@forgezero/agent 0.1.61 → 0.1.63

package/dist/operator-bootstrap.js

@@ -1209,19 +1209,175 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
   return evidence;
 }
 
+// src/bootstrap-bundle.ts
+import { createHash, randomBytes } from "crypto";
+import {
+  chmodSync,
+  createReadStream,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname as dirname2, isAbsolute, resolve as resolve2 } from "path";
+var BOOTSTRAP_BUNDLE_FORMAT = 1;
+var BOOTSTRAP_BUNDLE_KIND = "forgezero-api-git-bundle";
+var MAX_BOOTSTRAP_BUNDLE_BYTES = 512 * 1024 * 1024;
+var run = async (argv) => {
+  const child = Bun.spawn([...argv], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, output: `${stdout}${stderr}`.slice(0, 65536) };
+};
+var checked = async (exec, argv, label) => {
+  const result = await exec(argv);
+  if (result.exitCode !== 0)
+    throw new Error(`${label} failed${result.output.trim() ? `: ${result.output.trim()}` : ""}`);
+  return result.output.trim();
+};
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  await new Promise((resolveDone, reject) => {
+    const stream = createReadStream(path);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("error", reject);
+    stream.on("end", resolveDone);
+  });
+  return hash.digest("hex");
+}
+var branchName = (value) => {
+  if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
+    throw new Error("bootstrap bundle branch is malformed");
+  }
+  return value;
+};
+function parseBootstrapBundleManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap bundle manifest must be an object");
+  const source = value;
+  const allowed = ["format", "kind", "branch", "revision", "sha256", "bytes", "createdAt"];
+  const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
+  if (unknown.length)
+    throw new Error(`bootstrap bundle manifest contains unknown field ${unknown[0]}`);
+  if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
+    throw new Error("bootstrap bundle manifest format is unsupported");
+  }
+  branchName(source.branch);
+  if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
+    throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
+  }
+  if (typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256)) {
+    throw new Error("bootstrap bundle digest is malformed");
+  }
+  if (!Number.isSafeInteger(source.bytes) || Number(source.bytes) < 1 || Number(source.bytes) > MAX_BOOTSTRAP_BUNDLE_BYTES) {
+    throw new Error("bootstrap bundle size is outside the supported boundary");
+  }
+  if (typeof source.createdAt !== "string" || Number.isNaN(Date.parse(source.createdAt))) {
+    throw new Error("bootstrap bundle creation time is malformed");
+  }
+  return source;
+}
+function ownerRegularFile(path, maximum, label) {
+  if (!isAbsolute(path) || resolve2(path) !== path || /[\r\n\0]/.test(path)) {
+    throw new Error(`${label} path must be canonical and absolute`);
+  }
+  const value = lstatSync(path);
+  const uid = process.getuid?.() ?? value.uid;
+  if (!value.isFile() || value.isSymbolicLink() || value.uid !== uid || value.nlink !== 1 || (value.mode & 63) !== 0 || value.size < 1 || value.size > maximum) {
+    throw new Error(`${label} must be an owner-only regular file with one link and at most ${maximum} bytes`);
+  }
+}
+async function readBootstrapBundle(bundlePath, manifestPath = `${bundlePath}.json`) {
+  ownerRegularFile(bundlePath, MAX_BOOTSTRAP_BUNDLE_BYTES, "bootstrap bundle");
+  ownerRegularFile(manifestPath, 16 * 1024, "bootstrap bundle manifest");
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch {
+    throw new Error("bootstrap bundle manifest is not valid JSON");
+  }
+  const manifest = parseBootstrapBundleManifest(parsed);
+  const size = lstatSync(bundlePath).size;
+  if (size !== manifest.bytes || await sha256File(bundlePath) !== manifest.sha256) {
+    throw new Error("bootstrap bundle bytes do not match their manifest");
+  }
+  return { bundlePath, manifestPath, manifest };
+}
+async function buildBootstrapBundle(input, exec = run) {
+  const repositoryRoot = resolve2(input.repositoryRoot);
+  const outputPath = resolve2(input.outputPath);
+  const manifestPath = `${outputPath}.json`;
+  const branch = branchName(input.branch);
+  if (!isAbsolute(input.outputPath) || outputPath !== input.outputPath) {
+    throw new Error("bootstrap bundle output must be a canonical absolute path");
+  }
+  if (existsSync(outputPath) || existsSync(manifestPath)) {
+    throw new Error("bootstrap bundle output already exists");
+  }
+  const root = lstatSync(repositoryRoot);
+  if (!root.isDirectory() || root.isSymbolicLink())
+    throw new Error("bootstrap bundle source must be a real directory");
+  mkdirSync(dirname2(outputPath), { recursive: true, mode: 448 });
+  const parent = lstatSync(dirname2(outputPath));
+  const uid = process.getuid?.() ?? parent.uid;
+  if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== uid || (parent.mode & 63) !== 0) {
+    throw new Error("bootstrap bundle output directory must be caller-owned and owner-only");
+  }
+  const dirty = await checked(exec, ["git", "-C", repositoryRoot, "status", "--porcelain=v1", "--untracked-files=no"], "Git worktree check");
+  if (dirty)
+    throw new Error("bootstrap bundle source has tracked changes; commit the reviewed API release first");
+  const revision = (await checked(exec, ["git", "-C", repositoryRoot, "rev-parse", "--verify", `refs/heads/${branch}^{commit}`], "Git branch resolution")).toLowerCase();
+  if (!/^[a-f0-9]{40}$/.test(revision))
+    throw new Error("bootstrap bundle branch did not resolve to one exact commit");
+  const temporary = `${outputPath}.next.${process.pid}.${randomBytes(6).toString("hex")}`;
+  try {
+    await checked(exec, ["git", "-C", repositoryRoot, "bundle", "create", temporary, `refs/heads/${branch}`], "Git bundle creation");
+    chmodSync(temporary, 384);
+    const file = lstatSync(temporary);
+    if (!file.isFile() || file.isSymbolicLink() || file.size < 1 || file.size > MAX_BOOTSTRAP_BUNDLE_BYTES) {
+      throw new Error("created bootstrap bundle is outside the supported boundary");
+    }
+    await checked(exec, ["git", "bundle", "verify", temporary], "Git bundle verification");
+    const manifest = {
+      format: BOOTSTRAP_BUNDLE_FORMAT,
+      kind: BOOTSTRAP_BUNDLE_KIND,
+      branch,
+      revision,
+      sha256: await sha256File(temporary),
+      bytes: file.size,
+      createdAt: new Date().toISOString()
+    };
+    const manifestTemporary = `${manifestPath}.next.${process.pid}.${randomBytes(6).toString("hex")}`;
+    writeFileSync(manifestTemporary, `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384, flag: "wx" });
+    renameSync(temporary, outputPath);
+    renameSync(manifestTemporary, manifestPath);
+    return { bundlePath: outputPath, manifestPath, manifest };
+  } catch (cause) {
+    rmSync(temporary, { force: true });
+    throw cause;
+  }
+}
+
 // src/bootstrap.ts
-import { createHash, createHmac as createHmac2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
 import {
-  chmodSync as chmodSync2,
-  existsSync as existsSync4,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
-  renameSync as renameSync4,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync4
+  chmodSync as chmodSync3,
+  existsSync as existsSync5,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync5,
+  renameSync as renameSync5,
+  rmSync as rmSync5,
+  writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 import { fileURLToPath } from "url";
 
 // src/agent-update-helper.ts
@@ -1240,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.61";
+var VERSION = "0.1.63";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -1255,8 +1411,8 @@ var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
 `;
 
 // src/service-supervisor.ts
-import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "fs";
-import { dirname as dirname2, join as join2, resolve as resolve2, sep } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, realpathSync, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join2, resolve as resolve3, sep } from "path";
 
 // src/definition.ts
 var RESERVED_STEP_ENV = new Set([
@@ -1275,17 +1431,17 @@ var RESERVED_STEP_ENV = new Set([
 // src/service-supervisor.ts
 var defaultHost = {
   write(path, content, mode) {
-    mkdirSync(dirname2(path), { recursive: true, mode: 493 });
+    mkdirSync2(dirname3(path), { recursive: true, mode: 493 });
     const next = `${path}.next`;
-    writeFileSync(next, content, { mode });
-    renameSync(next, path);
+    writeFileSync2(next, content, { mode });
+    renameSync2(next, path);
   },
-  read: (path) => readFileSync(path, "utf8"),
-  exists: existsSync,
-  list: (path) => existsSync(path) ? readdirSync(path) : [],
+  read: (path) => readFileSync2(path, "utf8"),
+  exists: existsSync2,
+  list: (path) => existsSync2(path) ? readdirSync(path) : [],
   realpath: realpathSync,
-  mkdir: (path, mode) => mkdirSync(path, { recursive: true, mode }),
-  remove: (path) => rmSync(path, { force: true }),
+  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  remove: (path) => rmSync2(path, { force: true }),
   async exec(argv) {
     const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: {
       PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
@@ -1315,21 +1471,21 @@ var defaultHost = {
 };
 
 // src/container-supervisor.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve3, sep as sep2 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname4, resolve as resolve4, sep as sep2 } from "path";
 var defaultHost2 = {
   realpath: realpathSync2,
-  exists: existsSync2,
-  read: (path) => readFileSync2(path, "utf8"),
+  exists: existsSync3,
+  read: (path) => readFileSync3(path, "utf8"),
   write(path, content, mode) {
-    mkdirSync2(dirname3(path), { recursive: true, mode: 493 });
+    mkdirSync3(dirname4(path), { recursive: true, mode: 493 });
     const next = `${path}.next`;
-    writeFileSync2(next, content, { mode });
-    renameSync2(next, path);
+    writeFileSync3(next, content, { mode });
+    renameSync3(next, path);
   },
-  remove: (path) => rmSync2(path, { force: true }),
-  list: (path) => existsSync2(path) ? readdirSync2(path) : [],
-  mkdir: (path, mode) => mkdirSync2(path, { recursive: true, mode }),
+  remove: (path) => rmSync3(path, { force: true }),
+  list: (path) => existsSync3(path) ? readdirSync2(path) : [],
+  mkdir: (path, mode) => mkdirSync3(path, { recursive: true, mode }),
   async exec(argv) {
     const child = Bun.spawn([...argv], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
     const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
@@ -1479,7 +1635,11 @@ function agentEgressUnit(options) {
   const user = options.user ?? "forgezero";
   if (!/^[a-z_][a-z0-9_-]{0,30}$/.test(user))
     throw new Error("invalid Agent service user");
-  const deploymentEnabled = Boolean(options.repository || options.pullDeployments);
+  const bootstrapBundleEnabled = Boolean(options.bootstrapBundlePath && options.bootstrapBundleManifestPath);
+  if (Boolean(options.bootstrapBundlePath) !== Boolean(options.bootstrapBundleManifestPath) || bootstrapBundleEnabled && ![options.bootstrapBundlePath, options.bootstrapBundleManifestPath].every((path) => path.startsWith("/") && !/[\r\n\0:]/.test(path))) {
+    throw new Error("bootstrap bundle and manifest must be supplied together as absolute paths");
+  }
+  const deploymentEnabled = Boolean(options.repository || bootstrapBundleEnabled || options.pullDeployments);
   const runnerLoopbackPorts = normalizeEgressTcpPorts(options.runnerLoopbackPorts ?? []);
   const runnerPublicTcpPorts = normalizeEgressTcpPorts(options.runnerPublicTcpPorts ?? DEFAULT_RUNNER_PUBLIC_TCP_PORTS);
   if (deploymentEnabled && runnerPublicTcpPorts.length < 1) {
@@ -1949,6 +2109,8 @@ function agentUnit(options) {
     options.gitPublicKeyPath ? `FZ_GIT_PUBLIC_KEY_FILE=${options.gitPublicKeyPath}` : null,
     options.repository ? `FZ_DEPLOY_REPO=${options.repository}` : null,
     options.branch ? `FZ_DEPLOY_BRANCH=${options.branch}` : null,
+    options.bootstrapBundlePath ? `FZ_BOOTSTRAP_BUNDLE=${options.bootstrapBundlePath}` : null,
+    options.bootstrapBundleManifestPath ? `FZ_BOOTSTRAP_BUNDLE_MANIFEST=${options.bootstrapBundleManifestPath}` : null,
     options.profile ? `FZ_DEPLOY_PROFILE=${options.profile}` : null,
     options.repository && options.branch ? `FZ_DEPLOY_KEY=${options.project ?? "platform"}:${options.environment ?? "production"}` : null,
     deploymentEnabled ? `FZ_DEPLOY_ROOT=${deployRoot}` : null,
@@ -2331,27 +2493,27 @@ function planProvision(options) {
 }
 
 // src/cli/agent-install.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import {
-  chmodSync,
+  chmodSync as chmodSync2,
   copyFileSync,
-  existsSync as existsSync3,
-  lstatSync,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
+  existsSync as existsSync4,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync4,
   realpathSync as realpathSync3,
-  renameSync as renameSync3,
-  rmSync as rmSync3,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
   symlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
-import { dirname as dirname4 } from "path";
-async function readCapabilities(run) {
+import { dirname as dirname5 } from "path";
+async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
   for (const [id, check] of checks) {
     try {
-      const result = await run(check.operation);
+      const result = await run2(check.operation);
       answers[id] = check.satisfied(result.stdout, result.exitCode);
     } catch {
       answers[id] = false;
@@ -2404,52 +2566,52 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync3(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync3(dirname4(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync4(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync4(dirname5(operation.binary), { recursive: true, mode: 493 });
     copyFileSync(operation.source, `${release}/dist/fz-agent.js`);
-    chmodSync(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname4(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync3(gitSshSource))
+    chmodSync2(`${release}/dist/fz-agent.js`, 493);
+    const gitSshSource = `${dirname5(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync4(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync(gitSshSource, `${release}/dist/fz-git-ssh.js`);
-    chmodSync(`${release}/dist/fz-git-ssh.js`, 493);
+    chmodSync2(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync3(pending, { force: true });
+    rmSync4(pending, { force: true });
     symlinkSync(`versions/${operation.version}`, pending);
-    renameSync3(pending, "/opt/forgezero/agent/current");
-    rmSync3(operation.binary, { force: true });
+    renameSync4(pending, "/opt/forgezero/agent/current");
+    rmSync4(operation.binary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync3(gitSshBinary, { force: true });
+    rmSync4(gitSshBinary, { force: true });
     symlinkSync("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync4(operation.credential) && lstatSync2(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    const seed = randomBytes(32).toString("base64url");
+    const seed = randomBytes2(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
     if (result.exitCode === 0)
-      chmodSync(operation.credential, 256);
+      chmodSync2(operation.credential, 256);
     return result;
   }
   if (operation.kind === "ensure-git-identity") {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync3(key, { force: true });
-        rmSync3(publicKey, { force: true });
+      if (!existsSync4(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync4(key, { force: true });
+        rmSync4(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=git-deploy-key", key, operation.credential]);
         if (result.exitCode !== 0)
           return result;
-        chmodSync(operation.credential, 256);
+        chmodSync2(operation.credential, 256);
       }
-      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync3(key)) {
+      if (!existsSync4(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync4(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -2457,30 +2619,30 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync4(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync3(key, { force: true });
-      rmSync3(publicKey, { force: true });
+      rmSync4(key, { force: true });
+      rmSync4(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync3(operation.credential) || lstatSync(operation.credential).size < 1) {
-        rmSync3(key, { force: true });
-        rmSync3(generatedPublicKey, { force: true });
+      if (!existsSync4(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync4(key, { force: true });
+        rmSync4(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync3(operation.source) ? lstatSync(operation.source) : undefined;
+          const source = existsSync4(operation.source) ? lstatSync2(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
           copyFileSync(operation.source, key);
-          chmodSync(key, 384);
+          chmodSync2(key, 384);
         } else {
           result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-bootstrap-runner", "-f", key]);
           if (result.exitCode !== 0)
@@ -2493,48 +2655,48 @@ var runProvisionOperation = async (operation) => {
         result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=bootstrap-ssh-key", key, operation.credential]);
         if (result.exitCode !== 0)
           return result;
-        chmodSync(operation.credential, 256);
+        chmodSync2(operation.credential, 256);
       }
-      if (!existsSync3(operation.publicKey) || lstatSync(operation.publicKey).size < 1) {
-        if (!existsSync3(key)) {
+      if (!existsSync4(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync4(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
-          chmodSync(key, 384);
+          chmodSync2(key, 384);
         }
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync3(dirname4(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync3(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync4(dirname5(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync4(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
-        chmodSync(operation.publicKey, 292);
+        chmodSync2(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync3(operation.source, { force: true });
+        rmSync4(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync3(key, { force: true });
-      rmSync3(generatedPublicKey, { force: true });
+      rmSync4(key, { force: true });
+      rmSync4(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync3(operation.state) && lstatSync(operation.state).size > 0 || existsSync3(operation.credential) && lstatSync(operation.credential).size > 0)
+    if (existsSync4(operation.state) && lstatSync2(operation.state).size > 0 || existsSync4(operation.credential) && lstatSync2(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync3(operation.source))
+    if (!existsSync4(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
-      chmodSync(operation.credential, 256);
-      rmSync3(operation.source, { force: true });
+      chmodSync2(operation.credential, 256);
+      rmSync4(operation.source, { force: true });
     }
     return result;
   }
   if (operation.kind === "wait-socket") {
     for (let attempt = 0;attempt < operation.attempts; attempt += 1) {
       try {
-        if (lstatSync(operation.path).isSocket())
+        if (lstatSync2(operation.path).isSocket())
           return { stdout: "", exitCode: 0 };
       } catch {}
       await Bun.sleep(operation.intervalMs);
@@ -2542,7 +2704,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync3(operation.path) && lstatSync(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync4(operation.path) && lstatSync2(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -2564,25 +2726,25 @@ var runProvisionOperation = async (operation) => {
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync3("/etc/os-release", "utf8");
+    const os = readFileSync4("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync3("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync3("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync3("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync4("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync4("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync4("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync3(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync4(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync3(key, { force: true });
+    rmSync4(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync3("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync4("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -2597,7 +2759,7 @@ async function localRunner(operation) {
   if (capability.kind === "version")
     return fixed(capability.argv);
   try {
-    const metadata = lstatSync(capability.path);
+    const metadata = lstatSync2(capability.path);
     const present = capability.nodeType === "directory" ? metadata.isDirectory() : true;
     return { stdout: present ? `yes
 ` : `no
@@ -2611,10 +2773,10 @@ function planInstall(options) {
   const { capabilities, ...unit } = options;
   return planProvision({ ...unit, mode: modeFor(capabilities) });
 }
-async function applyPlan(plan, run) {
+async function applyPlan(plan, run2) {
   const transcript = [];
   for (const step2 of plan.steps) {
-    const result = await run(step2.operation);
+    const result = await run2(step2.operation);
     transcript.push({ label: step2.label, command: step2.command, exitCode: result.exitCode });
     if (result.exitCode !== 0 && !step2.optional) {
       throw new Error(`${step2.label} failed (exit ${result.exitCode}): ${step2.command}`);
@@ -2708,8 +2870,6 @@ function validatePlatformSharedEnvironment(input) {
     databaseUser: input.databaseUser,
     sharedDirectory: input.sharedDirectory,
     seedSyncEpoch: input.seedSyncEpoch,
-    repository: input.repository,
-    branch: input.branch,
     deployProfile: input.deployProfile
   }))
     safeAtom(name, value);
@@ -2792,8 +2952,6 @@ function renderPlatformSharedEnvironment(input) {
     FZ_AGENT_OTLP_ENDPOINT: value.agentOtlpEndpoint,
     FZ_CUSTODIAN_EMAIL: value.custodianEmail ?? "",
     FZ_PROFILE: value.deployProfile,
-    FZ_REPO: value.repository,
-    FZ_BRANCH: value.branch,
     FZ_EMAIL_PROVIDER: value.email?.provider ?? "",
     FZ_SMTP_HOST: value.email?.provider === "smtp" ? value.email.host : "",
     FZ_SMTP_PORT: value.email?.provider === "smtp" ? String(value.email.port) : "",
@@ -3004,7 +3162,7 @@ var EXTRACT = "/run/forgezero-otelcol-release";
 var BINARY = "/usr/local/lib/forgezero/otelcol/otelcol";
 var CONFIG = "/etc/forgezero/otelcol.yaml";
 var UNIT = `/etc/systemd/system/${FORGEZERO_OTEL_COLLECTOR_UNIT}`;
-var checked = async (host, argv) => {
+var checked2 = async (host, argv) => {
   const result = await host.exec(argv);
   const output = `${result.output ?? result.stdout ?? ""}${result.stderr ?? ""}`;
   if (result.exitCode !== 0)
@@ -3086,7 +3244,7 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   });
   const versionOutput = `${observed.output ?? observed.stdout ?? ""}${observed.stderr ?? ""}`;
   if (observed.exitCode !== 0 || !versionOutput.includes(`otelcol version ${FORGEZERO_OTEL_COLLECTOR_VERSION}`)) {
-    await checked(host, [
+    await checked2(host, [
       "/usr/bin/curl",
       "--fail",
       "--silent",
@@ -3098,19 +3256,19 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
       ARCHIVE,
       `https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v${FORGEZERO_OTEL_COLLECTOR_VERSION}/otelcol_${FORGEZERO_OTEL_COLLECTOR_VERSION}_linux_amd64.tar.gz`
     ]);
-    const digest = (await checked(host, ["/usr/bin/sha256sum", ARCHIVE])).split(/\s+/)[0];
+    const digest = (await checked2(host, ["/usr/bin/sha256sum", ARCHIVE])).split(/\s+/)[0];
     if (digest !== FORGEZERO_OTEL_COLLECTOR_SHA256)
       throw new Error("OTLP collector archive checksum mismatch");
-    await checked(host, ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/otelcol", EXTRACT]);
-    await checked(host, ["/usr/bin/tar", "-xzf", ARCHIVE, "-C", EXTRACT, "otelcol"]);
-    await checked(host, ["/usr/bin/install", "-m", "0755", `${EXTRACT}/otelcol`, BINARY]);
-    await checked(host, ["/usr/bin/rm", "-f", ARCHIVE, `${EXTRACT}/otelcol`]);
+    await checked2(host, ["/usr/bin/install", "-d", "-m", "0755", "/usr/local/lib/forgezero/otelcol", EXTRACT]);
+    await checked2(host, ["/usr/bin/tar", "-xzf", ARCHIVE, "-C", EXTRACT, "otelcol"]);
+    await checked2(host, ["/usr/bin/install", "-m", "0755", `${EXTRACT}/otelcol`, BINARY]);
+    await checked2(host, ["/usr/bin/rm", "-f", ARCHIVE, `${EXTRACT}/otelcol`]);
   }
   if ((await host.exec(["/usr/bin/getent", "group", "forgezero-otel"])).exitCode !== 0) {
-    await checked(host, ["/usr/sbin/groupadd", "--system", "forgezero-otel"]);
+    await checked2(host, ["/usr/sbin/groupadd", "--system", "forgezero-otel"]);
   }
   if ((await host.exec(["/usr/bin/id", "forgezero-otel"])).exitCode !== 0) {
-    await checked(host, [
+    await checked2(host, [
       "/usr/sbin/useradd",
       "--system",
       "--no-create-home",
@@ -3123,8 +3281,8 @@ async function ensureForgeZeroOtelCollector(host, exportEndpoint) {
   }
   host.write(CONFIG, rendered.config, 420);
   host.write(UNIT, rendered.unit, 420);
-  await checked(host, ["/usr/bin/systemctl", "daemon-reload"]);
-  await checked(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
+  await checked2(host, ["/usr/bin/systemctl", "daemon-reload"]);
+  await checked2(host, ["/usr/bin/systemctl", "enable", "--now", FORGEZERO_OTEL_COLLECTOR_UNIT]);
   let ready = false;
   for (let attempt = 0;attempt < 100; attempt += 1) {
     const probe = await host.exec([
@@ -3253,7 +3411,7 @@ var SEED_CREDENTIAL = `${CREDS}/seed-sync-root.cred`;
 var BACKUP_RECOVERY_CREDENTIAL = `${CREDS}/backup-recovery-root.cred`;
 var BOOTSTRAP_SSH_CREDENTIAL = `${CREDS}/bootstrap-ssh-key.cred`;
 var BOOTSTRAP_SSH_PUBLIC_KEY = "/etc/forgezero/bootstrap/runner.pub";
-var GIT_PUBLIC_KEY = "/etc/forgezero/git/deploy.pub";
+var BOOTSTRAP_RELEASE_EVIDENCE = "/var/lib/forgezero/bootstrap-release.json";
 var DB_MODE_EVIDENCE = "/var/lib/forgezero-cluster/server-mode.json";
 var LIFECYCLE_PROFILE = "/etc/forgezero/lifecycle.json";
 var CONTROL_SOCKET = "/run/forgezero/control.sock";
@@ -3326,6 +3484,9 @@ function validateBootstrapConfig(value) {
     throw new Error("Cloudflare Mesh/WARP requires a node-specific Cloudflare handoff");
   }
   if (value.kind === "enrolled-compute") {
+    if (value.gitDeployKey !== undefined && typeof value.gitDeployKey !== "boolean") {
+      throw new Error("gitDeployKey must be boolean");
+    }
     if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(value.realm))
       throw new Error("tenant realm is malformed");
     if (!/^https:\/\//.test(value.apiUrl) && !/^http:\/\/(?:127\.0\.0\.1|localhost)(?::\d+)?$/.test(value.apiUrl)) {
@@ -3351,6 +3512,9 @@ function validateBootstrapConfig(value) {
     throw new Error("unsupported platform software profile");
   if (!["production", "development"].includes(value.environment))
     throw new Error("platform environment must be production or development");
+  if (!value.bootstrapBundle || ![value.bootstrapBundle.bundleFile, value.bootstrapBundle.manifestFile].every((path) => typeof path === "string" && path.startsWith("/") && !/[\r\n\0:]/.test(path))) {
+    throw new Error("platform bootstrap requires absolute bundle and manifest paths");
+  }
   let api;
   try {
     api = new URL(value.apiUrl);
@@ -3383,7 +3547,7 @@ function validateBootstrapConfig(value) {
   if (runtime.otlpCollectorUnit !== FORGEZERO_OTEL_COLLECTOR_UNIT) {
     throw new Error(`platform bootstrap requires ${FORGEZERO_OTEL_COLLECTOR_UNIT}`);
   }
-  if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.repository !== value.repository || runtime.branch !== value.branch || runtime.databaseCoordinators.join(",") !== write.join(",")) {
+  if (runtime.softwareProfile !== value.profile || runtime.databaseRole !== value.database.role || runtime.nodeHostname !== value.nodeHostname || runtime.apiOrigin !== api.origin || runtime.databaseCoordinators.join(",") !== write.join(",")) {
     throw new Error("platform runtime coordinates disagree with immutable bootstrap coordinates");
   }
   if (runtime.deployProfile !== value.environment)
@@ -3413,6 +3577,7 @@ function planBootstrap(input, initialized = false) {
   ] : [
     ...config.firewall.enabled ? [{ id: "ufw", version: "ubuntu-26.04" }] : [],
     { id: "bun", version: "1.3.14" },
+    { id: "git", version: "ubuntu-26.04" },
     { id: "nginx", version: "ubuntu-26.04" },
     ...platformBootstrapRunner(config) ? [{ id: "openssh-client", version: "ubuntu-26.04" }] : [],
     ...config.profile === "platform-api" ? [] : [{ id: "arangodb", version: "3.11.14" }],
@@ -3441,7 +3606,7 @@ function planBootstrap(input, initialized = false) {
     ]
   };
 }
-var checked2 = async (host, argv, label, options) => {
+var checked3 = async (host, argv, label, options) => {
   const result = await host.exec(argv, options);
   if (result.exitCode !== 0)
     throw new Error(`${label} failed: ${result.output.trim()}`);
@@ -3622,6 +3787,37 @@ async function seal(host, name, destination2, value) {
   if (result.exitCode !== 0)
     throw new Error(`could not seal ${name}: ${result.output.trim()}`);
 }
+async function verifyBootstrapBundleOnHost(host, config, verifyGit = false) {
+  const manifestMetadata = host.inspect?.(config.bootstrapBundle.manifestFile);
+  const bundleMetadata = host.inspect?.(config.bootstrapBundle.bundleFile);
+  if (manifestMetadata && (!manifestMetadata.regular || manifestMetadata.symbolic || manifestMetadata.uid !== 0 || manifestMetadata.links !== 1 || (manifestMetadata.mode & 63) !== 0 || manifestMetadata.size > 16 * 1024)) {
+    throw new Error("bootstrap bundle manifest must be a root-owned owner-only regular file");
+  }
+  if (bundleMetadata && (!bundleMetadata.regular || bundleMetadata.symbolic || bundleMetadata.uid !== 0 || bundleMetadata.links !== 1 || (bundleMetadata.mode & 63) !== 0 || bundleMetadata.size < 1 || bundleMetadata.size > 512 * 1024 * 1024)) {
+    throw new Error("bootstrap bundle must be a root-owned owner-only regular file within 512 MiB");
+  }
+  if (!host.exists(config.bootstrapBundle.bundleFile) || !host.exists(config.bootstrapBundle.manifestFile)) {
+    throw new Error("attended bootstrap bundle and manifest are required for release generation one");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(host.read(config.bootstrapBundle.manifestFile));
+  } catch {
+    throw new Error("bootstrap bundle manifest is not valid JSON");
+  }
+  const manifest = parseBootstrapBundleManifest(parsed);
+  const expectedBranch = config.environment === "production" ? "main" : "dev";
+  if (manifest.branch !== expectedBranch || bundleMetadata && bundleMetadata.size !== manifest.bytes) {
+    throw new Error("bootstrap bundle manifest disagrees with the selected platform environment");
+  }
+  const digest = (await checked3(host, ["/usr/bin/sha256sum", config.bootstrapBundle.bundleFile], "bootstrap bundle digest")).trim().split(/\s+/)[0];
+  if (digest !== manifest.sha256)
+    throw new Error("bootstrap bundle digest does not match its manifest");
+  if (verifyGit) {
+    await checked3(host, ["/usr/bin/git", "bundle", "verify", config.bootstrapBundle.bundleFile], "bootstrap Git bundle verification");
+  }
+  return manifest;
+}
 function bootstrapIdentity(config) {
   if (config.kind === "enrolled-compute")
     return {
@@ -3648,8 +3844,7 @@ function bootstrapIdentity(config) {
     computeReference: config.computeReference,
     nodeHostname: config.nodeHostname,
     apiUrl: config.apiUrl,
-    repository: config.repository,
-    branch: config.branch,
+    bootstrapBundle: config.bootstrapBundle,
     deployRoot: config.deployRoot ?? "/opt/forgezero",
     telemetryEndpoint: config.telemetryEndpoint,
     database: {
@@ -3679,7 +3874,7 @@ function bootstrapIdentity(config) {
   };
 }
 function bootstrapIdentityDigest(config) {
-  return createHash("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(bootstrapIdentity(config))).digest("hex");
 }
 function parseStoredState(raw) {
   let value;
@@ -3729,34 +3924,6 @@ function bindBootstrapIntent(host, config) {
   }
   return identityDigest;
 }
-async function preparePlatformBootstrap(input, host = localBootstrapHost()) {
-  const config = validateBootstrapConfig(structuredClone(input));
-  if (config.kind !== "platform")
-    throw new Error("platform preparation requires a platform bootstrap config");
-  if (host.uid() !== 0)
-    throw new Error("fz bootstrap platform prepare --apply must run as root");
-  if (host.exists(STATE_PATH)) {
-    const installed = parseStoredState(host.read(STATE_PATH));
-    if (installed.kind !== "platform" || installed.identityDigest !== bootstrapIdentityDigest(config)) {
-      throw new Error("platform preparation coordinates do not match the installed host identity");
-    }
-  }
-  const identityDigest = bindBootstrapIntent(host, config);
-  await host.installAgent(config);
-  if (!host.exists(GIT_PUBLIC_KEY))
-    throw new Error("Agent installation did not produce its public Git deploy key");
-  const gitPublicKey = host.read(GIT_PUBLIC_KEY).trim();
-  if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(gitPublicKey)) {
-    throw new Error("Agent public Git deploy key is malformed");
-  }
-  return {
-    kind: "platform",
-    prepared: true,
-    identityDigest,
-    gitPublicKey,
-    next: "register this read-only deploy key, then run --apply concurrently on all three genesis Agency members"
-  };
-}
 function stateFor(config, cloudflare, previousCloudflareTunnelId) {
   return `${JSON.stringify({
     format: 2,
@@ -3910,6 +4077,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   let installed;
   if (host.exists(STATE_PATH))
     installed = parseStoredState(host.read(STATE_PATH));
+  const bootstrapManifest = config.kind === "platform" && !host.exists(BOOTSTRAP_RELEASE_EVIDENCE) ? await verifyBootstrapBundleOnHost(host, config) : undefined;
   let cloudflare;
   if (config.cloudflareHandoff) {
     if (host.exists(config.cloudflareHandoff.handoffFile)) {
@@ -3967,14 +4135,14 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   const platformPrivate = config.kind === "platform" ? (() => {
     if (!secrets)
       throw new Error("platform apply requires attended credentials on stdin");
-    const checked3 = validatePlatformBootstrapSecrets(config, secrets);
+    const checked4 = validatePlatformBootstrapSecrets(config, secrets);
     return {
-      root: checked3.clusterBootstrapCode,
-      email: checked3.emailSecret,
-      enrolmentToken: checked3.enrolmentToken,
-      backup: checked3.backupS3Secret,
-      cloudflareTunnelToken: checked3.cloudflareTunnelToken,
-      cloudflareApiToken: checked3.cloudflareApiToken
+      root: checked4.clusterBootstrapCode,
+      email: checked4.emailSecret,
+      enrolmentToken: checked4.enrolmentToken,
+      backup: checked4.backupS3Secret,
+      cloudflareTunnelToken: checked4.cloudflareTunnelToken,
+      cloudflareApiToken: checked4.cloudflareApiToken
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4019,18 +4187,21 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   } else
     await host.ensureSoftware(plan.software);
   if (config.kind === "platform" && config.firewall.enabled) {
-    await checked2(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
-    await checked2(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
-    await checked2(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
+    await checked3(host, ["ufw", "--force", "default", "deny", "incoming"], "firewall inbound policy");
+    await checked3(host, ["ufw", "--force", "default", "allow", "outgoing"], "firewall outbound policy");
+    await checked3(host, ["ufw", "allow", `${config.firewall.sshPort}/tcp`], "firewall SSH rule");
     for (const cidr of config.firewall.privateCidrs) {
       if (config.database.role !== "none")
-        await checked2(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
+        await checked3(host, ["ufw", "allow", "from", cidr, "to", "any", "port", "8528:8539", "proto", "tcp"], "database firewall rule");
       for (const port of [config.runtime.bluePort, config.runtime.greenPort])
-        await checked2(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
+        await checked3(host, ["ufw", "allow", "from", cidr, "to", "any", "port", String(port), "proto", "tcp"], "seed-mesh firewall rule");
     }
-    await checked2(host, ["ufw", "--force", "enable"], "firewall activation");
+    await checked3(host, ["ufw", "--force", "enable"], "firewall activation");
     await host.ensureSoftware(plan.software.filter(({ id }) => id !== "ufw"));
   }
+  if (config.kind === "platform" && bootstrapManifest) {
+    await verifyBootstrapBundleOnHost(host, config, true);
+  }
   if (config.kind === "platform") {
     const root = platformPrivate.root;
     if (!host.exists(JWT_CREDENTIAL)) {
@@ -4085,8 +4256,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       keepReleases: runtime.keepReleases,
       drainDeadlineMs: runtime.environment.drainDeadlineMs
     });
-    await checked2(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
-      await checked2(host, ["id", runtime.serviceUser], "existing API service account");
+    await checked3(host, ["useradd", "--system", "--no-create-home", "--shell", "/usr/sbin/nologin", runtime.serviceUser], "API service account").catch(async () => {
+      await checked3(host, ["id", runtime.serviceUser], "existing API service account");
     });
     host.mkdir(runtime.environment.sharedDirectory, 488);
     host.mkdir(runtime.slotsDirectory, 493);
@@ -4095,7 +4266,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       host.write("/etc/forgezero/capacity.env", `FZ_CONCURRENCY_LIMIT=${runtime.environment.concurrencyLimit}
 `, 420);
     }
-    await checked2(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
+    await checked3(host, ["chown", `root:${runtime.serviceUser}`, runtime.environment.sharedDirectory, envPath], "runtime ownership");
     host.write("/etc/systemd/system/forgezero@.service", units.template, 420);
     host.write("/etc/systemd/system/forgezero@blue.service.d/port.conf", units.dropIns.blue, 420);
     host.write("/etc/systemd/system/forgezero@green.service.d/port.conf", units.dropIns.green, 420);
@@ -4104,30 +4275,30 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     host.write("/etc/forgezero/deploy.env", activation.environment, 420);
     host.write("/etc/forgezero/deploy-activation.json", activation.helper, 384);
     host.write("/etc/sudoers.d/forgezero-runner", activation.sudoers, 288);
-    await checked2(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
+    await checked3(host, ["visudo", "-cf", "/etc/sudoers.d/forgezero-runner"], "activation sudo policy");
     const telemetry = planLocalOtlpProof(runtime.environment.otlpEndpoint, runtime.environment.otlpCollectorUnit);
-    await checked2(host, telemetry.unitCheck.argv, "OTLP collector supervision");
-    const otlpStatus = (await checked2(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
+    await checked3(host, telemetry.unitCheck.argv, "OTLP collector supervision");
+    const otlpStatus = (await checked3(host, [telemetry.receiverCheck.command, ...telemetry.receiverCheck.argv], "OTLP receiver")).trim();
     if (!/^2\d\d$/.test(otlpStatus))
       throw new Error(`OTLP receiver returned HTTP ${otlpStatus || "unknown"}`);
-    await checked2(host, ["nginx", "-t"], "nginx configuration");
-    await checked2(host, ["systemctl", "daemon-reload"], "systemd reload");
-    await checked2(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
+    await checked3(host, ["nginx", "-t"], "nginx configuration");
+    await checked3(host, ["systemctl", "daemon-reload"], "systemd reload");
+    await checked3(host, ["systemctl", "enable", "--now", "nginx.service"], "nginx supervision");
     if (config.database.role === "master") {
       const invite = `${runtime.environment.sharedDirectory}/platform-invite.token`;
       if (!host.exists(invite)) {
-        host.write(invite, `plt_${randomBytes2(24).toString("hex")}
+        host.write(invite, `plt_${randomBytes3(24).toString("hex")}
 `, 384);
-        await checked2(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
+        await checked3(host, ["chown", `${runtime.serviceUser}:${runtime.serviceUser}`, invite], "platform invite ownership");
       }
     }
     if (config.database.role !== "none") {
       host.mkdir("/var/lib/forgezero-cluster", 448);
-      await checked2(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
+      await checked3(host, ["chown", "arangodb:arangodb", "/var/lib/forgezero-cluster"], "database state ownership");
       host.write("/etc/systemd/system/forgezero-db.service", databaseUnit(config), 420);
       host.write("/etc/systemd/system/forgezero-db-verify.service", databaseVerifyUnit(config), 420);
-      await checked2(host, ["systemctl", "daemon-reload"], "database unit reload");
-      await checked2(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
+      await checked3(host, ["systemctl", "daemon-reload"], "database unit reload");
+      await checked3(host, ["systemctl", "enable", "--now", "forgezero-db.service", "forgezero-db-verify.service"], "database supervision");
       const evidence = {
         expectedMode: "default",
         role: "COORDINATOR",
@@ -4138,15 +4309,30 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       host.write(DB_MODE_EVIDENCE, `${JSON.stringify(evidence, null, 2)}
 `, 384);
     }
-    await checked2(host, [
-      "runuser",
-      "-u",
-      "forgezero-agent",
-      "--",
-      "/usr/local/bin/fz-agent",
-      "deploy",
-      ...config.database.role === "master" ? ["--release-executor"] : []
-    ], "initial Agent deployment");
+    if (bootstrapManifest) {
+      await checked3(host, [
+        "runuser",
+        "-u",
+        "forgezero-agent",
+        "--",
+        "/usr/local/bin/fz-agent",
+        "deploy",
+        `--revision=${bootstrapManifest.revision}`,
+        ...config.database.role === "master" ? ["--release-executor"] : []
+      ], "initial Agent deployment");
+      host.write(BOOTSTRAP_RELEASE_EVIDENCE, `${JSON.stringify({
+        format: 1,
+        kind: "forgezero-bootstrap-release",
+        revision: bootstrapManifest.revision,
+        sha256: bootstrapManifest.sha256,
+        branch: bootstrapManifest.branch,
+        deployedAt: new Date().toISOString()
+      }, null, 2)}
+`, 384);
+      host.remove(config.bootstrapBundle.bundleFile);
+      host.remove(config.bootstrapBundle.manifestFile);
+      await host.installAgent(config);
+    }
   }
   if (config.cloudflareHandoff) {
     if (!host.exists(TUNNEL_CREDENTIAL) && connectorCapabilities) {
@@ -4155,8 +4341,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     if (!host.exists(TUNNEL_CREDENTIAL))
       throw new Error("sealed cloudflared connector credential is missing");
     host.write("/etc/systemd/system/cloudflared.service", tunnelUnit(), 420);
-    await checked2(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
-    await checked2(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
+    await checked3(host, ["systemctl", "daemon-reload"], "cloudflared unit reload");
+    await checked3(host, ["systemctl", "enable", "--now", "cloudflared.service"], "cloudflared connector supervision");
     const tunnelId = cloudflare?.tunnelId ?? installed?.cloudflareTunnelId ?? (config.kind === "platform" ? config.runtime.environment.cloudflare?.tunnelId : undefined);
     if (!tunnelId)
       throw new Error("Cloudflare tunnel identity is missing after handoff validation");
@@ -4166,8 +4352,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     if (!host.exists(WARP_CONNECTOR_CREDENTIAL))
       throw new Error("sealed Cloudflare Mesh connector credential is missing");
     host.write("/etc/systemd/system/forgezero-mesh-config.service", meshConnectorUnit(), 420);
-    await checked2(host, ["systemctl", "daemon-reload"], "Cloudflare Mesh unit reload");
-    await checked2(host, ["systemctl", "enable", "--now", "warp-svc.service", "forgezero-mesh-config.service"], "Cloudflare Mesh connector supervision");
+    await checked3(host, ["systemctl", "daemon-reload"], "Cloudflare Mesh unit reload");
+    await checked3(host, ["systemctl", "enable", "--now", "warp-svc.service", "forgezero-mesh-config.service"], "Cloudflare Mesh connector supervision");
   }
   host.write(STATE_PATH, stateFor(config, cloudflare, installed?.cloudflareTunnelId), 384);
   const status = await bootstrapStatus(host);
@@ -4212,8 +4398,7 @@ function strictBootstrapDocument(value) {
     "computeReference",
     "nodeHostname",
     "apiUrl",
-    "repository",
-    "branch",
+    "bootstrapBundle",
     "deployRoot",
     "telemetryEndpoint",
     "database",
@@ -4226,9 +4411,11 @@ function strictBootstrapDocument(value) {
     "realm",
     "software",
     "deploymentCredentials",
+    "gitDeployKey",
     "bootstrapRunner"
   ], "bootstrap config");
   if (root.kind === "platform") {
+    exactKeys(root.bootstrapBundle, ["bundleFile", "manifestFile"], "bootstrap bundle config");
     exactKeys(root.firewall, ["enabled", "sshPort", "privateCidrs"], "firewall config");
     if (root.cloudflareHandoff !== undefined)
       exactKeys(root.cloudflareHandoff, ["handoffFile", "nodeName"], "Cloudflare handoff");
@@ -4270,8 +4457,6 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
-      "repository",
-      "branch",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -4309,11 +4494,11 @@ function strictBootstrapDocument(value) {
   return value;
 }
 function readBootstrapConfig(path) {
-  const metadata = lstatSync2(path);
+  const metadata = lstatSync3(path);
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== (process.getuid?.() ?? metadata.uid) || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size > 64 * 1024) {
     throw new Error("bootstrap config must be an owner-only regular file with one link and at most 64 KiB");
   }
-  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync4(path, "utf8"))));
+  return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync5(path, "utf8"))));
 }
 function localBootstrapHost() {
   const execute = async (argv, options = {}) => {
@@ -4331,19 +4516,19 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync4,
-    read: (path) => readFileSync4(path, "utf8"),
+    exists: existsSync5,
+    read: (path) => readFileSync5(path, "utf8"),
     write(path, content, mode) {
-      mkdirSync4(dirname5(path), { recursive: true, mode: 493 });
+      mkdirSync5(dirname6(path), { recursive: true, mode: 493 });
       const temporary = `${path}.next.${process.pid}`;
-      writeFileSync4(temporary, content, { mode });
-      chmodSync2(temporary, mode);
-      renameSync4(temporary, path);
+      writeFileSync5(temporary, content, { mode });
+      chmodSync3(temporary, mode);
+      renameSync5(temporary, path);
     },
-    mkdir: (path, mode) => mkdirSync4(path, { recursive: true, mode }),
-    remove: (path) => rmSync4(path, { force: true }),
+    mkdir: (path, mode) => mkdirSync5(path, { recursive: true, mode }),
+    remove: (path) => rmSync5(path, { force: true }),
     inspect(path) {
-      const value = lstatSync2(path);
+      const value = lstatSync3(path);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
     },
     exec: execute,
@@ -4365,7 +4550,12 @@ function localBootstrapHost() {
     async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || existsSync4(ENROL_CREDENTIAL) || existsSync4("/var/lib/forgezero/enrolment.json");
+      const hasBinding = existsSync5("/var/lib/forgezero/enrolment.json");
+      const initialBundle = config.kind === "platform" && !existsSync5(BOOTSTRAP_RELEASE_EVIDENCE) ? {
+        path: config.bootstrapBundle.bundleFile,
+        manifestPath: config.bootstrapBundle.manifestFile,
+        manifest: parseBootstrapBundleManifest(JSON.parse(readFileSync5(config.bootstrapBundle.manifestFile, "utf8")))
+      } : undefined;
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -4377,8 +4567,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync4(dirname5(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync4(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync5(dirname6(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync5(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -4386,15 +4576,17 @@ function localBootstrapHost() {
         socketPath: DEFAULT_SOCKET2,
         seedPath: "/var/lib/forgezero/node.seed",
         controlSocketPath: "/run/forgezero/control.sock",
-        repository: config.repository,
-        branch: config.branch,
+        repository: initialBundle?.path ?? (config.kind === "enrolled-compute" ? config.repository : undefined),
+        branch: initialBundle?.manifest.branch ?? (config.kind === "enrolled-compute" ? config.branch : undefined),
+        bootstrapBundlePath: initialBundle?.path,
+        bootstrapBundleManifestPath: initialBundle?.manifestPath,
         profile: config.kind === "platform" ? config.profile : config.profile,
         deployRoot,
         deploymentCredentials: config.deploymentCredentials,
         publicApiUrl: config.apiUrl,
-        gitCredentialPath: "/etc/forgezero/creds/git-deploy-key.cred",
-        gitPublicKeyPath: "/etc/forgezero/git/deploy.pub",
-        generateGitIdentity: true,
+        gitCredentialPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
+        gitPublicKeyPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
+        generateGitIdentity: config.kind === "enrolled-compute" && config.gitDeployKey === true,
         pullDeployments: hasBinding,
         pullMigrations: config.kind === "platform" && hasBinding,
         pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
@@ -4408,9 +4600,11 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
+        ...existsSync5(ENROL_CREDENTIAL) || hasBinding ? {
+          enrolTokenCredentialPath: existsSync5(ENROL_CREDENTIAL) ? ENROL_CREDENTIAL : undefined,
+          enrolStatePath: "/var/lib/forgezero/enrolment.json"
+        } : {},
         ...hasBinding ? {
-          enrolTokenCredentialPath: ENROL_CREDENTIAL,
-          enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,
           project: config.kind === "enrolled-compute" ? config.realm : "platform",
           environment: config.kind === "enrolled-compute" ? undefined : config.environment,
@@ -4418,8 +4612,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync4(dirname5(unit.path), { recursive: true, mode: 493 });
-        writeFileSync4(unit.path, unit.unit, { mode: 420 });
+        mkdirSync5(dirname6(unit.path), { recursive: true, mode: 493 });
+        writeFileSync5(unit.path, unit.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;
@@ -4428,31 +4622,31 @@ function localBootstrapHost() {
 }
 
 // src/metal-bootstrap.ts
-import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
 import {
-  chmodSync as chmodSync3,
+  chmodSync as chmodSync4,
   chownSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync5,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync5,
+  existsSync as existsSync6,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync6,
   realpathSync as realpathSync4,
-  renameSync as renameSync5,
+  renameSync as renameSync6,
   statSync,
   symlinkSync as symlinkSync2,
   unlinkSync,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
-import { dirname as dirname7, isAbsolute as isAbsolute2, join as join5, resolve as resolve4 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute3, join as join5, resolve as resolve5 } from "path";
 import { isIP as isIP5 } from "net";
 
 // src/metal-isolation.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
 import { join as join4 } from "path";
 
 // src/metal-provision.ts
-import { dirname as dirname6, isAbsolute, join as join3 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute2, join as join3 } from "path";
 import { isIP as isIP4 } from "net";
 
 // src/ubuntu.ts
@@ -4501,7 +4695,7 @@ function validateMetalProfile(profile) {
   if (!Number.isInteger(profile.addressStart) || !Number.isInteger(profile.addressEnd) || profile.addressStart < 2 || profile.addressEnd > 254 || profile.addressStart > profile.addressEnd)
     throw new MetalProvisionError("invalid guest address range");
   for (const path of [profile.stateDir, profile.seedDir, profile.unitDir]) {
-    if (!isAbsolute(path))
+    if (!isAbsolute2(path))
       throw new MetalProvisionError("metal paths must be absolute");
   }
   new URL(profile.apiUrl);
@@ -4609,14 +4803,14 @@ var defaultExec = async (argv) => {
   ]);
   return { exitCode, stdout, stderr };
 };
-var checked3 = async (exec, argv) => {
+var checked4 = async (exec, argv) => {
   const result = await exec(argv);
   if (result.exitCode !== 0)
     throw new Error(`${argv[0]} failed: ${(result.stderr || result.stdout).trim()}`);
   return result;
 };
 var requireGuestsInSlice = async (exec) => {
-  const active = await checked3(exec, [
+  const active = await checked4(exec, [
     "systemctl",
     "list-units",
     "--type=service",
@@ -4630,7 +4824,7 @@ var requireGuestsInSlice = async (exec) => {
     const service = line.trim().split(/\s+/)[0];
     if (!service)
       continue;
-    const cgroup = await checked3(exec, ["systemctl", "show", "-p", "ControlGroup", "--value", service]);
+    const cgroup = await checked4(exec, ["systemctl", "show", "-p", "ControlGroup", "--value", service]);
     if (!cgroup.stdout.trim().includes("/forgezero-guests.slice/")) {
       throw new Error(`${service} must be drained and restarted into forgezero-guests.slice`);
     }
@@ -4640,23 +4834,23 @@ async function applyMetalIsolation(profile, exec = defaultExec) {
   validateMetalProfile(profile);
   await requireGuestsInSlice(exec);
   const unitDir = profile.unitDir;
-  mkdirSync5(unitDir, { recursive: true });
-  writeFileSync5(join4(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
+  mkdirSync6(unitDir, { recursive: true });
+  writeFileSync6(join4(unitDir, "forgezero-guests.slice"), metalGuestSliceUnit(profile), { mode: 420 });
   for (const unit of ["system.slice", "user.slice"]) {
     const directory = join4(unitDir, `${unit}.d`);
-    mkdirSync5(directory, { recursive: true });
-    writeFileSync5(join4(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
+    mkdirSync6(directory, { recursive: true });
+    writeFileSync6(join4(directory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "slice"), { mode: 420 });
   }
   const initDirectory = join4(unitDir, "init.scope.d");
-  mkdirSync5(initDirectory, { recursive: true });
-  writeFileSync5(join4(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
-  await checked3(exec, ["systemctl", "daemon-reload"]);
+  mkdirSync6(initDirectory, { recursive: true });
+  writeFileSync6(join4(initDirectory, "50-forgezero-housekeeping.conf"), metalHousekeepingDropIn(profile, "scope"), { mode: 420 });
+  await checked4(exec, ["systemctl", "daemon-reload"]);
   await requireGuestsInSlice(exec);
   const properties = [`AllowedCPUs=${profile.housekeepingCpus}`];
   if (profile.housekeepingMemoryNodes)
     properties.push(`AllowedMemoryNodes=${profile.housekeepingMemoryNodes}`);
   for (const unit of ["system.slice", "user.slice", "init.scope"]) {
-    await checked3(exec, ["systemctl", "set-property", "--runtime", unit, ...properties]);
+    await checked4(exec, ["systemctl", "set-property", "--runtime", unit, ...properties]);
   }
 }
 
@@ -4768,7 +4962,7 @@ function validateMetalBootstrapConfig(config) {
     throw new MetalBootstrapError("metal bootstrap uses fixed state, seed, and systemd unit directories");
   }
   const image = config.profile.images[Object.keys(config.profile.images)[0]];
-  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve4(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
+  if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve5(image.path) !== image.path || /[\0\r\n]/.test(image.path)) {
     throw new MetalBootstrapError("the pinned guest image must use the fixed image directory");
   }
   if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION) {
@@ -4803,10 +4997,10 @@ function validateMetalBootstrapConfig(config) {
   return config;
 }
 function validateOwnerOnlyPath(path, requireRootOwner) {
-  if (!isAbsolute2(path) || resolve4(path) !== path || path.includes("/../")) {
+  if (!isAbsolute3(path) || resolve5(path) !== path || path.includes("/../")) {
     throw new MetalBootstrapError("private bootstrap paths must be canonical absolute paths");
   }
-  const metadata = lstatSync3(path);
+  const metadata = lstatSync4(path);
   if (!metadata.isFile() || metadata.isSymbolicLink() || realpathSync4(path) !== path) {
     throw new MetalBootstrapError("private bootstrap path must be a regular non-symlink file");
   }
@@ -4824,7 +5018,7 @@ function readMetalBootstrapConfig(path) {
     throw new MetalBootstrapError("metal bootstrap config size is invalid");
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
   }
@@ -4857,15 +5051,15 @@ function planMetalBootstrap(config) {
   };
 }
 var atomicWrite = (path, body, mode) => {
-  mkdirSync6(dirname7(path), { recursive: true, mode: 493 });
+  mkdirSync7(dirname8(path), { recursive: true, mode: 493 });
   const temporary = `${path}.next-${process.pid}`;
-  writeFileSync6(temporary, body, { mode, flag: "wx" });
-  chmodSync3(temporary, mode);
+  writeFileSync7(temporary, body, { mode, flag: "wx" });
+  chmodSync4(temporary, mode);
   chownSync(temporary, 0, 0);
-  renameSync5(temporary, path);
+  renameSync6(temporary, path);
 };
 var validateAgentSourcePath = (source) => {
-  if (!isAbsolute2(source) || !lstatSync3(source).isFile() || lstatSync3(source).isSymbolicLink()) {
+  if (!isAbsolute3(source) || !lstatSync4(source).isFile() || lstatSync4(source).isSymbolicLink()) {
     throw new MetalBootstrapError("published Agent source path must be an absolute regular non-symlink file");
   }
 };
@@ -5029,11 +5223,11 @@ WantedBy=multi-user.target
 var installAgentBinary = (source, version) => {
   validateAgentSourcePath(source);
   const release = `/opt/forgezero/agent/versions/${version}/dist`;
-  mkdirSync6(release, { recursive: true, mode: 493 });
+  mkdirSync7(release, { recursive: true, mode: 493 });
   copyFileSync2(source, join5(release, "fz-agent.js"));
-  chmodSync3(join5(release, "fz-agent.js"), 493);
+  chmodSync4(join5(release, "fz-agent.js"), 493);
   chownSync(join5(release, "fz-agent.js"), 0, 0);
-  mkdirSync6("/opt/forgezero/agent", { recursive: true, mode: 493 });
+  mkdirSync7("/opt/forgezero/agent", { recursive: true, mode: 493 });
   for (const [link, target] of [
     ["/opt/forgezero/agent/current.next", `versions/${version}`],
     [AGENT_PATH, "/opt/forgezero/agent/current/dist/fz-agent.js"]
@@ -5043,7 +5237,7 @@ var installAgentBinary = (source, version) => {
     } catch {}
     symlinkSync2(target, link);
     if (link.endsWith("current.next"))
-      renameSync5(link, "/opt/forgezero/agent/current");
+      renameSync6(link, "/opt/forgezero/agent/current");
   }
 };
 var preflight = async (config, exec) => {
@@ -5065,10 +5259,10 @@ var preflight = async (config, exec) => {
   ]);
   await runChecked(exec, ["/usr/sbin/vgs", config.profile.volumeGroup]);
   await runChecked(exec, ["/usr/sbin/ip", "link", "show", config.profile.bridge]);
-  if (!existsSync5("/dev/kvm"))
+  if (!existsSync6("/dev/kvm"))
     throw new MetalBootstrapError("/dev/kvm is required");
   if (config.profile.confidential) {
-    if (!existsSync5("/dev/sev"))
+    if (!existsSync6("/dev/sev"))
       throw new MetalBootstrapError("/dev/sev is required by the confidential profile");
     await runChecked(exec, ["/usr/bin/qemu-system-x86_64", "-object", "sev-snp-guest,help"]);
   }
@@ -5080,16 +5274,16 @@ var assertSupportedMetalHost = () => {
   if (process.platform !== "linux" || process.arch !== "x64") {
     throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
   }
-  const release = readFileSync5("/etc/os-release", "utf8");
+  const release = readFileSync6("/etc/os-release", "utf8");
   if (!/^ID=ubuntu$/m.test(release) || !/^VERSION_ID="?26\.04"?$/m.test(release)) {
     throw new MetalBootstrapError("metal bootstrap supports only Ubuntu 26.04 x86_64 hosts");
   }
 };
 var ensurePinnedGuestImage = async (config, exec) => {
   const image = config.profile.images[SUPPORTED_GUEST_IMAGE.key];
-  if (existsSync5(image.path))
+  if (existsSync6(image.path))
     return;
-  mkdirSync6(dirname7(image.path), { recursive: true, mode: 493 });
+  mkdirSync7(dirname8(image.path), { recursive: true, mode: 493 });
   const temporary = `${image.path}.next-${process.pid}`;
   try {
     await runChecked(exec, [
@@ -5106,9 +5300,9 @@ var ensurePinnedGuestImage = async (config, exec) => {
     const digest = (await runChecked(exec, ["/usr/bin/sha256sum", temporary])).stdout.split(/\s+/)[0];
     if (digest !== image.sha256)
       throw new MetalBootstrapError("downloaded guest image digest mismatch");
-    chmodSync3(temporary, 292);
+    chmodSync4(temporary, 292);
     chownSync(temporary, 0, 0);
-    renameSync5(temporary, image.path);
+    renameSync6(temporary, image.path);
   } catch (cause) {
     try {
       unlinkSync(temporary);
@@ -5121,11 +5315,11 @@ async function applyMetalBootstrap(config, options) {
   if ((options.getuid ?? process.getuid)?.() !== 0)
     throw new MetalBootstrapError("fz bootstrap metal --apply must run as root");
   assertSupportedMetalHost();
-  if (existsSync5(STATE_PATH2) && !options.repair)
+  if (existsSync6(STATE_PATH2) && !options.repair)
     throw new MetalBootstrapError("metal host is already initialized; use explicit repair");
   if (config.agentSeedFile)
     validateOwnerOnlyPath(config.agentSeedFile, true);
-  if (config.agentSeedFile && existsSync5(SEED_CREDENTIAL_PATH)) {
+  if (config.agentSeedFile && existsSync6(SEED_CREDENTIAL_PATH)) {
     throw new MetalBootstrapError("repair refuses replacement seed material while the sealed metal identity exists");
   }
   validateAgentSourcePath(options.agentSourcePath);
@@ -5152,9 +5346,9 @@ async function applyMetalBootstrap(config, options) {
   await preflight(config, exec);
   await ensureAccount(exec);
   installAgentBinary(options.agentSourcePath, config.profile.agentVersion);
-  mkdirSync6("/etc/forgezero/creds", { recursive: true, mode: 448 });
-  mkdirSync6(config.profile.stateDir, { recursive: true, mode: 448 });
-  mkdirSync6(config.profile.seedDir, { recursive: true, mode: 448 });
+  mkdirSync7("/etc/forgezero/creds", { recursive: true, mode: 448 });
+  mkdirSync7(config.profile.stateDir, { recursive: true, mode: 448 });
+  mkdirSync7(config.profile.seedDir, { recursive: true, mode: 448 });
   const persistedProfile = {
     ...config.profile,
     metalHostname: config.metalHostname,
@@ -5163,13 +5357,13 @@ async function applyMetalBootstrap(config, options) {
   };
   atomicWrite(PROFILE_PATH, `${JSON.stringify(persistedProfile, null, 2)}
 `, 384);
-  if (!existsSync5(SEED_CREDENTIAL_PATH)) {
-    const seed = config.agentSeedFile ? readFileSync5(config.agentSeedFile, "utf8").trim() : randomBytes3(32).toString("base64url");
+  if (!existsSync6(SEED_CREDENTIAL_PATH)) {
+    const seed = config.agentSeedFile ? readFileSync6(config.agentSeedFile, "utf8").trim() : randomBytes4(32).toString("base64url");
     if (seed.length < 32 || /[\0\r\n]/.test(seed))
       throw new MetalBootstrapError("metal Agent seed is invalid");
     await runChecked(exec, ["/usr/bin/systemd-creds", "encrypt", "--name=metal-agent-seed", "-", SEED_CREDENTIAL_PATH], `${seed}
 `);
-    chmodSync3(SEED_CREDENTIAL_PATH, 256);
+    chmodSync4(SEED_CREDENTIAL_PATH, 256);
     chownSync(SEED_CREDENTIAL_PATH, 0, 0);
     if (config.agentSeedFile)
       unlinkSync(config.agentSeedFile);
@@ -5218,7 +5412,7 @@ async function applyMetalBootstrap(config, options) {
     initializedAt: new Date().toISOString(),
     role: "metal",
     metalHostname: config.metalHostname,
-    profileSha256: createHash2("sha256").update(JSON.stringify(config.profile)).digest("hex")
+    profileSha256: createHash3("sha256").update(JSON.stringify(config.profile)).digest("hex")
   };
   atomicWrite(STATE_PATH2, `${JSON.stringify(state, null, 2)}
 `, 384);
@@ -5226,7 +5420,7 @@ async function applyMetalBootstrap(config, options) {
 }
 var socketReady = (path) => {
   try {
-    return lstatSync3(path).isSocket();
+    return lstatSync4(path).isSocket();
   } catch {
     return false;
   }
@@ -5235,17 +5429,17 @@ async function metalBootstrapStatus(exec = defaultExec2) {
   const problems = [];
   let profileValid = false, imageVerified = false, metalHostname, profileSha256;
   let profileMode = null;
-  if (existsSync5(PROFILE_PATH)) {
+  if (existsSync6(PROFILE_PATH)) {
     try {
       const metadata = statSync(PROFILE_PATH);
       profileMode = metadata.mode & 511;
       if (profileMode !== 384 || metadata.uid !== 0)
         problems.push("metal profile is not root-owned mode 0600");
-      const persisted = JSON.parse(readFileSync5(PROFILE_PATH, "utf8"));
+      const persisted = JSON.parse(readFileSync6(PROFILE_PATH, "utf8"));
       const { metalHostname: profileHostname, hostTelemetryEndpoint, hostTelemetryUnit, ...profile } = persisted;
       validateMetalProfile(profile);
       profileValid = true;
-      profileSha256 = createHash2("sha256").update(JSON.stringify(profile)).digest("hex");
+      profileSha256 = createHash3("sha256").update(JSON.stringify(profile)).digest("hex");
       if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(profileHostname) || hostTelemetryEndpoint !== "http://127.0.0.1:4318") {
         problems.push("persisted metal host coordinates are invalid");
       }
@@ -5274,7 +5468,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
         problems.push("local OTLP metrics receiver did not accept a proof request");
       }
       const image = profile.images[Object.keys(profile.images)[0]];
-      if (existsSync5(image.path)) {
+      if (existsSync6(image.path)) {
         const digest = (await exec(["/usr/bin/sha256sum", image.path])).stdout.split(/\s+/)[0];
         imageVerified = digest === image.sha256;
       }
@@ -5285,9 +5479,9 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     }
   } else
     problems.push("metal profile is missing");
-  if (existsSync5(STATE_PATH2)) {
+  if (existsSync6(STATE_PATH2)) {
     try {
-      const state = JSON.parse(readFileSync5(STATE_PATH2, "utf8"));
+      const state = JSON.parse(readFileSync6(STATE_PATH2, "utf8"));
       metalHostname = state.metalHostname;
       if (state.role !== "metal" || !metalHostname || state.profileSha256 !== profileSha256) {
         problems.push("metal initialized state does not bind the current profile");
@@ -5303,7 +5497,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     "forgezero-metal-agent-egress.service",
     "forgezero-metal-agent.service"
   ]) {
-    if (!existsSync5(join5(UNIT_DIRECTORY, unit)))
+    if (!existsSync6(join5(UNIT_DIRECTORY, unit)))
       units[unit] = "missing";
     else
       units[unit] = (await exec(["/usr/bin/systemctl", "is-active", "--quiet", unit])).exitCode === 0 ? "active" : "inactive";
@@ -5317,7 +5511,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
   return {
-    initialized: existsSync5(STATE_PATH2),
+    initialized: existsSync6(STATE_PATH2),
     profileValid,
     profileMode,
     imageVerified,
@@ -5330,8 +5524,8 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
-import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
-import { lstatSync as lstatSync4, mkdtempSync, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { createHash as createHash4, randomBytes as randomBytes5 } from "crypto";
+import { lstatSync as lstatSync5, mkdtempSync, readFileSync as readFileSync7, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
 import { basename, join as join6 } from "path";
@@ -5472,22 +5666,22 @@ var exactKeys3 = (value, keys, label) => {
 var ownerFile = (path, limit, label) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error(`${label} path must be absolute`);
-  const metadata = lstatSync4(path);
+  const metadata = lstatSync5(path);
   const uid = process.getuid?.() ?? metadata.uid;
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== uid || metadata.nlink !== 1 || (metadata.mode & 63) !== 0 || metadata.size < 1 || metadata.size > limit) {
     throw new Error(`${label} must be an owner-only regular file with one link and at most ${limit} bytes`);
   }
-  return readFileSync6(path);
+  return readFileSync7(path);
 };
 var publicIdentity = (path) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error("SSH public-key path must be absolute");
-  const metadata = lstatSync4(path);
+  const metadata = lstatSync5(path);
   const uid = process.getuid?.() ?? metadata.uid;
   if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.uid !== uid || metadata.nlink !== 1 || metadata.size > 16384) {
     throw new Error("SSH public key must be a caller-owned regular file with one link");
   }
-  const value = readFileSync6(path, "utf8").trim();
+  const value = readFileSync7(path, "utf8").trim();
   if (!/^ssh-(?:ed25519|rsa) [A-Za-z0-9+/]+={0,3}(?: [^\r\n]+)?$/.test(value)) {
     throw new Error("SSH public key is malformed");
   }
@@ -5496,7 +5690,7 @@ var publicIdentity = (path) => {
 var socketPath = (path) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error("SSH agent socket path must be absolute");
-  const metadata = lstatSync4(path);
+  const metadata = lstatSync5(path);
   const uid = process.getuid?.() ?? metadata.uid;
   if (!metadata.isSocket() || metadata.isSymbolicLink() || metadata.uid !== uid) {
     throw new Error("SSH agent socket must be a caller-owned Unix socket");
@@ -5510,7 +5704,7 @@ var fingerprint = (key) => {
   if (!bytes.length || bytes.toString("base64").replace(/=+$/, "") !== encoded.replace(/=+$/, "")) {
     throw new Error("SSH host key is malformed");
   }
-  return `SHA256:${createHash3("sha256").update(bytes).digest("base64").replace(/=+$/, "")}`;
+  return `SHA256:${createHash4("sha256").update(bytes).digest("base64").replace(/=+$/, "")}`;
 };
 var validateHop = (value, label) => {
   const hop = exactKeys3(value, ["address", "port", "user", "hostKey", "hostKeySha256"], label);
@@ -5655,8 +5849,9 @@ function planOperatorPlatformBootstrap(request, mode) {
     steps: mode === "status" ? ["verify pinned SSH transport", "run typed fz bootstrap status"] : [
       "verify pinned SSH transport and caller-approved SSH agent",
       "copy pinned Bun and packaged fz artifacts to a private staging directory",
+      "verify and copy the one immutable API Git bundle plus its manifest",
       "stage the rewritten owner-only platform config and its named credential handoffs",
-      `run typed fz bootstrap platform${mode === "prepare" ? " prepare" : ""} --apply`,
+      "run typed fz bootstrap platform --apply from the local bundle",
       "remove transient local and remote staging data"
     ],
     secretInputs: mode === "apply" ? [...attendedSecretNames(config), ...secretSources(config).map(([name]) => name)] : []
@@ -5685,7 +5880,7 @@ var defaultExec3 = async (argv, options = {}) => {
   ]);
   return { exitCode, output: options.secret ? "" : `${stdout}${stderr}`.slice(0, 65536) };
 };
-var checked4 = async (exec, argv, label, options) => {
+var checked5 = async (exec, argv, label, options) => {
   const result = await exec(argv, options);
   if (result.exitCode !== 0)
     throw new Error(`${label} failed${result.output ? `: ${result.output.trim()}` : ""}`);
@@ -5698,7 +5893,7 @@ function writeKnownHosts(request, directory) {
   if (request.target.jump)
     lines.push(`${hostLabel(request.target.jump.address, request.target.jump.port)} ${request.target.jump.hostKey}`);
   const path = join6(directory, "known_hosts");
-  writeFileSync7(path, `${lines.join(`
+  writeFileSync8(path, `${lines.join(`
 `)}
 `, { mode: 384, flag: "wx" });
   return path;
@@ -5739,7 +5934,7 @@ var safeRemoteArg = (value) => {
 };
 var remote = async (exec, request, knownHosts, argv, label, secret = false, stdin) => {
   argv.forEach(safeRemoteArg);
-  return checked4(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv], label, { secret, stdin });
+  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv], label, { secret, stdin });
 };
 var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   safeRemoteArg(path);
@@ -5760,36 +5955,45 @@ var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
 };
 var copy = async (exec, request, knownHosts, local, remotePath, secret = false) => {
   safeRemoteArg(remotePath);
-  await checked4(exec, [
+  await checked5(exec, [
     "scp",
     ...sshOptions(request, knownHosts, true),
     local,
     `${destination2(request.target)}:${remotePath}`
   ], "secure copy", { secret });
 };
-function stageConfig(config, directory) {
+async function stageConfig(config, directory) {
   const rewritten = structuredClone(config);
   const staged = [];
   for (const [name, source] of secretSources(config)) {
     const bytes = ownerFile(source, SECRET_LIMIT, name);
     const local = join6(directory, name);
-    writeFileSync7(local, bytes, { mode: 384, flag: "wx" });
+    writeFileSync8(local, bytes, { mode: 384, flag: "wx" });
     staged.push(name);
     const remotePath = `${REMOTE_STAGE}/${name}`;
     if (name === "cloudflare-handoff")
       rewritten.cloudflareHandoff.handoffFile = remotePath;
   }
+  const bundle = await readBootstrapBundle(config.bootstrapBundle.bundleFile, config.bootstrapBundle.manifestFile);
+  const bundleFiles = [
+    { source: bundle.bundlePath, name: "bootstrap-api.bundle" },
+    { source: bundle.manifestPath, name: "bootstrap-api.bundle.json" }
+  ];
+  rewritten.bootstrapBundle = {
+    bundleFile: `${REMOTE_STAGE}/bootstrap-api.bundle`,
+    manifestFile: `${REMOTE_STAGE}/bootstrap-api.bundle.json`
+  };
   const path = join6(directory, "platform-config.json");
-  writeFileSync7(path, `${JSON.stringify(rewritten, null, 2)}
+  writeFileSync8(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
-  return { path, files: staged };
+  return { path, files: staged, bundleFiles };
 }
 function stageMetalConfig(config, directory) {
   const rewritten = structuredClone(config);
   const files = [];
   if (config.agentSeedFile) {
     const name = "metal-agent-seed";
-    writeFileSync7(join6(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
+    writeFileSync8(join6(directory, name), ownerFile(config.agentSeedFile, SECRET_LIMIT, name), {
       mode: 384,
       flag: "wx"
     });
@@ -5797,7 +6001,7 @@ function stageMetalConfig(config, directory) {
     files.push(name);
   }
   const path = join6(directory, "metal-config.json");
-  writeFileSync7(path, `${JSON.stringify(rewritten, null, 2)}
+  writeFileSync8(path, `${JSON.stringify(rewritten, null, 2)}
 `, { mode: 384, flag: "wx" });
   return { path, files };
 }
@@ -5806,10 +6010,10 @@ async function verifiedBunArchive(directory, fetcher) {
   if (!response.ok)
     throw new Error("pinned Bun download failed");
   const bytes = new Uint8Array(await response.arrayBuffer());
-  if (createHash3("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256)
+  if (createHash4("sha256").update(bytes).digest("hex") !== BUN_RELEASE_SHA256)
     throw new Error("pinned Bun checksum mismatch");
   const path = join6(directory, "bun.zip");
-  writeFileSync7(path, bytes, { mode: 384, flag: "wx" });
+  writeFileSync8(path, bytes, { mode: 384, flag: "wx" });
   return path;
 }
 async function installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options) {
@@ -5819,7 +6023,7 @@ async function installPackagedAgent(request, knownHosts, exec, directory, remote
     [options.fzGitSshPath ?? fileURLToPath2(new URL("./fz-git-ssh.js", import.meta.url)), "fz-git-ssh.js"]
   ];
   for (const [artifact] of artifacts) {
-    if (!readFileSync6(artifact).length)
+    if (!readFileSync7(artifact).length)
       throw new Error(`packaged artifact is empty: ${basename(artifact)}`);
   }
   await remote(exec, request, knownHosts, ["/usr/bin/mkdir", "-m", "0700", remoteTemp], "remote staging");
@@ -5860,7 +6064,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
   const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-bootstrap-"));
-  const remoteTemp = `/tmp/forgezero-operator-${randomBytes4(12).toString("hex")}`;
+  const remoteTemp = `/tmp/forgezero-operator-${randomBytes5(12).toString("hex")}`;
   let knownHosts = "";
   try {
     knownHosts = writeKnownHosts(request, directory);
@@ -5872,18 +6076,16 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     if (config.kind !== "platform")
       throw new Error("operator bootstrap requires a platform config");
     const secrets = mode === "apply" ? validatePlatformBootstrapSecrets(config, options.secrets) : undefined;
-    const staged = stageConfig(config, directory);
+    const staged = await stageConfig(config, directory);
     await installPackagedAgent(request, knownHosts, exec, directory, remoteTemp, options);
     await copy(exec, request, knownHosts, staged.path, `${remoteTemp}/platform-config.json`, true);
     for (const name of staged.files)
       await copy(exec, request, knownHosts, join6(directory, name), `${remoteTemp}/${name}`, true);
-    for (const name of ["platform-config.json", ...staged.files])
+    for (const bundle of staged.bundleFiles)
+      await copy(exec, request, knownHosts, bundle.source, `${remoteTemp}/${bundle.name}`, true);
+    for (const name of ["platform-config.json", ...staged.files, ...staged.bundleFiles.map(({ name: name2 }) => name2)])
       await remote(exec, request, knownHosts, ["/usr/bin/sudo", "-n", "/usr/bin/install", "-m", "0600", `${remoteTemp}/${name}`, `${REMOTE_STAGE}/${name}`], "remote bootstrap handoff", true);
-    const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform"];
-    if (mode === "prepare")
-      command.push("prepare");
-    else
-      command.push("credentials-stdin");
+    const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
 ` : undefined);
@@ -5894,7 +6096,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
         return;
       });
     }
-    rmSync5(directory, { recursive: true, force: true });
+    rmSync6(directory, { recursive: true, force: true });
   }
 }
 async function applyOperatorMetalBootstrap(request, mode, options = {}) {
@@ -5903,7 +6105,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   socketPath(request.target.agentSocket);
   const exec = options.exec ?? defaultExec3;
   const directory = mkdtempSync(join6(tmpdir(), "forgezero-operator-metal-"));
-  const remoteTemp = `/tmp/forgezero-operator-${randomBytes4(12).toString("hex")}`;
+  const remoteTemp = `/tmp/forgezero-operator-${randomBytes5(12).toString("hex")}`;
   let knownHosts = "";
   try {
     knownHosts = writeKnownHosts(request, directory);
@@ -5947,7 +6149,7 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
         return;
       });
     }
-    rmSync5(directory, { recursive: true, force: true });
+    rmSync6(directory, { recursive: true, force: true });
   }
 }
 export {