig(value) {
   if (!/^[a-z0-9](?:[a-z0-9:_-]{0,126}[a-z0-9])?$/.test(value.computeReference)) {
     throw new Error("platform compute reference is malformed");
   }
-  if (!value.database.bootstrapSecretFile)
-    throw new Error("platform bootstrap requires the shared cluster bootstrap-code file");
   const write = value.database.coordinators.map(privateOrigin);
   if (write.length < 1 || write.length > 16 || new Set(write).size !== write.length) {
     throw new Error("database coordinators must contain 1-16 unique private origins");
@@ -13344,12 +13392,6 @@ function validateBootstrapConfig(value) {
   }
   if (runtime.deployProfile !== value.environment)
     throw new Error("runtime deployment profile disagrees with bootstrap environment");
-  if (Boolean(runtime.email) !== Boolean(value.runtime.credentialFiles?.emailSecret)) {
-    throw new Error("Bootstrap email configuration and its owner-only credential file must be supplied together");
-  }
-  if (value.runtime.credentialFiles?.emailSecret && (!value.runtime.credentialFiles.emailSecret.startsWith("/") || /[\r\n]/.test(value.runtime.credentialFiles.emailSecret))) {
-    throw new Error("Bootstrap email credential file must be an absolute single-line path");
-  }
   if (value.database.address !== runtime.databaseAddress || value.database.master !== runtime.databaseMaster) {
     throw new Error("runtime database topology disagrees with bootstrap topology");
   }
@@ -13360,9 +13402,8 @@ function validateBootstrapConfig(value) {
   if (value.firewall.enabled && (value.firewall.privateCidrs.length < 1 || new Set(value.firewall.privateCidrs).size !== value.firewall.privateCidrs.length)) {
     throw new Error("enabled firewall requires unique private cluster CIDRs");
   }
-  if (!["genesis-derived", "api-token"].includes(value.enrolment.source) || value.enrolment.source === "api-token" && !value.enrolment.tokenFile || value.enrolment.source === "genesis-derived" && value.enrolment.tokenFile) {
-    throw new Error("platform enrolment source and token file disagree");
-  }
+  if (!["genesis-derived", "api-token"].includes(value.enrolment.source))
+    throw new Error("platform enrolment source is invalid");
   value.runtime.environment = runtime;
   return value;
 }
@@ -13576,7 +13617,7 @@ async function waitForCloudflaredTunnel(host, expectedTunnelId) {
 var derive = (root, label) => {
   if (!/^[a-f0-9]{64}$/i.test(root))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
-  return createHmac("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
+  return createHmac2("sha256", Buffer.from(root, "hex")).update(label).digest("hex");
 };
 async function seal(host, name, destination2, value) {
   if (host.exists(destination2))
@@ -13866,15 +13907,10 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     problems.push("durable Agent enrolment state is missing");
   return { initialized: problems.length === 0, kind: state.kind, profile: state.profile, services, problems };
 }
-async function applyBootstrap(input, host = localBootstrapHost()) {
+async function applyBootstrap(input, host = localBootstrapHost(), secrets, dependencies = {}) {
   const config = validateBootstrapConfig(structuredClone(input));
   if (host.uid() !== 0)
     throw new Error("fz bootstrap --apply must run as root");
-  if (config.kind === "enrolled-compute") {
-    const token = privateFile(host, config.enrolTokenFile, "tenant enrolment token");
-    if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(token))
-      throw new Error("tenant enrolment token is malformed");
-  }
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
@@ -13932,11 +13968,21 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       throw new Error("bootstrap repair coordinates do not match the installed host identity");
     }
   }
-  const platformPrivate = config.kind === "platform" ? {
-    root: privateFile(host, config.database.bootstrapSecretFile, "database bootstrap secret"),
-    email: config.runtime.credentialFiles?.emailSecret && !host.exists(`${CREDS}/${config.runtime.environment.email?.provider === "jetemail" ? "bootstrap-jetemail-api-key" : "bootstrap-smtp-password"}.cred`) ? privateFile(host, config.runtime.credentialFiles.emailSecret, "bootstrap email credential") : undefined,
-    backup: config.runtime.credentialFiles?.backupS3Secret && !host.exists(`${CREDS}/backup-s3-secret.cred`) ? privateFile(host, config.runtime.credentialFiles.backupS3Secret, "backup S3 credential") : undefined
-  } : undefined;
+  const platformPrivate = config.kind === "platform" ? (() => {
+    if (!secrets)
+      throw new Error("platform apply requires attended credentials on stdin");
+    const checked3 = validatePlatformBootstrapSecrets(config, secrets);
+    return {
+      root: checked3.clusterBootstrapCode,
+      email: checked3.emailSecret,
+      enrolmentToken: checked3.enrolmentToken,
+      backup: checked3.backupS3Secret,
+      cloudflareTunnelToken: checked3.cloudflareTunnelToken,
+      cloudflareApiToken: checked3.cloudflareApiToken
+    };
+  })() : undefined;
+  const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
+  const cloudflarePrivate = cloudflare ? config.kind === "platform" ? { cloudflareTunnelToken: platformPrivate.cloudflareTunnelToken, cloudflareApiToken: platformPrivate.cloudflareApiToken } : validateCloudflareBootstrapSecretPair(enrolledPrivate) : undefined;
   if (config.kind === "enrolled-compute" && config.bootstrapRunner?.sshPrivateKeyFile && !host.exists(BOOTSTRAP_SSH_CREDENTIAL)) {
     privateFile(host, config.bootstrapRunner.sshPrivateKeyFile, "bootstrap runner SSH private key");
   }
@@ -13945,17 +13991,31 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
-  if (cloudflare && !host.exists(CF_API_CREDENTIAL)) {
-    await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflare.apiToken);
+  if (!alreadyEnrolled && !host.exists(ENROL_CREDENTIAL)) {
+    const enrolmentToken = config.kind === "platform" ? config.enrolment.source === "api-token" ? platformPrivate.enrolmentToken : `fze_${derive(derive(platformPrivate.root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}` : enrolledPrivate.enrolmentToken;
+    await seal(host, "enrol-token", ENROL_CREDENTIAL, enrolmentToken);
   }
-  if (cloudflare?.realtime && !host.exists(REALTIME_PUBLISH_CREDENTIAL)) {
-    await seal(host, "REALTIME_PUBLISH_SECRET", REALTIME_PUBLISH_CREDENTIAL, cloudflare.realtime.publishSecret);
+  const connectorCapabilities = cloudflare ? await retrieveCloudflareConnectorTokens({
+    accountId: cloudflare.accountId,
+    tunnelId: cloudflare.tunnelId,
+    ...cloudflare.mesh ? { meshConnectorId: cloudflare.mesh.connectorId } : {},
+    apiToken: cloudflarePrivate.cloudflareTunnelToken
+  }, dependencies.fetcher ?? fetch) : undefined;
+  if (cloudflarePrivate && !host.exists(CF_API_CREDENTIAL)) {
+    await seal(host, "CF_API_TOKEN", CF_API_CREDENTIAL, cloudflarePrivate.cloudflareApiToken);
   }
-  if (cloudflare?.realtime && !host.exists(REALTIME_TICKET_CREDENTIAL)) {
-    await seal(host, "REALTIME_TICKET_SECRET", REALTIME_TICKET_CREDENTIAL, cloudflare.realtime.ticketSecret);
+  if (config.kind === "platform" && platformPrivate.cloudflareTunnelToken && !host.exists(CF_TUNNEL_API_CREDENTIAL)) {
+    await seal(host, "CF_TUNNEL_TOKEN", CF_TUNNEL_API_CREDENTIAL, platformPrivate.cloudflareTunnelToken);
   }
-  if (cloudflare?.mesh && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
-    await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, cloudflare.mesh.connectorToken);
+  const realtimeSecrets = cloudflare?.realtime && cloudflarePrivate ? deriveCloudflareRealtimeSecrets(cloudflarePrivate.cloudflareApiToken) : undefined;
+  if (realtimeSecrets && !host.exists(REALTIME_PUBLISH_CREDENTIAL)) {
+    await seal(host, "REALTIME_PUBLISH_SECRET", REALTIME_PUBLISH_CREDENTIAL, realtimeSecrets.publishSecret);
+  }
+  if (realtimeSecrets && !host.exists(REALTIME_TICKET_CREDENTIAL)) {
+    await seal(host, "REALTIME_TICKET_SECRET", REALTIME_TICKET_CREDENTIAL, realtimeSecrets.ticketSecret);
+  }
+  if (connectorCapabilities?.meshConnectorToken && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
+    await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, connectorCapabilities.meshConnectorToken);
   }
   await host.installAgent(config);
   if (config.kind === "platform" && config.firewall.enabled) {
@@ -13982,22 +14042,15 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     }
     await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
     await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
-    const credentialFiles = config.runtime.credentialFiles ?? {};
-    const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "bootstrap-smtp-password" : config.runtime.environment.email?.provider === "jetemail" ? "bootstrap-jetemail-api-key" : undefined;
-    if (Boolean(config.runtime.environment.email) !== Boolean(credentialFiles.emailSecret)) {
-      throw new Error("Bootstrap email configuration and its owner-only credential file must be supplied together");
-    }
+    const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "backup-s3-secret": platformPrivate.backup
+      "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
         const destination2 = `${CREDS}/${name}.cred`;
         if (!host.exists(destination2)) {
           await seal(host, name, destination2, source);
-          const sourcePath = name === "backup-s3-secret" ? credentialFiles.backupS3Secret : credentialFiles.emailSecret;
-          if (sourcePath)
-            host.remove(sourcePath);
         }
       }
     }
@@ -14067,7 +14120,7 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
-        host.write(invite, `plt_${randomBytes7(24).toString("hex")}
+        host.write(invite, `plt_${randomBytes6(24).toString("hex")}
 `, 384);
         await checked2(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
       }
@@ -14087,13 +14140,6 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
         verifiedAt: new Date().toISOString()
       };
       host.write(DB_MODE_EVIDENCE, `${JSON.stringify(evidence, null, 2)}
-`, 384);
-    }
-    if (!alreadyEnrolled) {
-      const enrolToken = config.enrolment.source === "api-token" ? privateFile(host, config.enrolment.tokenFile, "platform enrolment token") : `fze_${derive(derive(root, "forgezero/cluster/arangodb-jwt/v1"), `forgezero/platform-enrolment/v1/${config.computeReference}`)}`;
-      if (!/^fze_[A-Za-z0-9_-]{32,128}$/.test(enrolToken))
-        throw new Error("platform enrolment token is malformed");
-      host.write(PLATFORM_ENROL_SOURCE, `${enrolToken}
 `, 384);
     }
     await checked2(host, [
@@ -14105,15 +14151,10 @@ async function applyBootstrap(input, host = localBootstrapHost()) {
       "deploy",
       ...config.database.role === "master" ? ["--release-executor"] : []
     ], "initial Agent deployment");
-    if (!alreadyEnrolled) {
-      await host.installAgent(config, PLATFORM_ENROL_SOURCE);
-      if (config.enrolment.source === "api-token")
-        host.remove(config.enrolment.tokenFile);
-    }
   }
   if (config.cloudflareHandoff) {
-    if (!host.exists(TUNNEL_CREDENTIAL) && cloudflare) {
-      await seal(host, "CF_TUNNEL_CONNECTOR_TOKEN", TUNNEL_CREDENTIAL, cloudflare.connectorToken);
+    if (!host.exists(TUNNEL_CREDENTIAL) && connectorCapabilities) {
+      await seal(host, "CF_TUNNEL_CONNECTOR_TOKEN", TUNNEL_CREDENTIAL, connectorCapabilities.connectorToken);
     }
     if (!host.exists(TUNNEL_CREDENTIAL))
       throw new Error("sealed cloudflared connector credential is missing");
@@ -14187,7 +14228,6 @@ function strictBootstrapDocument(value) {
     "installWarp",
     "cloudflareHandoff",
     "realm",
-    "enrolTokenFile",
     "software",
     "deploymentCredentials",
     "bootstrapRunner"
@@ -14196,8 +14236,8 @@ function strictBootstrapDocument(value) {
     exactKeys2(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys2(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
-    exactKeys2(root.database, ["role", "agency", "serverMode", "address", "master", "coordinators", "bootstrapSecretFile"], "database config");
-    exactKeys2(root.enrolment, ["source", "tokenFile"], "platform enrolment config");
+    exactKeys2(root.database, ["role", "agency", "serverMode", "address", "master", "coordinators"], "database config");
+    exactKeys2(root.enrolment, ["source"], "platform enrolment config");
     const runtime = exactKeys2(root.runtime, [
       "environment",
       "serviceUser",
@@ -14205,8 +14245,7 @@ function strictBootstrapDocument(value) {
       "bluePort",
       "greenPort",
       "healthPath",
-      "keepReleases",
-      "credentialFiles"
+      "keepReleases"
     ], "runtime config");
     exactKeys2(runtime.environment, [
       "softwareProfile",
@@ -14244,8 +14283,6 @@ function strictBootstrapDocument(value) {
       "cloudflare",
       "realtime"
     ], "runtime environment");
-    if (runtime.credentialFiles !== undefined)
-      exactKeys2(runtime.credentialFiles, ["emailSecret", "backupS3Secret"], "runtime credential files");
     const environment = runtime.environment;
     if (environment.email !== undefined) {
       const email = exactKeys2(environment.email, ["provider", "host", "port", "user", "from", "eu"], "email config");
@@ -14329,10 +14366,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config, enrolTokenSourcePath) {
+    async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync8("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || existsSync8(ENROL_CREDENTIAL) || existsSync8("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -14375,8 +14412,7 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
-        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
-          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
+        ...hasBinding ? {
           enrolTokenCredentialPath: ENROL_CREDENTIAL,
           enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,
@@ -14399,12 +14435,11 @@ function localBootstrapHost() {
 import { constants as constants2, closeSync, fstatSync, openSync, readFileSync as readFileSync9 } from "fs";
 import { dirname as dirname9, resolve as resolve6 } from "path";
 async function discoverCloudflareBootstrapCommandResources(input, dependencies = {}) {
-  const tokens = await readCloudflareBootstrapTokens(input.tokenFiles);
   return (dependencies.discover ?? discoverCloudflareBootstrapResources)({
     zoneName: input.zoneName,
     kvNamespaceTitle: input.kvNamespaceTitle,
     ...input.workerScriptName ? { workerScriptName: input.workerScriptName } : {},
-    ...tokens
+    ...input.tokens
   }, dependencies.fetcher);
 }
 var exactKeys3 = (value, allowed, label) => {
@@ -14421,20 +14456,11 @@ function createCloudflareBootstrapCommandConfig(input) {
   if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
     throw new Error("Cloudflare bootstrap checkpointPath is required");
   }
-  for (const key of ["tunnelTokenFile", "apiTokenFile"]) {
-    if (typeof input.tokenFiles?.[key] !== "string" || !input.tokenFiles[key].trim()) {
-      throw new Error(`Cloudflare bootstrap tokenFiles.${key} is required and must be a non-empty file path`);
-    }
-  }
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-request",
     checkpointPath: input.checkpointPath.trim(),
-    coordinates: validateCloudflareBootstrapCoordinates(input.coordinates),
-    tokenFiles: {
-      tunnelTokenFile: input.tokenFiles.tunnelTokenFile.trim(),
-      apiTokenFile: input.tokenFiles.apiTokenFile.trim()
-    }
+    coordinates: validateCloudflareBootstrapCoordinates(input.coordinates)
   };
 }
 function readOwnerConfig(path) {
@@ -14462,7 +14488,7 @@ function readOwnerConfig(path) {
 function readCloudflareBootstrapCommandConfig(path, mode) {
   const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
   const baseDirectory = dirname9(resolve6(path));
-  exactKeys3(input, ["format", "kind", "checkpointPath", "coordinates", "tokenFiles"], "Cloudflare bootstrap config");
+  exactKeys3(input, ["format", "kind", "checkpointPath", "coordinates"], "Cloudflare bootstrap config");
   if (input.format !== 1 || input.kind !== "forgezero-cloudflare-bootstrap-request") {
     throw new Error("Cloudflare bootstrap config format/kind is invalid");
   }
@@ -14498,33 +14524,16 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
     }
   }
   const coordinates = validateCloudflareBootstrapCoordinates(coordinateSource);
-  let tokenFiles;
-  if (input.tokenFiles !== undefined) {
-    const source = record2(input.tokenFiles, "Cloudflare bootstrap tokenFiles");
-    const keys = ["tunnelTokenFile", "apiTokenFile"];
-    exactKeys3(source, keys, "Cloudflare bootstrap tokenFiles");
-    for (const key of keys) {
-      if (typeof source[key] !== "string" || !source[key].trim()) {
-        throw new Error(`Cloudflare bootstrap tokenFiles.${key} is required and must be a non-empty file path`);
-      }
-    }
-    tokenFiles = {
-      tunnelTokenFile: resolve6(baseDirectory, source.tunnelTokenFile),
-      apiTokenFile: resolve6(baseDirectory, source.apiTokenFile)
-    };
-  }
-  if (mode === "apply" && !tokenFiles) {
-    throw new Error("Cloudflare apply config requires exactly two owner-only tokenFiles paths");
-  }
   return {
     mode,
     coordinates,
-    checkpointPath: resolve6(baseDirectory, input.checkpointPath),
-    ...tokenFiles ? { tokenFiles } : {}
+    checkpointPath: resolve6(baseDirectory, input.checkpointPath)
   };
 }
-async function runCloudflareBootstrapCommand(configPath, apply, dependencies = {}) {
+async function runCloudflareBootstrapCommand(configPath, apply, tokens, dependencies = {}) {
   const request = readCloudflareBootstrapCommandConfig(configPath, apply ? "apply" : "plan");
+  if (apply)
+    request.tokens = tokens;
   const evidence = await (dependencies.run ?? runAttendedCloudflareBootstrap)(request);
   (dependencies.write ?? ((text3) => process.stdout.write(text3)))(`${JSON.stringify(evidence, null, 2)}
 `);
@@ -14562,7 +14571,7 @@ async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies =
 }
 
 // src/metal-bootstrap.ts
-import { createHash as createHash4, randomBytes as randomBytes8 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes7 } from "crypto";
 import {
   chmodSync as chmodSync4,
   chownSync,
@@ -15298,7 +15307,7 @@ async function applyMetalBootstrap(config, options) {
   atomicWrite2(PROFILE_PATH, `${JSON.stringify(persistedProfile, null, 2)}
 `, 384);
   if (!existsSync9(SEED_CREDENTIAL_PATH)) {
-    const seed = config.agentSeedFile ? readFileSync10(config.agentSeedFile, "utf8").trim() : randomBytes8(32).toString("base64url");
+    const seed = config.agentSeedFile ? readFileSync10(config.agentSeedFile, "utf8").trim() : randomBytes7(32).toString("base64url");
     if (seed.length < 32 || /[\0\r\n]/.test(seed))
       throw new MetalBootstrapError("metal Agent seed is invalid");
     await runChecked(exec, ["/usr/bin/systemd-creds", "encrypt", "--name=metal-agent-seed", "-", SEED_CREDENTIAL_PATH], `${seed}
@@ -15464,7 +15473,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
-import { createHash as createHash5, randomBytes as randomBytes9 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes8 } from "crypto";
 import { lstatSync as lstatSync6, mkdtempSync, readFileSync as readFileSync11, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
@@ -15577,6 +15586,17 @@ function platformCommunityRehearsalClaims(sshPublicKeys) {
     }
   }];
 }
+function platformCommunityRehearsalDeletionClaims(sshPublicKeys) {
+  return platformCommunityRehearsalClaims(sshPublicKeys).map((claim) => ({
+    computeKey: claim.computeKey,
+    claimToken: claim.claimToken,
+    claimExpiresAtTs: claim.claimExpiresAtTs,
+    attempt: claim.attempt,
+    action: "delete",
+    bootstrap: { kind: "platform-genesis" },
+    spec: claim.spec
+  }));
+}
 
 // src/operator-bootstrap.ts
 var REQUEST_LIMIT = 64 * 1024;
@@ -15730,17 +15750,17 @@ function readOperatorMetalBootstrapRequest(path) {
 }
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
-  if (mode === "rehearsal" && request.genesis.environment !== "development") {
+  if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && request.genesis.environment !== "development") {
     throw new Error("the disposable four-node Community rehearsal is development-only");
   }
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
-  const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+  const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
   return {
     kind: "metal-remote",
     mode,
     mutation: mode !== "status",
     target: { address: request.target.address, port: request.target.port, user: request.target.user },
-    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
+    steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup" ? ["verify pinned SSH transport", mode === "rehearsal" ? "send the fixed three-node seed plus ordinary n4 Community rehearsal claim to the constrained Metal helper" : mode === "rehearsal-cleanup" ? "delete the exact disposable dev-fz-n1..n4 guests and their owned disks, units, seed data and inventory" : "send three fixed platform-genesis claims to the constrained Metal helper"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to private staging",
       "stage the strict owner-only metal config and optional seed handoff",
@@ -15752,12 +15772,15 @@ function planOperatorMetalBootstrap(request, mode) {
   };
 }
 var secretSources = (config) => [
-  ["cluster-code", config.database.bootstrapSecretFile],
-  ...config.enrolment.tokenFile ? [["enrol-token", config.enrolment.tokenFile]] : [],
-  ...config.runtime.credentialFiles?.emailSecret ? [["email-secret", config.runtime.credentialFiles.emailSecret]] : [],
-  ...config.runtime.credentialFiles?.backupS3Secret ? [["backup-s3-secret", config.runtime.credentialFiles.backupS3Secret]] : [],
   ...config.cloudflareHandoff ? [["cloudflare-handoff", config.cloudflareHandoff.handoffFile]] : []
 ];
+var attendedSecretNames = (config) => [
+  "cluster-bootstrap-code",
+  config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : "fz_smtp.password",
+  ...config.enrolment.source === "api-token" ? ["enrol-token"] : [],
+  ...config.runtime.environment.backup ? ["backup.s3.secretAccessKey"] : [],
+  ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? ["CF_TUNNEL_TOKEN", "CF_API_TOKEN"] : []
+];
 function planOperatorPlatformBootstrap(request, mode) {
   const config = readBootstrapConfig(request.platformConfigFile);
   if (config.kind !== "platform")
@@ -15779,7 +15802,7 @@ function planOperatorPlatformBootstrap(request, mode) {
       `run typed fz bootstrap platform${mode === "prepare" ? " prepare" : ""} --apply`,
       "remove transient local and remote staging data"
     ],
-    secretInputs: secretSources(config).map(([name]) => name)
+    secretInputs: mode === "apply" ? [...attendedSecretNames(config), ...secretSources(config).map(([name]) => name)] : []
   };
 }
 var defaultExec3 = async (argv2, options = {}) => {
@@ -15896,15 +15919,7 @@ function stageConfig(config, directory) {
     writeFileSync11(local, bytes, { mode: 384, flag: "wx" });
     staged.push(name);
     const remotePath = `${REMOTE_STAGE}/${name}`;
-    if (name === "cluster-code")
-      rewritten.database.bootstrapSecretFile = remotePath;
-    else if (name === "enrol-token")
-      rewritten.enrolment.tokenFile = remotePath;
-    else if (name === "email-secret")
-      rewritten.runtime.credentialFiles.emailSecret = remotePath;
-    else if (name === "backup-s3-secret")
-      rewritten.runtime.credentialFiles.backupS3Secret = remotePath;
-    else if (name === "cloudflare-handoff")
+    if (name === "cloudflare-handoff")
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
   const path = join10(directory, "platform-config.json");
@@ -15988,7 +16003,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
   const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-bootstrap-"));
-  const remoteTemp = `/tmp/forgezero-operator-${randomBytes9(12).toString("hex")}`;
+  const remoteTemp = `/tmp/forgezero-operator-${randomBytes8(12).toString("hex")}`;
   let knownHosts = "";
   try {
     knownHosts = writeKnownHosts(request, directory);
@@ -15999,6 +16014,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const config = readBootstrapConfig(request.platformConfigFile);
     if (config.kind !== "platform")
       throw new Error("operator bootstrap requires a platform config");
+    const secrets = mode === "apply" ? validatePlatformBootstrapSecrets(config, options.secrets) : undefined;
     const staged = stageConfig(config, directory);
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
@@ -16009,8 +16025,11 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform"];
     if (mode === "prepare")
       command.push("prepare");
+    else
+      command.push("credentials-stdin");
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
-    const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap");
+    const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
+` : undefined);
     return { plan, output };
   } finally {
     if (knownHosts) {
@@ -16027,7 +16046,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
   const directory = mkdtempSync(join10(tmpdir(), "forgezero-operator-metal-"));
-  const remoteTemp = `/tmp/forgezero-operator-${randomBytes9(12).toString("hex")}`;
+  const remoteTemp = `/tmp/forgezero-operator-${randomBytes8(12).toString("hex")}`;
   let knownHosts = "";
   try {
     knownHosts = writeKnownHosts(request, directory);
@@ -16035,10 +16054,10 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
       const output2 = await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "status"], "remote metal status");
       return { plan, output: output2 };
     }
-    if (mode === "genesis" || mode === "rehearsal") {
+    if (mode === "genesis" || mode === "rehearsal" || mode === "rehearsal-cleanup") {
       const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
       const outputs = [];
-      const claims = mode === "rehearsal" ? platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
+      const claims = mode === "rehearsal" || mode === "rehearsal-cleanup" ? mode === "rehearsal-cleanup" ? platformCommunityRehearsalDeletionClaims(keys) : platformCommunityRehearsalClaims(keys) : platformGenesisClaims(request.genesis.environment, keys);
       for (const claim of claims) {
         outputs.push(await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/local/bin/fz-agent", "metal-apply", "--claim=-"], `provision ${claim.spec.guestName}`, false, `${JSON.stringify(claim)}
 `));
@@ -16102,8 +16121,7 @@ function platformGenesisBootstrapConfigs(template, nodes) {
       serverMode: "default",
       address: guest.address,
       ...role === "joiner" ? { master } : {},
-      coordinators,
-      bootstrapSecretFile: template.database.bootstrapSecretFile
+      coordinators
     };
     config.enrolment = { source: "genesis-derived" };
     config.installCloudflared = true;
@@ -16985,8 +17003,10 @@ async function cmdStatus(options) {
 async function cmdAgent(options, args) {
   if (args[0] === "activate") {
     try {
-      if (args[1] !== undefined)
-        throw new Error("internal Agent activation accepts no positional arguments");
+      const credentialStdin = args[1] === "credentials-stdin";
+      if (args[1] !== undefined && !credentialStdin || args[2] !== undefined) {
+        throw new Error("internal Agent activation accepts only credentials-stdin");
+      }
       if (!options.bootstrapConfigPath)
         throw new Error("internal Agent activation requires --bootstrap-config");
       const config = readBootstrapConfig(options.bootstrapConfigPath);
@@ -16997,7 +17017,19 @@ async function cmdAgent(options, args) {
         out.line(JSON.stringify(plan2, null, 2));
         return 0;
       }
-      out.line(JSON.stringify(await applyBootstrap(config), null, 2));
+      if (!credentialStdin)
+        throw new Error("internal Agent activation requires credentials-stdin");
+      const body = await Bun.stdin.text();
+      if (body.length < 2 || body.length > 65536)
+        throw new Error("activation credential stdin has an invalid size");
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        throw new Error("activation credential stdin is not valid JSON");
+      }
+      const secrets = validateEnrolledComputeBootstrapSecrets(config, parsed);
+      out.line(JSON.stringify(await applyBootstrap(config, undefined, secrets), null, 2));
       return 0;
     } catch (cause) {
       out.fail(cause instanceof Error ? cause.message : String(cause));
@@ -17008,7 +17040,6 @@ async function cmdAgent(options, args) {
     out.fail("Usage: fz agent install [--apply]");
     return 1;
   }
-  const enrolTokenSourcePath = "/run/forgezero-enrol-token";
   const enrolTokenCredentialPath = "/etc/forgezero/creds/enrol-token.cred";
   const enrolStatePath = "/var/lib/forgezero/enrolment.json";
   const gitCredentialPath = process.env.FZ_GIT_CREDENTIAL_PATH ?? "/etc/forgezero/creds/git-deploy-key.cred";
@@ -17048,7 +17079,6 @@ async function cmdAgent(options, args) {
     telemetryEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT,
     ...options.enrol ? {
       pullDeployments: true,
-      enrolTokenSourcePath,
       enrolTokenCredentialPath,
       enrolStatePath,
       deployRoot: process.env.FZ_DEPLOY_ROOT ?? "/opt/forgezero"
@@ -17086,23 +17116,20 @@ async function cmdAgent(options, args) {
       out.ok(`Wrote ${auxiliary.path}`);
     }
     if (options.enrol) {
-      if (existsSync11(enrolTokenSourcePath)) {
-        const source = statSync2(enrolTokenSourcePath);
-        const token = readFileSync14(enrolTokenSourcePath, "utf8").trim();
-        if (!source.isFile() || (source.mode & 511) !== 384 || source.uid !== 0) {
-          throw new Error("The preloaded enrolment token must be a root-owned 0600 file in /run.");
-        }
-        if (!/^fze_[A-Za-z0-9_-]{40,100}$/.test(token)) {
-          throw new Error("The preloaded enrolment token is malformed.");
-        }
-      } else {
-        const prompt = Bun.spawn(["systemd-ask-password", "--timeout=0", "--echo=no", "ForgeZero one-time enrolment token:"], { stdin: "inherit", stdout: "pipe", stderr: "inherit" });
-        const token = (await new Response(prompt.stdout).text()).trim();
-        if (await prompt.exited !== 0 || !/^fze_[A-Za-z0-9_-]{40,100}$/.test(token)) {
+      if (!existsSync11(enrolStatePath) && !existsSync11(enrolTokenCredentialPath)) {
+        const token = await bootstrapSecret("ForgeZero one-time enrolment token");
+        if (!/^fze_[A-Za-z0-9_-]{40,100}$/.test(token))
           throw new Error("A valid fze_ enrolment token was not provided.");
+        mkdirSync11(dirname12(enrolTokenCredentialPath), { recursive: true, mode: 448 });
+        const sealing = Bun.spawn(["systemd-creds", "encrypt", "--name=enrol-token", "-", enrolTokenCredentialPath], { stdin: "pipe", stdout: "ignore", stderr: "pipe" });
+        if (sealing.stdin && typeof sealing.stdin !== "number") {
+          sealing.stdin.write(`${token}
+`);
+          sealing.stdin.end();
         }
-        writeFileSync12(enrolTokenSourcePath, `${token}
-`, { mode: 384, flag: "wx" });
+        const error = await new Response(sealing.stderr).text();
+        if (await sealing.exited !== 0)
+          throw new Error(`could not seal enrolment credential: ${error.trim()}`);
       }
     }
     const transcript = await applyPlan(plan, localRunner);
@@ -17116,11 +17143,6 @@ async function cmdAgent(options, args) {
     out.line();
     return 0;
   } catch (cause) {
-    if (options.enrol) {
-      try {
-        unlinkSync3(enrolTokenSourcePath);
-      } catch {}
-    }
     out.fail(`Could not write ${plan.unitPath}: ${cause.message}`);
     out.step("Run this as root, or use --json and hand the unit to your provisioner.");
     return 1;
@@ -17141,6 +17163,27 @@ var bootstrapNumber = (question, fallback) => {
     throw new Error(`${question} must be an integer`);
   return value;
 };
+async function bootstrapSecret(question) {
+  if (!process.stdin.isTTY)
+    throw new Error(`${question} requires an interactive terminal`);
+  const prompt = Bun.spawn(["systemd-ask-password", "--timeout=0", "--echo=no", `${question}:`], { stdin: "inherit", stdout: "pipe", stderr: "inherit" });
+  const value = (await new Response(prompt.stdout).text()).trim();
+  if (await prompt.exited !== 0 || !value)
+    throw new Error(`${question} was not provided`);
+  return value;
+}
+async function promptPlatformBootstrapSecrets(config) {
+  return validatePlatformBootstrapSecrets(config, {
+    clusterBootstrapCode: await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
+    emailSecret: await bootstrapSecret(config.runtime.environment.email?.provider === "jetemail" ? "JetEmail API key" : "SMTP password"),
+    ...config.enrolment.source === "api-token" ? { enrolmentToken: await bootstrapSecret("API-issued one-time platform enrolment token") } : {},
+    ...config.runtime.environment.backup ? { backupS3Secret: await bootstrapSecret("Backup S3 secret key") } : {},
+    ...config.cloudflareHandoff || config.runtime.environment.cloudflare ? {
+      cloudflareTunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
+      cloudflareApiToken: await bootstrapSecret("CF_API_TOKEN")
+    } : {}
+  });
+}
 var bootstrapList = (question, fallback) => bootstrapAnswer(question, fallback).split(",").map((value) => value.trim()).filter(Boolean);
 var parseCpuPools = (value) => value.split(";").map((entry) => entry.trim()).filter(Boolean).map((entry) => {
   const [key, cpus, physicalCores, memoryNodes] = entry.split("|").map((field) => field?.trim());
@@ -17211,9 +17254,9 @@ function writeBootstrapConfig(path, config) {
 async function interactiveCloudflareBootstrap() {
   if (!process.stdin.isTTY)
     throw new Error("interactive Cloudflare config generation requires a terminal");
-  const tokenFiles = {
-    tunnelTokenFile: bootstrapAnswer("Owner-only CF_TUNNEL_TOKEN file", "./CF_TUNNEL_TOKEN"),
-    apiTokenFile: bootstrapAnswer("Owner-only CF_API_TOKEN file", "./CF_API_TOKEN")
+  const tokens = {
+    tunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
+    apiToken: await bootstrapSecret("CF_API_TOKEN")
   };
   const zoneName = bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net");
   const kvNamespaceTitle = bootstrapAnswer("Existing Worker-bound KV namespace title");
@@ -17223,7 +17266,7 @@ async function interactiveCloudflareBootstrap() {
     zoneName,
     kvNamespaceTitle,
     ...workerScriptName ? { workerScriptName } : {},
-    tokenFiles
+    tokens
   });
   const nodeCount = bootstrapNumber("Number of public API nodes", "3");
   if (nodeCount < 1 || nodeCount > 32)
@@ -17261,8 +17304,7 @@ async function interactiveCloudflareBootstrap() {
         }
       } : {},
       nodes
-    },
-    tokenFiles
+    }
   });
 }
 function genesisOutputDirectory(path) {
@@ -17277,20 +17319,9 @@ function genesisOutputDirectory(path) {
   }
   return path;
 }
-function ensureGenesisClusterSecret(directory) {
-  const path = `${directory}/cluster-bootstrap.code`;
-  if (!existsSync11(path))
-    writeFileSync12(path, `${randomBytes10(32).toString("hex")}
-`, { mode: 384, flag: "wx" });
-  if (!/^[a-f0-9]{64}$/i.test(readOwnerOnlySecret(path, "cluster bootstrap code"))) {
-    throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
-  }
-  return path;
-}
 function writePlatformGenesisFleet(directory) {
   const output = genesisOutputDirectory(directory);
-  const secret = ensureGenesisClusterSecret(output);
-  const template = interactiveBootstrap("platform", { bootstrapSecretFile: secret });
+  const template = interactiveBootstrap("platform", true);
   const fleet = PLATFORM_GENESIS_FLEETS[template.environment];
   const nodes = fleet.map((guest, index) => index === 0 ? {
     nodeHostname: template.nodeHostname,
@@ -17304,9 +17335,9 @@ function writePlatformGenesisFleet(directory) {
     writeBootstrapConfig(path, config);
     return path;
   });
-  return { secret, configs };
+  return { configs };
 }
-function interactiveBootstrap(kind, genesis) {
+function interactiveBootstrap(kind, genesis = false) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
   const environment = bootstrapAnswer("Environment (production/development)", "production");
@@ -17340,18 +17371,14 @@ function interactiveBootstrap(kind, genesis) {
   const smtpPort = emailProvider === "smtp" ? Number(bootstrapAnswer("SMTP port", "587")) : undefined;
   const smtpUser = emailProvider === "smtp" ? bootstrapAnswer("SMTP user") : undefined;
   const jetemailEu = emailProvider === "jetemail" ? bootstrapAnswer("Use JetEmail EU processing? (yes/no)", "no") === "yes" : undefined;
-  const emailSecret = bootstrapAnswer(emailProvider === "smtp" ? "Root-only SMTP password file" : "Root-only JetEmail API-key file");
   const backupEndpoint = bootstrapAnswer("Backup S3 HTTPS endpoint (blank to disable)", "");
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
-  const backupS3Secret = backupEndpoint ? bootstrapAnswer("Root-only backup S3 secret file") : undefined;
   const cloudflareHandoffFile = bootstrapAnswer(genesis ? `${computeReference} node-specific Cloudflare host handoff` : "Node-specific Cloudflare host handoff (blank for no public edge)", genesis ? undefined : "");
   const cloudflareNodeName = cloudflareHandoffFile ? bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
-  const bootstrapSecretFile = genesis?.bootstrapSecretFile ?? bootstrapAnswer("Root-only shared cluster bootstrap-code file");
   const enrolmentSource = genesis ? "genesis-derived" : bootstrapAnswer("Enrolment source (genesis-derived/api-token)", "genesis-derived");
-  const platformEnrolTokenFile = enrolmentSource === "api-token" ? bootstrapAnswer("Root-only API-issued platform enrolment-token file") : undefined;
   return {
     kind,
     environment,
@@ -17368,10 +17395,9 @@ function interactiveBootstrap(kind, genesis) {
       serverMode,
       address,
       master,
-      coordinators,
-      bootstrapSecretFile
+      coordinators
     },
-    enrolment: { source: enrolmentSource, ...platformEnrolTokenFile ? { tokenFile: platformEnrolTokenFile } : {} },
+    enrolment: { source: enrolmentSource },
     runtime: {
       environment: {
         softwareProfile: profile,
@@ -17414,11 +17440,7 @@ function interactiveBootstrap(kind, genesis) {
       bluePort: 3001,
       greenPort: 3002,
       healthPath: "/api/health",
-      keepReleases: 5,
-      credentialFiles: {
-        emailSecret,
-        backupS3Secret
-      }
+      keepReleases: 5
     },
     firewall: {
       enabled: bootstrapAnswer("Enable host firewall? (yes/no)", "yes") === "yes",
@@ -17468,13 +17490,17 @@ async function cmdBootstrap(options, args) {
         out.step("Review the pinned target and secret names, then repeat with --apply to contact the host.");
         return 0;
       }
-      out.line(JSON.stringify(await applyOperatorPlatformBootstrap(request, mode), null, 2));
+      const platformConfig = readBootstrapConfig(request.platformConfigFile);
+      if (platformConfig.kind !== "platform")
+        throw new Error("remote platform bootstrap requires a platform config");
+      const secrets2 = mode === "apply" ? await promptPlatformBootstrapSecrets(platformConfig) : undefined;
+      out.line(JSON.stringify(await applyOperatorPlatformBootstrap(request, mode, { secrets: secrets2 }), null, 2));
       return 0;
     }
     if (operation === "metal" && args[1] === "remote") {
       const mode = args[2];
-      if (!mode || !["apply", "genesis", "rehearsal", "status"].includes(mode) || args[3] !== undefined) {
-        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|status> --bootstrap-config <owner-only-request.json> [--apply]");
+      if (!mode || !["apply", "genesis", "rehearsal", "rehearsal-cleanup", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status> --bootstrap-config <owner-only-request.json> [--apply]");
       }
       if (!options.bootstrapConfigPath)
         throw new Error("remote metal bootstrap requires --bootstrap-config");
@@ -17509,7 +17535,7 @@ async function cmdBootstrap(options, args) {
             steps: [
               "probe every declared public node",
               "write secret-free acceptance evidence",
-              "remove the capability-bearing checkpoint and node handoffs"
+              "remove the completed non-secret checkpoint and node handoffs"
             ]
           }, null, 2));
           out.step("Review the evidence destination, then repeat with --apply to finalize and remove bootstrap capabilities.");
@@ -17520,7 +17546,11 @@ async function cmdBootstrap(options, args) {
       }
       if (args[2] !== undefined)
         throw new Error("Cloudflare bootstrap operation must be plan/apply, verify or finalize");
-      await runCloudflareBootstrapCommand(options.bootstrapConfigPath, options.apply);
+      const tokens = options.apply ? {
+        tunnelToken: await bootstrapSecret("CF_TUNNEL_TOKEN"),
+        apiToken: await bootstrapSecret("CF_API_TOKEN")
+      } : undefined;
+      await runCloudflareBootstrapCommand(options.bootstrapConfigPath, options.apply, tokens);
       return 0;
     }
     if (operation === "platform" && args[1] === "prepare") {
@@ -17542,6 +17572,9 @@ async function cmdBootstrap(options, args) {
       out.line(JSON.stringify(await preparePlatformBootstrap(config2), null, 2));
       return 0;
     }
+    const credentialStdin = operation === "platform" && args[1] === "credentials-stdin";
+    if (credentialStdin && args[2] !== undefined)
+      throw new Error("platform credential stdin accepts no additional positional arguments");
     const installedBootstrapKind = () => resolveInstalledBootstrapKind({
       metal: existsSync11(METAL_BOOTSTRAP_STATE_PATH),
       compute: existsSync11(BOOTSTRAP_STATE_PATH)
@@ -17585,7 +17618,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -17602,7 +17635,21 @@ async function cmdBootstrap(options, args) {
       out.step("Review the plan, then repeat with --apply as root.");
       return 0;
     }
-    const result = await applyBootstrap(config);
+    const secrets = config.kind === "platform" && !credentialStdin ? await promptPlatformBootstrapSecrets(config) : undefined;
+    let stdinSecrets = secrets;
+    if (config.kind === "platform" && credentialStdin) {
+      const body = await Bun.stdin.text();
+      if (body.length < 2 || body.length > 65536)
+        throw new Error("bootstrap credential stdin has an invalid size");
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        throw new Error("bootstrap credential stdin is not valid JSON");
+      }
+      stdinSecrets = validatePlatformBootstrapSecrets(config, parsed);
+    }
+    const result = await applyBootstrap(config, undefined, stdinSecrets);
     out.line(JSON.stringify(result, null, 2));
     return 0;
   } catch (cause) {
@@ -18155,15 +18202,15 @@ function usage() {
 	                         strict three-node platform genesis directory; never apply locally
 	 fz bootstrap platform cloudflare
 	                         Plan/apply attended Tunnel and DNS reconciliation
-	                         using supplied management and KV/Worker runtime token files
+	                         using hidden management and KV/Worker runtime token prompts
 	 fz bootstrap platform cloudflare verify
 	                         From the operator laptop, prove every ordinary public
 	                         node /api/health using the 0600 checkpoint
 	 fz bootstrap platform cloudflare finalize
 	                         Persist secret-free public-node acceptance, then remove
-	                         the capability-bearing checkpoint and node handoffs
+	                         the completed non-secret checkpoint and node handoffs
 	 fz bootstrap metal      Plan/install an identity-only physical provisioner
-	 fz bootstrap metal remote <apply|genesis|rehearsal|status>
+	 fz bootstrap metal remote <apply|genesis|rehearsal|rehearsal-cleanup|status>
 	                         Install/bootstrap one pinned blank metal target, then
 	                         provision the exact selected three-node genesis seed
 	 fz bootstrap status     Verify persisted profile and supervised units
@@ -18228,7 +18275,8 @@ function usage() {
     --json                  Machine-readable output
     --apply                 Apply the reviewed operation instead of planning it
 	 --bootstrap-config <p>  Private JSON coordinates for unattended bootstrap;
-	                           secret values remain in separate owner-only files
+	                           secrets come from hidden prompts or authenticated stdin
+	                           and are sealed immediately as systemd credentials
 	 --output <path>         Canonical absolute destination for generated bootstrap config
     --root <path>           Project root for project/deploy commands
     --name <name>           Project or deploy name during init