@forgezero/agent 0.1.63 → 0.1.64

package/dist/fz.js

@@ -4811,8 +4811,8 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 
 // src/cli/index.ts
 init_dist();
-import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync12, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename3, dirname as dirname13, isAbsolute as isAbsolute6, resolve as resolve10 } from "path";
+import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "fs";
+import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join12, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { hostname } from "os";
 
@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.63";
+var VERSION2 = "0.1.64";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5838,17 +5838,16 @@ function agentUnit(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath)) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
   const warpValues = [
     options.warpOrganization,
     options.warpClientIdCredentialPath,
@@ -6087,15 +6086,13 @@ function planProvision(options) {
   if (Boolean(options.pullMigrations) !== Boolean(options.lifecycleProfilePath)) {
     throw new Error("migration pull and lifecycle profile must be supplied together");
   }
-  const bootstrapEnabled = Boolean(options.pullBootstrap && options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath && options.bootstrapTargetTelemetryEndpoint);
-  if ([
-    options.pullBootstrap,
-    options.bootstrapSshCredentialPath,
-    options.bootstrapSshPublicKeyPath,
-    options.bootstrapSshSourcePath,
-    options.bootstrapTargetTelemetryEndpoint
-  ].some(Boolean) && !bootstrapEnabled) {
-    throw new Error("bootstrap pull, SSH credential, public key and target telemetry endpoint must be supplied together");
+  const bootstrapIdentityEnabled = Boolean(options.bootstrapSshCredentialPath && options.bootstrapSshPublicKeyPath);
+  if (Boolean(options.bootstrapSshCredentialPath) !== Boolean(options.bootstrapSshPublicKeyPath) || options.bootstrapSshSourcePath && !bootstrapIdentityEnabled) {
+    throw new Error("bootstrap SSH credential and public key paths must be supplied together");
+  }
+  const bootstrapEnabled = Boolean(options.pullBootstrap);
+  if (bootstrapEnabled && (!bootstrapIdentityEnabled || !options.bootstrapTargetTelemetryEndpoint) || !bootstrapEnabled && options.bootstrapTargetTelemetryEndpoint) {
+    throw new Error("bootstrap pull, SSH identity and target telemetry endpoint must be supplied together");
   }
   const warpValues = [
     options.warpOrganization,
@@ -6105,13 +6102,13 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
-    throw new Error("direct enrolment credential and state paths must be supplied together");
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath);
+  if (options.enrolTokenCredentialPath && !options.enrolStatePath || options.enrolTokenSourcePath && (!options.enrolTokenCredentialPath || !options.enrolStatePath)) {
+    throw new Error("direct enrolment credential requires its durable state path");
   }
   const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
-  const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
+  const enrolStatePath = options.enrolStatePath ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
   const sourceBinPath = options.sourceBinPath ? systemdPath(options.sourceBinPath, "agent source binary") : undefined;
   const binPath = options.binPath ? systemdPath(options.binPath, "agent binary") : undefined;
@@ -6123,8 +6120,8 @@ function planProvision(options) {
   const gitPublicKeyDir = gitPublicKeyPath?.replace(/\/[^/]+$/, "");
   const lifecycleProfilePath = lifecycleEnabled ? systemdPath(options.lifecycleProfilePath, "lifecycle profile") : undefined;
   const lifecycleHelperSocketPath = lifecycleEnabled ? systemdPath(options.lifecycleHelperSocketPath ?? LIFECYCLE_HELPER_SOCKET, "lifecycle helper socket") : undefined;
-  const bootstrapSshCredentialPath = bootstrapEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
-  const bootstrapSshPublicKeyPath = bootstrapEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
+  const bootstrapSshCredentialPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshCredentialPath, "bootstrap SSH credential") : undefined;
+  const bootstrapSshPublicKeyPath = bootstrapIdentityEnabled ? systemdPath(options.bootstrapSshPublicKeyPath, "bootstrap SSH public key") : undefined;
   const bootstrapSshSourcePath = options.bootstrapSshSourcePath ? systemdPath(options.bootstrapSshSourcePath, "bootstrap SSH private-key source") : undefined;
   const bootstrapSshPublicKeyDir = bootstrapSshPublicKeyPath?.replace(/\/[^/]+$/, "");
   const warpClientIdCredentialPath = warpEnabled ? systemdPath(options.warpClientIdCredentialPath, "WARP client-id credential") : undefined;
@@ -6224,7 +6221,7 @@ function planProvision(options) {
         step("Git deploy identity directory", { kind: "directories", directories: [{ path: gitPublicKeyDir, mode: 493, owner: "root", group: "root" }] }),
         step("unique encrypted Git deploy identity", { kind: "ensure-git-identity", credential: gitCredentialPath, publicKey: gitPublicKeyPath })
       ] : [],
-      ...bootstrapEnabled ? [
+      ...bootstrapIdentityEnabled ? [
         step("bootstrap SSH public identity directory", { kind: "directories", directories: [
           { path: bootstrapSshPublicKeyDir, mode: 493, owner: "root", group: "root" }
         ] }),
@@ -6260,6 +6257,10 @@ function planProvision(options) {
         { argv: ["/usr/bin/rm", "-f", "/etc/systemd/system/forgezero-deploy-runner.socket"] },
         { argv: ["/usr/bin/systemctl", "daemon-reload"] }
       ] })] : [],
+      ...enrolStatePath && !enrolmentEnabled ? [step("retire consumed enrolment unit", { kind: "commands", commands: [
+        { argv: ["/usr/bin/systemctl", "disable", "--now", "forgezero-agent-enrol.service"], acceptedExitCodes: [0, 1, 5] },
+        { argv: ["/usr/bin/rm", "-f", ENROLMENT_UNIT_PATH] }
+      ] })] : [],
       step("enable and converge services", { kind: "commands", commands: [
         { argv: ["/usr/bin/systemctl", "enable", ...enabledUnits] },
         { argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-agent.service"], acceptedExitCodes: [0, 1] },
@@ -14188,7 +14189,15 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   if (connectorCapabilities?.meshConnectorToken && !host.exists(WARP_CONNECTOR_CREDENTIAL)) {
     await seal(host, "CF_WARP_CONNECTOR_TOKEN", WARP_CONNECTOR_CREDENTIAL, connectorCapabilities.meshConnectorToken);
   }
-  await host.installAgent(config);
+  if (alreadyEnrolled) {
+    await host.installAgent(config, "bound");
+  } else if (config.kind === "platform") {
+    if (bootstrapManifest)
+      await host.installAgent(config, "bootstrap");
+  } else {
+    await host.installAgent(config, "enrol");
+    await host.installAgent(config, "bound");
+  }
   if (config.kind === "platform" && config.firewall.enabled) {
     await host.ensureSoftware(plan.software.filter(({ id: id2 }) => id2 === "ufw"));
   } else
@@ -14338,7 +14347,19 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
 `, 384);
       host.remove(config.bootstrapBundle.bundleFile);
       host.remove(config.bootstrapBundle.manifestFile);
-      await host.installAgent(config);
+    }
+    if (!alreadyEnrolled) {
+      await checked3(host, [
+        "curl",
+        "--fail",
+        "--silent",
+        "--show-error",
+        "--max-time",
+        "10",
+        `http://127.0.0.1:3000${runtime.healthPath}`
+      ], "release-one API health");
+      await host.installAgent(config, "enrol");
+      await host.installAgent(config, "bound");
     }
   }
   if (config.cloudflareHandoff) {
@@ -14507,6 +14528,65 @@ function readBootstrapConfig(path) {
   }
   return validateBootstrapConfig(strictBootstrapDocument(JSON.parse(readFileSync9(path, "utf8"))));
 }
+function planBootstrapAgentInstall(config, phase, context) {
+  const { capabilities, hasBinding, hasEnrolCredential, initialBundle } = context;
+  if (phase === "bootstrap") {
+    if (config.kind !== "platform" || hasBinding || !initialBundle) {
+      throw new Error("release-one Agent install requires an unbound platform host and verified bootstrap bundle");
+    }
+  } else if (phase === "enrol") {
+    if (hasBinding || !hasEnrolCredential) {
+      throw new Error("Agent enrolment requires one unbound host and its sealed one-use credential");
+    }
+  } else if (!hasBinding) {
+    throw new Error("bound Agent convergence requires durable enrolment state");
+  }
+  const bound = phase === "bound";
+  const enrolling = phase === "enrol";
+  const authenticated = enrolling || bound;
+  const bootstrapRunner = platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner);
+  const options = {
+    capabilities,
+    socketPath: DEFAULT_SOCKET,
+    seedPath: "/var/lib/forgezero/node.seed",
+    controlSocketPath: CONTROL_SOCKET,
+    repository: phase === "bootstrap" ? initialBundle.path : bound && config.kind === "enrolled-compute" ? config.repository : undefined,
+    branch: phase === "bootstrap" ? initialBundle.manifest.branch : bound && config.kind === "enrolled-compute" ? config.branch : undefined,
+    bootstrapBundlePath: phase === "bootstrap" ? initialBundle.path : undefined,
+    bootstrapBundleManifestPath: phase === "bootstrap" ? initialBundle.manifestPath : undefined,
+    profile: config.profile,
+    deployRoot: config.deployRoot ?? "/opt/forgezero",
+    deploymentCredentials: config.deploymentCredentials,
+    publicApiUrl: config.apiUrl,
+    gitCredentialPath: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
+    gitPublicKeyPath: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
+    generateGitIdentity: authenticated && config.kind === "enrolled-compute" && config.gitDeployKey === true,
+    pullDeployments: bound,
+    pullMigrations: bound && config.kind === "platform",
+    pullBootstrap: bound && bootstrapRunner,
+    bootstrapSshCredentialPath: authenticated && bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
+    bootstrapSshSourcePath: enrolling && config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
+    bootstrapSshPublicKeyPath: authenticated && bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
+    bootstrapTargetTelemetryEndpoint: bound && bootstrapRunner ? platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined : undefined,
+    lifecycleProfilePath: bound && config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
+    enforceEgress: true,
+    nodeHostname: config.nodeHostname,
+    telemetryEndpoint: config.telemetryEndpoint,
+    binPath: "/usr/local/lib/forgezero/agent/fz-agent",
+    sourceBinPath: PACKAGED_AGENT_BIN,
+    ...enrolling ? {
+      enrolTokenCredentialPath: ENROL_CREDENTIAL,
+      enrolStatePath: "/var/lib/forgezero/enrolment.json"
+    } : bound ? { enrolStatePath: "/var/lib/forgezero/enrolment.json" } : {},
+    ...authenticated ? {
+      apiUrl: config.apiUrl,
+      project: config.kind === "enrolled-compute" ? config.realm : "platform",
+      environment: config.kind === "enrolled-compute" ? undefined : config.environment,
+      nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
+    } : {}
+  };
+  return planInstall(options);
+}
 function localBootstrapHost() {
   const execute = async (argv2, options = {}) => {
     const child = Bun.spawn([...argv2], { stdin: options.stdin === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
@@ -14554,10 +14634,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config) {
+    async installAgent(config, phase) {
       const capabilities = await readCapabilities(localRunner);
-      const deployRoot = config.deployRoot ?? "/opt/forgezero";
       const hasBinding = existsSync9("/var/lib/forgezero/enrolment.json");
+      const hasEnrolCredential = existsSync9(ENROL_CREDENTIAL);
       const initialBundle = config.kind === "platform" && !existsSync9(BOOTSTRAP_RELEASE_EVIDENCE) ? {
         path: config.bootstrapBundle.bundleFile,
         manifestPath: config.bootstrapBundle.manifestFile,
@@ -14578,45 +14658,11 @@ function localBootstrapHost() {
         writeFileSync9(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
-      const plan = planInstall({
+      const plan = planBootstrapAgentInstall(config, phase, {
         capabilities,
-        socketPath: DEFAULT_SOCKET,
-        seedPath: "/var/lib/forgezero/node.seed",
-        controlSocketPath: "/run/forgezero/control.sock",
-        repository: initialBundle?.path ?? (config.kind === "enrolled-compute" ? config.repository : undefined),
-        branch: initialBundle?.manifest.branch ?? (config.kind === "enrolled-compute" ? config.branch : undefined),
-        bootstrapBundlePath: initialBundle?.path,
-        bootstrapBundleManifestPath: initialBundle?.manifestPath,
-        profile: config.kind === "platform" ? config.profile : config.profile,
-        deployRoot,
-        deploymentCredentials: config.deploymentCredentials,
-        publicApiUrl: config.apiUrl,
-        gitCredentialPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/creds/git-deploy-key.cred" : undefined,
-        gitPublicKeyPath: config.kind === "enrolled-compute" && config.gitDeployKey ? "/etc/forgezero/git/deploy.pub" : undefined,
-        generateGitIdentity: config.kind === "enrolled-compute" && config.gitDeployKey === true,
-        pullDeployments: hasBinding,
-        pullMigrations: config.kind === "platform" && hasBinding,
-        pullBootstrap: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && Boolean(config.bootstrapRunner),
-        bootstrapSshCredentialPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_CREDENTIAL : undefined,
-        bootstrapSshSourcePath: config.kind === "enrolled-compute" ? config.bootstrapRunner?.sshPrivateKeyFile : undefined,
-        bootstrapSshPublicKeyPath: platformBootstrapRunner(config) || config.kind === "enrolled-compute" && config.bootstrapRunner ? BOOTSTRAP_SSH_PUBLIC_KEY : undefined,
-        bootstrapTargetTelemetryEndpoint: platformBootstrapRunner(config) ? config.telemetryEndpoint : config.kind === "enrolled-compute" ? config.bootstrapRunner?.targetTelemetryEndpoint : undefined,
-        lifecycleProfilePath: config.kind === "platform" ? LIFECYCLE_PROFILE : undefined,
-        enforceEgress: true,
-        nodeHostname: config.nodeHostname,
-        telemetryEndpoint: config.telemetryEndpoint,
-        binPath: "/usr/local/lib/forgezero/agent/fz-agent",
-        sourceBinPath: PACKAGED_AGENT_BIN,
-        ...existsSync9(ENROL_CREDENTIAL) || hasBinding ? {
-          enrolTokenCredentialPath: existsSync9(ENROL_CREDENTIAL) ? ENROL_CREDENTIAL : undefined,
-          enrolStatePath: "/var/lib/forgezero/enrolment.json"
-        } : {},
-        ...hasBinding ? {
-          apiUrl: config.apiUrl,
-          project: config.kind === "enrolled-compute" ? config.realm : "platform",
-          environment: config.kind === "enrolled-compute" ? undefined : config.environment,
-          nodeLabel: config.kind === "enrolled-compute" ? config.nodeHostname : config.computeReference
-        } : {}
+        hasBinding,
+        hasEnrolCredential,
+        initialBundle
       });
       for (const unit of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
         mkdirSync9(dirname9(unit.path), { recursive: true, mode: 493 });
@@ -15671,10 +15717,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 
 // src/operator-bootstrap.ts
 import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
-import { lstatSync as lstatSync7, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
 import { isIP as isIP6 } from "net";
 import { tmpdir } from "os";
-import { basename as basename2, join as join10 } from "path";
+import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/platform-genesis.ts
@@ -15809,6 +15855,25 @@ var exactKeys5 = (value, keys, label) => {
     throw new Error(`${label} contains unknown fields: ${unknown.join(", ")}`);
   return record3;
 };
+var canonicalOutputPath = (path, label) => {
+  if (!isAbsolute5(path) || resolve9(path) !== path || /[\r\n\0]/.test(path)) {
+    throw new Error(`${label} must be a canonical absolute path`);
+  }
+  return path;
+};
+var writeOwnerJson2 = (path, value, label) => {
+  canonicalOutputPath(path, label);
+  mkdirSync12(dirname13(path), { recursive: true, mode: 448 });
+  const parent = lstatSync7(dirname13(path));
+  const uid = process.getuid?.() ?? parent.uid;
+  if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== uid || (parent.mode & 63) !== 0) {
+    throw new Error(`${label} parent must be an owner-only directory`);
+  }
+  writeFileSync12(path, `${JSON.stringify(value, null, 2)}
+`, { mode: 384, flag: "wx" });
+  chmodSync6(path, 384);
+  return path;
+};
 var ownerFile = (path, limit, label) => {
   if (!path.startsWith("/") || /[\r\n]/.test(path))
     throw new Error(`${label} path must be absolute`);
@@ -15867,8 +15932,10 @@ var validateHop = (value, label) => {
   }
   return hop;
 };
-function readOperatorPlatformBootstrapRequest(path) {
-  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator bootstrap request")));
+function createOperatorSshHop(input) {
+  return validateHop({ ...input, hostKeySha256: fingerprint(input.hostKey) }, "operator SSH hop");
+}
+var validatePlatformRequestValue = (value) => {
   const root = exactKeys5(value, ["kind", "target", "platformConfigFile"], "operator bootstrap request");
   if (root.kind !== "platform-remote")
     throw new Error("operator bootstrap kind must be platform-remote");
@@ -15887,6 +15954,7 @@ function readOperatorPlatformBootstrapRequest(path) {
   socketPath(targetValue.agentSocket);
   if (typeof root.platformConfigFile !== "string")
     throw new Error("platformConfigFile must be an absolute path");
+  canonicalOutputPath(root.platformConfigFile, "platformConfigFile");
   const config = readBootstrapConfig(root.platformConfigFile);
   if (config.kind !== "platform")
     throw new Error("operator bootstrap requires a platform config");
@@ -15900,9 +15968,39 @@ function readOperatorPlatformBootstrapRequest(path) {
       ...targetValue.jump === undefined ? {} : { jump: validateHop(targetValue.jump, "operator bootstrap jump") }
     }
   };
-}
-function readOperatorMetalBootstrapRequest(path) {
-  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal request")));
+};
+function readOperatorPlatformBootstrapRequest(path) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator bootstrap request")));
+  return validatePlatformRequestValue(value);
+}
+function writeOperatorPlatformBootstrapRequest(path, request) {
+  validatePlatformRequestValue(request);
+  return writeOwnerJson2(path, request, "operator bootstrap request");
+}
+function readOperatorPlatformBootstrapFleetRequest(path) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator fleet request")));
+  const root = exactKeys5(value, ["kind", "requests"], "operator fleet request");
+  if (root.kind !== "platform-fleet-remote")
+    throw new Error("operator fleet kind must be platform-fleet-remote");
+  if (!Array.isArray(root.requests) || root.requests.length !== 3 || root.requests.some((entry) => typeof entry !== "string")) {
+    throw new Error("operator fleet requires exactly three request files");
+  }
+  const requests = root.requests.map((entry) => canonicalOutputPath(entry, "operator fleet request file"));
+  if (new Set(requests).size !== 3)
+    throw new Error("operator fleet request files must be unique");
+  for (const request of requests)
+    readOperatorPlatformBootstrapRequest(request);
+  return { kind: "platform-fleet-remote", requests };
+}
+function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles) {
+  const request = { kind: "platform-fleet-remote", requests: requestFiles };
+  if (new Set(requestFiles).size !== 3)
+    throw new Error("operator fleet request files must be unique");
+  for (const file of requestFiles)
+    readOperatorPlatformBootstrapRequest(file);
+  return writeOwnerJson2(path, request, "operator fleet request");
+}
+var validateMetalRequestValue = (value) => {
   const root = exactKeys5(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
@@ -15921,6 +16019,7 @@ function readOperatorMetalBootstrapRequest(path) {
   socketPath(targetValue.agentSocket);
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
+  canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
   readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys5(root.genesis, ["environment", "sshPublicKeyFiles"], "operator metal genesis");
   if (typeof genesis.environment !== "string" || !PLATFORM_GENESIS_ENVIRONMENTS.includes(genesis.environment)) {
@@ -15944,6 +16043,14 @@ function readOperatorMetalBootstrapRequest(path) {
       sshPublicKeyFiles: genesis.sshPublicKeyFiles
     }
   };
+};
+function readOperatorMetalBootstrapRequest(path) {
+  const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal request")));
+  return validateMetalRequestValue(value);
+}
+function writeOperatorMetalBootstrapRequest(path, request) {
+  validateMetalRequestValue(request);
+  return writeOwnerJson2(path, request, "operator metal request");
 }
 function planOperatorMetalBootstrap(request, mode) {
   const config = readMetalBootstrapConfig(request.metalConfigFile);
@@ -16003,6 +16110,87 @@ function planOperatorPlatformBootstrap(request, mode) {
     secretInputs: mode === "apply" ? [...attendedSecretNames(config), ...secretSources(config).map(([name]) => name)] : []
   };
 }
+var fleetConfigIdentity = (config) => {
+  const normalized = structuredClone(config);
+  delete normalized.computeReference;
+  delete normalized.nodeHostname;
+  delete normalized.cloudflareHandoff;
+  delete normalized.database.role;
+  delete normalized.database.address;
+  delete normalized.database.master;
+  const environment = normalized.runtime.environment;
+  delete environment.databaseRole;
+  delete environment.databaseAddress;
+  delete environment.databaseMaster;
+  delete environment.nodeHostname;
+  delete environment.seedSyncPeers;
+  delete environment.custodianEmail;
+  return JSON.stringify(normalized);
+};
+function validatedPlatformFleet(fleet) {
+  const requests = fleet.requests.map(readOperatorPlatformBootstrapRequest);
+  const configs = requests.map((request) => {
+    const config = readBootstrapConfig(request.platformConfigFile);
+    if (config.kind !== "platform")
+      throw new Error("operator fleet requires platform configs");
+    return config;
+  });
+  const environment = configs[0].environment;
+  const expected = PLATFORM_GENESIS_FLEETS[environment];
+  if (!expected || expected.length !== 3)
+    throw new Error("operator fleet environment is invalid");
+  const identity = fleetConfigIdentity(configs[0]);
+  const operatorIdentity = `${requests[0].target.identityPublicKeyFile}\x00${requests[0].target.agentSocket}`;
+  const jumpIdentity = JSON.stringify(requests[0].target.jump ?? null);
+  const coordinators = expected.map((guest) => `http://${guest.address}:8529`);
+  const nodeHostnames = new Set;
+  for (let index = 0;index < 3; index += 1) {
+    const config = configs[index];
+    const request = requests[index];
+    const guest = expected[index];
+    const role = index === 0 ? "master" : "joiner";
+    if (config.environment !== environment || fleetConfigIdentity(config) !== identity) {
+      throw new Error("operator fleet platform configs do not share one immutable identity");
+    }
+    if (config.computeReference !== guest.name || config.database.address !== guest.address || config.database.role !== role || config.database.agency !== "member" || (role === "master" ? config.database.master !== undefined : config.database.master !== expected[0].address) || config.database.coordinators.join(",") !== coordinators.join(",") || config.enrolment.source !== "genesis-derived" || config.cloudflareHandoff?.nodeName !== guest.name) {
+      throw new Error(`operator fleet ${guest.name} does not match the exact genesis topology`);
+    }
+    if (request.target.address !== guest.address || request.target.port !== 22 || request.target.user !== "forgezero") {
+      throw new Error(`operator fleet ${guest.name} SSH target must be forgezero@${guest.address}:22`);
+    }
+    if (`${request.target.identityPublicKeyFile}\x00${request.target.agentSocket}` !== operatorIdentity) {
+      throw new Error("operator fleet must use one caller-approved SSH identity and agent socket");
+    }
+    if (JSON.stringify(request.target.jump ?? null) !== jumpIdentity) {
+      throw new Error("operator fleet must use one pinned Metal jump or no jump on every node");
+    }
+    if (nodeHostnames.has(config.nodeHostname))
+      throw new Error("operator fleet node hostnames must be unique");
+    nodeHostnames.add(config.nodeHostname);
+  }
+  return { requests, configs, environment };
+}
+function planOperatorPlatformFleetBootstrap(fleet, mode) {
+  const { requests, configs, environment } = validatedPlatformFleet(fleet);
+  const secretInputs = mode === "apply" ? attendedSecretNames(configs[0]) : [];
+  for (const config of configs.slice(1)) {
+    if (JSON.stringify(attendedSecretNames(config)) !== JSON.stringify(secretInputs)) {
+      throw new Error("operator fleet configs do not share one attended secret schema");
+    }
+  }
+  return {
+    kind: "platform-fleet-remote",
+    mode,
+    mutation: mode !== "status",
+    environment,
+    nodes: requests.map((request, index) => ({
+      computeReference: configs[index].computeReference,
+      address: request.target.address,
+      ...request.target.jump ? { via: request.target.jump.address } : {}
+    })),
+    secretInputs
+  };
+}
 var defaultExec3 = async (argv2, options = {}) => {
   const child = Bun.spawn([...argv2], {
     stdin: options.stdin === undefined ? "ignore" : "pipe",
@@ -16245,6 +16433,30 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     rmSync7(directory, { recursive: true, force: true });
   }
 }
+async function applyOperatorPlatformFleetBootstrap(fleet, mode, options = {}) {
+  const plan = planOperatorPlatformFleetBootstrap(fleet, mode);
+  const { requests, configs } = validatedPlatformFleet(fleet);
+  const secrets = mode === "apply" ? validatePlatformBootstrapSecrets(configs[0], options.secrets) : undefined;
+  if (secrets) {
+    for (const config of configs.slice(1))
+      validatePlatformBootstrapSecrets(config, secrets);
+  }
+  const settled = await Promise.allSettled(requests.map((request) => applyOperatorPlatformBootstrap(request, mode, { ...options, secrets })));
+  const outcomes = settled.map((result, index) => {
+    const config = configs[index];
+    const address = requests[index].target.address;
+    if (result.status === "fulfilled")
+      return {
+        computeReference: config.computeReference,
+        address,
+        ok: true,
+        output: result.value.output.slice(0, 65536)
+      };
+    const message = result.reason instanceof Error ? result.reason.message : String(result.reason);
+    return { computeReference: config.computeReference, address, ok: false, error: message.slice(0, 4096) };
+  });
+  return { plan, ok: outcomes.every(({ ok }) => ok), outcomes };
+}
 async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   const plan = planOperatorMetalBootstrap(request, mode);
   publicIdentity(request.target.identityPublicKeyFile);
@@ -16478,7 +16690,7 @@ async function applyHostMaintenance(request, runtime = localRuntime()) {
 
 // src/cli/maintenance.ts
 import { existsSync as existsSync11, lstatSync as lstatSync9, readFileSync as readFileSync14, realpathSync as realpathSync5 } from "fs";
-import { isAbsolute as isAbsolute5, join as join11, relative as relative2, resolve as resolve9 } from "path";
+import { isAbsolute as isAbsolute6, join as join11, relative as relative2, resolve as resolve10 } from "path";
 var API_OPERATION_ENTRYPOINTS = {
   "dev-reset": ["src", "server", "maintenance", "dev-reset.ts"],
   "db-backup": ["src", "server", "maintenance", "snapshot-backup.ts"],
@@ -16572,13 +16784,13 @@ function checkedEntrypoint(root, parts) {
   }
   const actual = realpathSync5(candidate);
   const within = relative2(root, actual);
-  if (within.startsWith("..") || isAbsolute5(within)) {
+  if (within.startsWith("..") || isAbsolute6(within)) {
     throw new Error(`The reviewed operation entrypoint escapes repository root ${root}.`);
   }
   return actual;
 }
 function resolveRepositoryOperation(operation, requestedRoot) {
-  const root = realpathSync5(resolve9(requestedRoot));
+  const root = realpathSync5(resolve10(requestedRoot));
   const name = manifestName(root);
   if (operation in API_OPERATION_ENTRYPOINTS) {
     const parts = API_OPERATION_ENTRYPOINTS[operation];
@@ -16879,7 +17091,7 @@ async function api(options, path, init) {
   return { status: response.status, body };
 }
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -17313,7 +17525,7 @@ async function cmdAgent(options, args) {
     writeFileSync13(plan.unitPath, plan.unit, { mode: 420 });
     out.ok(`Wrote ${plan.unitPath}`);
     for (const auxiliary of plan.auxiliaryUnits) {
-      mkdirSync12(dirname13(auxiliary.path), { recursive: true, mode: 493 });
+      mkdirSync13(dirname14(auxiliary.path), { recursive: true, mode: 493 });
       writeFileSync13(auxiliary.path, auxiliary.unit, { mode: 420 });
       out.ok(`Wrote ${auxiliary.path}`);
     }
@@ -17322,7 +17534,7 @@ async function cmdAgent(options, args) {
         const token = await bootstrapSecret("ForgeZero one-time enrolment token");
         if (!/^fze_[A-Za-z0-9_-]{40,100}$/.test(token))
           throw new Error("A valid fze_ enrolment token was not provided.");
-        mkdirSync12(dirname13(enrolTokenCredentialPath), { recursive: true, mode: 448 });
+        mkdirSync13(dirname14(enrolTokenCredentialPath), { recursive: true, mode: 448 });
         const sealing = Bun.spawn(["systemd-creds", "encrypt", "--name=enrol-token", "-", enrolTokenCredentialPath], { stdin: "pipe", stdout: "ignore", stderr: "pipe" });
         if (sealing.stdin && typeof sealing.stdin !== "number") {
           sealing.stdin.write(`${token}
@@ -17448,9 +17660,9 @@ function interactiveMetalBootstrap() {
   });
 }
 function writeBootstrapConfig(path, config) {
-  if (!isAbsolute6(path) || resolve10(path) !== path)
+  if (!isAbsolute7(path) || resolve11(path) !== path)
     throw new Error("--output must be a canonical absolute path");
-  mkdirSync12(dirname13(path), { recursive: true, mode: 448 });
+  mkdirSync13(dirname14(path), { recursive: true, mode: 448 });
   writeFileSync13(path, `${JSON.stringify(config, null, 2)}
 `, { mode: 384, flag: "wx" });
   return path;
@@ -17512,10 +17724,10 @@ async function interactiveCloudflareBootstrap() {
   });
 }
 function genesisOutputDirectory(path) {
-  if (!isAbsolute6(path) || resolve10(path) !== path)
+  if (!isAbsolute7(path) || resolve11(path) !== path)
     throw new Error("--output must be a canonical absolute directory");
   if (!existsSync12(path))
-    mkdirSync12(path, { recursive: true, mode: 448 });
+    mkdirSync13(path, { recursive: true, mode: 448 });
   const metadata = lstatSync10(path);
   const uid = process.getuid?.();
   if (!metadata.isDirectory() || metadata.isSymbolicLink() || (metadata.mode & 63) !== 0 || uid !== undefined && uid !== 0 && metadata.uid !== uid) {
@@ -17523,6 +17735,37 @@ function genesisOutputDirectory(path) {
   }
   return path;
 }
+function interactiveOperatorHop(label, defaults) {
+  return createOperatorSshHop({
+    address: bootstrapAnswer(`${label} explicit SSH IP`, defaults.address),
+    port: bootstrapNumber(`${label} SSH port`, "22"),
+    user: bootstrapAnswer(`${label} SSH user`, defaults.user),
+    hostKey: bootstrapAnswer(`${label} trusted ssh-ed25519 host public key`)
+  });
+}
+function operatorIdentityCoordinates() {
+  return {
+    identityPublicKeyFile: bootstrapAnswer("Operator SSH public-key file (private key remains in Bitwarden SSH agent)"),
+    agentSocket: bootstrapAnswer("Bitwarden SSH agent socket", process.env.SSH_AUTH_SOCK)
+  };
+}
+function writeMetalOperatorFiles(directory) {
+  const output = genesisOutputDirectory(directory);
+  const config = interactiveMetalBootstrap();
+  const metalConfig = writeBootstrapConfig(join12(output, "metal.json"), config);
+  const identity = operatorIdentityCoordinates();
+  const target = interactiveOperatorHop("Metal", { user: "root" });
+  const remoteRequest = writeOperatorMetalBootstrapRequest(join12(output, "metal-remote.json"), {
+    kind: "metal-remote",
+    metalConfigFile: metalConfig,
+    target: { ...target, ...identity },
+    genesis: {
+      environment: bootstrapAnswer("Genesis environment (production/development)", "development"),
+      sshPublicKeyFiles: [identity.identityPublicKeyFile]
+    }
+  });
+  return { metalConfig, remoteRequest };
+}
 function writePlatformGenesisFleet(directory) {
   const output = genesisOutputDirectory(directory);
   const template = interactiveBootstrap("platform", true);
@@ -17539,7 +17782,20 @@ function writePlatformGenesisFleet(directory) {
     writeBootstrapConfig(path, config);
     return path;
   });
-  return { configs };
+  const identity = operatorIdentityCoordinates();
+  const useJump = bootstrapAnswer("Reach genesis computes through the Metal SSH jump? (yes/no)", "yes") === "yes";
+  const jump = useJump ? interactiveOperatorHop("Metal jump", { user: "root" }) : undefined;
+  const requests = configs.map((platformConfigFile, index) => {
+    const guest = fleet[index];
+    const target = interactiveOperatorHop(`${guest.name} compute`, { address: guest.address, user: "forgezero" });
+    return writeOperatorPlatformBootstrapRequest(join12(output, `${guest.name}-remote.json`), {
+      kind: "platform-remote",
+      platformConfigFile,
+      target: { ...target, ...identity, ...jump ? { jump } : {} }
+    });
+  });
+  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests);
+  return { configs, requests, fleetRequest };
 }
 function interactiveBootstrap(kind, genesis = false) {
   if (!process.stdin.isTTY)
@@ -17661,7 +17917,7 @@ async function cmdBootstrap(options, args) {
     if (operation === "config") {
       const kind = args[1];
       if (kind !== "metal" && kind !== "platform" && kind !== "cloudflare" || args[2] !== undefined || !options.outputPath) {
-        throw new Error("Usage: fz bootstrap config metal|cloudflare --output <absolute-file> | fz bootstrap config platform --output <absolute-owner-only-directory>");
+        throw new Error("Usage: fz bootstrap config cloudflare --output <absolute-file> | fz bootstrap config metal|platform --output <absolute-owner-only-directory>");
       }
       if (kind === "platform") {
         out.line(JSON.stringify({ kind, ...writePlatformGenesisFleet(options.outputPath), mode: "0600" }, null, 2));
@@ -17673,10 +17929,32 @@ async function cmdBootstrap(options, args) {
         out.line(JSON.stringify({ kind, path, mode: "0600" }, null, 2));
         return 0;
       }
-      const config2 = interactiveMetalBootstrap();
-      out.line(JSON.stringify({ kind, path: writeBootstrapConfig(options.outputPath, config2), mode: "0600" }, null, 2));
+      out.line(JSON.stringify({ kind, ...writeMetalOperatorFiles(options.outputPath), mode: "0600" }, null, 2));
       return 0;
     }
+    if (operation === "platform" && args[1] === "fleet") {
+      const mode = args[2];
+      if (!mode || !["apply", "status"].includes(mode) || args[3] !== undefined) {
+        throw new Error("Usage: fz bootstrap platform fleet <apply|status> --bootstrap-config <owner-only-platform-fleet-remote.json> [--apply]");
+      }
+      if (!options.bootstrapConfigPath)
+        throw new Error("remote platform fleet bootstrap requires --bootstrap-config");
+      const fleet = readOperatorPlatformBootstrapFleetRequest(options.bootstrapConfigPath);
+      const plan2 = planOperatorPlatformFleetBootstrap(fleet, mode);
+      if (!options.apply) {
+        out.line(JSON.stringify(plan2, null, 2));
+        out.step("Review all three pinned targets and shared secret names, then repeat with --apply.");
+        return 0;
+      }
+      const first = readOperatorPlatformBootstrapRequest(fleet.requests[0]);
+      const firstConfig = readBootstrapConfig(first.platformConfigFile);
+      if (firstConfig.kind !== "platform")
+        throw new Error("remote platform fleet requires platform configs");
+      const secrets2 = mode === "apply" ? await promptPlatformBootstrapSecrets(firstConfig) : undefined;
+      const result2 = await applyOperatorPlatformFleetBootstrap(fleet, mode, { secrets: secrets2 });
+      out.line(JSON.stringify(result2, null, 2));
+      return result2.ok ? 0 : 1;
+    }
     if (operation === "platform" && args[1] === "remote") {
       const mode = args[2];
       if (!mode || !["apply", "status"].includes(mode) || args[3] !== undefined) {
@@ -17812,7 +18090,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -18188,7 +18466,7 @@ async function cmdDeploy(options, args) {
           out.ok(`Initialized legacy .fz/deploy.json (${created.summary.digest}).`);
         return 0;
       }
-      initializeTypeScriptDeployment(options.projectRoot, { name: options.projectName ?? basename3(resolve10(options.projectRoot)), force: options.force });
+      initializeTypeScriptDeployment(options.projectRoot, { name: options.projectName ?? basename3(resolve11(options.projectRoot)), force: options.force });
       const compiled = await compileDeploymentProject(options.projectRoot);
       if (options.json)
         out.line(JSON.stringify({ source: compiled.source, output: compiled.output, digest: compiled.digest }, null, 2));
@@ -18213,7 +18491,7 @@ async function cmdDeploy(options, args) {
       return problems.length === 0 ? 0 : 1;
     }
     if (operation === "check" || operation === "sync") {
-      if (existsSync12(resolve10(options.projectRoot, DEPLOY_SOURCE_FILE))) {
+      if (existsSync12(resolve11(options.projectRoot, DEPLOY_SOURCE_FILE))) {
         const expected = await compileDeploymentProject(options.projectRoot, { write: false });
         const actual = inspectCompiledDeployment(options.projectRoot);
         const current = canonicalJson(expected.plan) === canonicalJson(actual.plan);
@@ -18390,10 +18668,13 @@ function usage() {
 	 fz bootstrap platform remote <apply|status>
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host; apply copies and verifies that bundle
+	 fz bootstrap platform fleet <apply|status>
+	                         Validate the exact three-node genesis identity, prompt
+	                         shared secrets once and run all pinned nodes concurrently
 	 fz bootstrap platform   Install/repair a typed elastic platform compute
 	 fz bootstrap config <metal|platform|cloudflare>
-	                         Write a validated owner-only metal/Cloudflare file or
-	                         strict three-node platform genesis directory; never apply locally
+	                         Write validated owner-only metal config+remote request,
+	                         Cloudflare file, or complete three-node platform request set
 	 fz bootstrap platform cloudflare
 	                         Plan/apply attended Tunnel and DNS reconciliation
 	                         using hidden management and KV/Worker runtime token prompts