@forgezero/agent 0.1.68 → 0.1.69

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.68";
+var VERSION3 = "0.1.69";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/attended-platform-bootstrap.d.ts

@@ -0,0 +1,22 @@
+import { finalizeCloudflareBootstrapAcceptance, runAttendedCloudflareBootstrap, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapEvidence } from './cloudflare-bootstrap';
+import { applyOperatorPlatformFleetBootstrap, type OperatorPlatformBootstrapFleetRequest, type OperatorPlatformBootstrapFleetResult } from './operator-bootstrap';
+import type { PlatformBootstrapSecrets } from './bootstrap';
+export interface AttendedPlatformBootstrapResult {
+    kind: 'forgezero-attended-platform-bootstrap';
+    ok: boolean;
+    edge: CloudflareBootstrapEvidence;
+    fleet: OperatorPlatformBootstrapFleetResult;
+    acceptance?: CloudflareBootstrapAcceptanceEvidence;
+    inviteUrl?: string;
+}
+export interface AttendedPlatformBootstrapDependencies {
+    cloudflare?: typeof runAttendedCloudflareBootstrap;
+    fleet?: typeof applyOperatorPlatformFleetBootstrap;
+    finalize?: typeof finalizeCloudflareBootstrapAcceptance;
+}
+/**
+ * The sole attended genesis composition boundary. All non-secret coordinates
+ * are checked before the first Cloudflare or SSH mutation. Secret values exist
+ * only in this call and the authenticated SSH stdin used by the fleet runner.
+ */
+export declare function applyAttendedPlatformBootstrap(fleetRequest: OperatorPlatformBootstrapFleetRequest, cloudflareRequest: AttendedCloudflareBootstrapRequest, acceptancePath: string, secrets: PlatformBootstrapSecrets, dependencies?: AttendedPlatformBootstrapDependencies): Promise<AttendedPlatformBootstrapResult>;

package/dist/bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.68";
+var VERSION = "0.1.69";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4380,6 +4380,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
+  await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);

package/dist/fz-agent.js

@@ -8588,7 +8588,7 @@ import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/version.ts
-var VERSION2 = "0.1.68";
+var VERSION2 = "0.1.69";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.68";
+var VERSION2 = "0.1.69";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -14399,6 +14399,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
+  await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
@@ -15076,6 +15077,14 @@ async function runCloudflareBootstrapFinalizeCommand(configPath, dependencies =
   return evidence;
 }
 
+// src/operator-bootstrap.ts
+import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
+import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { isIP as isIP6 } from "net";
+import { tmpdir } from "os";
+import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
 // src/metal-bootstrap.ts
 import { createHash as createHash5, randomBytes as randomBytes8 } from "crypto";
 import {
@@ -15986,12 +15995,6 @@ async function metalBootstrapStatus(exec = defaultExec2) {
 }
 
 // src/operator-bootstrap.ts
-import { createHash as createHash6, randomBytes as randomBytes9 } from "crypto";
-import { chmodSync as chmodSync6, lstatSync as lstatSync7, mkdirSync as mkdirSync12, mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
-import { isIP as isIP6 } from "net";
-import { tmpdir } from "os";
-import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute5, join as join10, resolve as resolve9 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
 var REQUEST_LIMIT = 64 * 1024;
 var SECRET_LIMIT = 256 * 1024;
 var REMOTE_STAGE = "/run/forgezero-operator-bootstrap";
@@ -16129,7 +16132,12 @@ function writeOperatorPlatformBootstrapRequest(path, request) {
 }
 function readOperatorPlatformBootstrapFleetRequest(path) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator fleet request")));
-  const root = exactKeys5(value, ["kind", "requests"], "operator fleet request");
+  const root = exactKeys5(value, [
+    "kind",
+    "requests",
+    "cloudflareConfigFile",
+    "cloudflareAcceptanceFile"
+  ], "operator fleet request");
   if (root.kind !== "platform-fleet-remote")
     throw new Error("operator fleet kind must be platform-fleet-remote");
   if (!Array.isArray(root.requests) || root.requests.length !== 3 || root.requests.some((entry) => typeof entry !== "string")) {
@@ -16140,10 +16148,25 @@ function readOperatorPlatformBootstrapFleetRequest(path) {
     throw new Error("operator fleet request files must be unique");
   for (const request of requests)
     readOperatorPlatformBootstrapRequest(request);
-  return { kind: "platform-fleet-remote", requests };
+  if (typeof root.cloudflareConfigFile !== "string" || typeof root.cloudflareAcceptanceFile !== "string") {
+    throw new Error("operator fleet requires Cloudflare coordinates and an acceptance evidence path");
+  }
+  const cloudflareConfigFile = canonicalOutputPath(root.cloudflareConfigFile, "operator fleet Cloudflare config");
+  const cloudflareAcceptanceFile = canonicalOutputPath(root.cloudflareAcceptanceFile, "operator fleet Cloudflare acceptance evidence");
+  return {
+    kind: "platform-fleet-remote",
+    requests,
+    cloudflareConfigFile,
+    cloudflareAcceptanceFile
+  };
 }
-function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles) {
-  const request = { kind: "platform-fleet-remote", requests: requestFiles };
+function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudflare) {
+  const request = {
+    kind: "platform-fleet-remote",
+    requests: requestFiles,
+    cloudflareConfigFile: canonicalOutputPath(cloudflare.configFile, "operator fleet Cloudflare config"),
+    cloudflareAcceptanceFile: canonicalOutputPath(cloudflare.acceptanceFile, "operator fleet Cloudflare acceptance evidence")
+  };
   if (new Set(requestFiles).size !== 3)
     throw new Error("operator fleet request files must be unique");
   for (const file of requestFiles)
@@ -16396,6 +16419,20 @@ function validatedPlatformFleet(fleet) {
   }
   return { requests, configs, environment };
 }
+function operatorPlatformFleetCoordinates(fleet) {
+  const { requests, configs, environment } = validatedPlatformFleet(fleet);
+  return {
+    environment,
+    appOrigin: configs[0].runtime.environment.appOrigin,
+    apiOrigin: configs[0].runtime.environment.apiOrigin,
+    nodes: configs.map((config, index) => ({
+      computeReference: config.computeReference,
+      address: requests[index].target.address,
+      nodeHostname: config.nodeHostname,
+      databaseRole: config.database.role
+    }))
+  };
+}
 function planOperatorPlatformFleetBootstrap(fleet, mode) {
   const { requests, configs, environment } = validatedPlatformFleet(fleet);
   const secretInputs = mode === "apply" ? attendedSecretNames(configs[0]) : [];
@@ -16797,6 +16834,47 @@ async function applyOperatorMetalBootstrap(request, mode, options = {}) {
   }
 }
 
+// src/attended-platform-bootstrap.ts
+var invitationFrom = (fleet, master) => {
+  const output = fleet.outcomes.find(({ computeReference }) => computeReference === master)?.output;
+  try {
+    const parsed = JSON.parse(output ?? "");
+    if (typeof parsed.launch?.inviteUrl === "string")
+      return parsed.launch.inviteUrl;
+  } catch {}
+  throw new Error("platform bootstrap completed without the initial custodian invitation");
+};
+async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, acceptancePath, secrets, dependencies = {}) {
+  if (cloudflareRequest.mode !== "apply")
+    throw new Error("attended platform bootstrap requires Cloudflare apply mode");
+  if (!secrets.cloudflareTunnelToken || !secrets.cloudflareApiToken) {
+    throw new Error("attended platform bootstrap requires both Cloudflare tokens");
+  }
+  const fleetCoordinates = operatorPlatformFleetCoordinates(fleetRequest);
+  if (cloudflareRequest.coordinates.nodes.length !== fleetCoordinates.nodes.length || fleetCoordinates.nodes.some((node, index) => {
+    const edge2 = cloudflareRequest.coordinates.nodes[index];
+    return edge2?.nodeName !== node.computeReference || edge2.hostname !== node.nodeHostname || edge2.service !== "http://127.0.0.1:3000";
+  })) {
+    throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
+  }
+  const edge = await (dependencies.cloudflare ?? runAttendedCloudflareBootstrap)({
+    ...cloudflareRequest,
+    tokens: {
+      tunnelToken: secrets.cloudflareTunnelToken,
+      apiToken: secrets.cloudflareApiToken
+    }
+  });
+  const fleet = await (dependencies.fleet ?? applyOperatorPlatformFleetBootstrap)(fleetRequest, "apply", { secrets });
+  if (!fleet.ok)
+    return { kind: "forgezero-attended-platform-bootstrap", ok: false, edge, fleet };
+  const inviteUrl = invitationFrom(fleet, fleetCoordinates.nodes[0].computeReference);
+  const acceptance = await (dependencies.finalize ?? finalizeCloudflareBootstrapAcceptance)({
+    checkpointPath: edge.checkpointFile,
+    acceptancePath
+  });
+  return { kind: "forgezero-attended-platform-bootstrap", ok: true, edge, fleet, acceptance, inviteUrl };
+}
+
 // src/platform-genesis-config.ts
 function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region) {
   const fleet = validatePlatformGenesisGuests(guests);
@@ -18102,7 +18180,8 @@ function writePlatformGenesisFleet(directory) {
   const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
   const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile).metalHostname;
-  const template = interactiveBootstrap("platform", fleet);
+  const checkpointPath = join12(output, "cloudflare-handoff.json");
+  const template = interactiveBootstrap("platform", fleet, checkpointPath);
   const region = {
     label: bootstrapAnswer(`Region ${template.runtime.environment.nodeRegion} display label`),
     country: bootstrapAnswer("Region ISO 3166-1 alpha-2 country code").toUpperCase(),
@@ -18110,11 +18189,32 @@ function writePlatformGenesisFleet(directory) {
   };
   const nodes = fleet.map((guest, index) => index === 0 ? {
     nodeHostname: template.nodeHostname,
-    cloudflareHandoffFile: template.cloudflareHandoff.handoffFile
+    cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   } : {
     nodeHostname: bootstrapAnswer(`${guest.name} public node hostname`),
-    cloudflareHandoffFile: bootstrapAnswer(`${guest.name} node-specific Cloudflare host handoff`)
+    cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   });
+  const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
+  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapCommandConfig({
+    checkpointPath,
+    coordinates: {
+      accountId: bootstrapAnswer("Cloudflare account id"),
+      zoneId: bootstrapAnswer("Cloudflare zone id"),
+      kvNamespaceId: bootstrapAnswer("Existing Worker-bound KV namespace id"),
+      ...realtimeEnabled ? { realtime: {
+        workerScriptName: bootstrapAnswer("Existing Worker script name"),
+        endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
+        producer: bootstrapAnswer("Realtime producer identity", "platform-api")
+      } } : {},
+      nodes: fleet.map((guest, index) => ({
+        nodeName: guest.name,
+        hostname: nodes[index].nodeHostname,
+        service: "http://127.0.0.1:3000",
+        tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
+      }))
+    }
+  }));
+  const cloudflareAcceptance = join12(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     writeBootstrapConfig(path, config);
@@ -18144,10 +18244,10 @@ function writePlatformGenesisFleet(directory) {
       }
     });
   });
-  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests);
-  return { configs, requests, fleetRequest };
+  const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join12(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
+  return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
-function interactiveBootstrap(kind, genesisGuests) {
+function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
   const environment = bootstrapAnswer("Environment (production/development)", "production");
@@ -18187,7 +18287,7 @@ function interactiveBootstrap(kind, genesisGuests) {
   const backupRegion = backupEndpoint ? bootstrapAnswer("Backup S3 region") : undefined;
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
-  const cloudflareHandoffFile = bootstrapAnswer(genesis ? `${computeReference} node-specific Cloudflare host handoff` : "Node-specific Cloudflare host handoff (blank for no public edge)", genesis ? undefined : "");
+  const cloudflareHandoffFile = genesis ? cloudflareHostHandoffPath(genesisCloudflareCheckpoint, computeReference) : bootstrapAnswer("Node-specific Cloudflare host handoff (blank for no public edge)", "");
   const cloudflareNodeName = cloudflareHandoffFile ? bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
   const enrolmentSource = genesis ? "genesis-derived" : bootstrapAnswer("Enrolment source (genesis-derived/api-token)", "genesis-derived");
@@ -18293,19 +18393,49 @@ async function cmdBootstrap(options, args) {
         throw new Error("remote platform fleet bootstrap requires --bootstrap-config");
       const fleet = readOperatorPlatformBootstrapFleetRequest(options.bootstrapConfigPath);
       const plan2 = planOperatorPlatformFleetBootstrap(fleet, mode);
+      const cloudflare = readCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, options.apply && mode === "apply" ? "apply" : "plan");
+      const coordinates = operatorPlatformFleetCoordinates(fleet);
+      if (cloudflare.coordinates.nodes.length !== coordinates.nodes.length || coordinates.nodes.some((node, index) => {
+        const edge = cloudflare.coordinates.nodes[index];
+        return edge?.nodeName !== node.computeReference || edge.hostname !== node.nodeHostname || edge.service !== "http://127.0.0.1:3000";
+      })) {
+        throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
+      }
       if (!options.apply) {
-        out.line(JSON.stringify(plan2, null, 2));
-        out.step("Review all three pinned targets and shared secret names, then repeat with --apply.");
+        out.line(JSON.stringify({
+          kind: "forgezero-attended-platform-bootstrap-plan",
+          mutation: true,
+          cloudflare: {
+            checkpointFile: cloudflare.checkpointPath,
+            nodes: cloudflare.coordinates.nodes.map(({ nodeName, hostname: hostname2 }) => ({ nodeName, hostname: hostname2 }))
+          },
+          fleet: plan2,
+          acceptanceFile: fleet.cloudflareAcceptanceFile,
+          completion: ["public ingress verified", "initial custodian invitation printed"]
+        }, null, 2));
+        out.step("Review the complete Tunnel, hostname, bundle, credential and three-node plan, then repeat with --apply.");
         return 0;
       }
       const first = readOperatorPlatformBootstrapRequest(fleet.requests[0]);
       const firstConfig = readBootstrapConfig(first.platformConfigFile);
       if (firstConfig.kind !== "platform")
         throw new Error("remote platform fleet requires platform configs");
+      if (mode === "status") {
+        const result3 = await applyOperatorPlatformFleetBootstrap(fleet, mode);
+        out.line(JSON.stringify(result3, null, 2));
+        return result3.ok ? 0 : 1;
+      }
       const secrets2 = mode === "apply" ? await promptPlatformBootstrapSecrets(firstConfig) : undefined;
-      const result2 = await applyOperatorPlatformFleetBootstrap(fleet, mode, { secrets: secrets2 });
+      if (!secrets2?.cloudflareTunnelToken || !secrets2.cloudflareApiToken) {
+        throw new Error("attended platform bootstrap requires both Cloudflare tokens");
+      }
+      const result2 = await applyAttendedPlatformBootstrap(fleet, cloudflare, fleet.cloudflareAcceptanceFile, secrets2);
       out.line(JSON.stringify(result2, null, 2));
-      return result2.ok ? 0 : 1;
+      if (!result2.ok)
+        return 1;
+      out.line();
+      out.step(`Initial custodian invitation: ${result2.inviteUrl}`);
+      return 0;
     }
     if (operation === "platform" && args[1] === "remote") {
       const mode = args[2];
@@ -19032,14 +19162,16 @@ function usage() {
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host; apply copies and verifies that bundle
 	 fz bootstrap platform fleet <apply|status>
-	                         Validate the exact three-node genesis identity, prompt
-	                         shared secrets once and run all pinned nodes concurrently
+	                         One attended genesis operation: reconcile public
+	                         hostnames/Tunnels, seal credentials, deploy the bundle,
+	                         run all three nodes, verify ingress and print the invite
 	 fz bootstrap platform   Install/repair a typed elastic platform compute
 	 fz bootstrap config <metal|platform|cloudflare>
 	                         Write validated owner-only metal config+remote request,
-	                         Cloudflare file, or complete three-node platform request set
+	                         low-level Cloudflare file, or the complete three-node
+	                         platform + Cloudflare request set
 	 fz bootstrap platform cloudflare
-	                         Plan/apply attended Tunnel and DNS reconciliation
+	                         Low-level resume/diagnostic Tunnel and DNS reconciliation
 	                         using hidden management and KV/Worker runtime token prompts
 	 fz bootstrap platform cloudflare verify
 	                         From the operator laptop, prove every ordinary public

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.68";
+var VERSION = "0.1.69";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.d.ts

@@ -40,6 +40,10 @@ export interface OperatorGuestHostKeyEvidence {
 export interface OperatorPlatformBootstrapFleetRequest {
     kind: 'platform-fleet-remote';
     requests: readonly [string, string, string];
+    /** Reviewed non-secret coordinates for the attended Tunnel/DNS/KV/DO phase. */
+    cloudflareConfigFile: string;
+    /** Secret-free evidence retained after checkpoint and host handoffs are consumed. */
+    cloudflareAcceptanceFile: string;
 }
 export interface OperatorPlatformBootstrapFleetPlan {
     kind: 'platform-fleet-remote';
@@ -123,7 +127,10 @@ export declare function createOperatorSshHop(input: Omit<OperatorSshHop, 'hostKe
 export declare function readOperatorPlatformBootstrapRequest(path: string): OperatorPlatformBootstrapRequest;
 export declare function writeOperatorPlatformBootstrapRequest(path: string, request: OperatorPlatformBootstrapRequest): string;
 export declare function readOperatorPlatformBootstrapFleetRequest(path: string): OperatorPlatformBootstrapFleetRequest;
-export declare function writeOperatorPlatformBootstrapFleetRequest(path: string, requestFiles: readonly [string, string, string]): string;
+export declare function writeOperatorPlatformBootstrapFleetRequest(path: string, requestFiles: readonly [string, string, string], cloudflare: {
+    configFile: string;
+    acceptanceFile: string;
+}): string;
 export declare function readOperatorMetalBootstrapRequest(path: string): OperatorMetalBootstrapRequest;
 export declare function writeOperatorMetalBootstrapRequest(path: string, request: OperatorMetalBootstrapRequest): string;
 export declare function readOperatorGuestHostKeyEvidence(path: string, request?: OperatorMetalBootstrapRequest): OperatorGuestHostKeyEvidence;

package/dist/operator-bootstrap.js

@@ -1396,7 +1396,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.68";
+var VERSION = "0.1.69";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -4380,6 +4380,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
   }
   bindBootstrapIntent(host, config);
   const plan = planBootstrap(config, host.exists(STATE_PATH));
+  await checked3(host, ["hostnamectl", "set-hostname", "--static", config.nodeHostname], "compute hostname");
   const alreadyEnrolled = host.exists("/var/lib/forgezero/enrolment.json");
   host.mkdir(CREDS, 448);
   host.mkdir("/var/lib/forgezero", 448);
@@ -5971,7 +5972,12 @@ function writeOperatorPlatformBootstrapRequest(path, request) {
 }
 function readOperatorPlatformBootstrapFleetRequest(path) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator fleet request")));
-  const root = exactKeys3(value, ["kind", "requests"], "operator fleet request");
+  const root = exactKeys3(value, [
+    "kind",
+    "requests",
+    "cloudflareConfigFile",
+    "cloudflareAcceptanceFile"
+  ], "operator fleet request");
   if (root.kind !== "platform-fleet-remote")
     throw new Error("operator fleet kind must be platform-fleet-remote");
   if (!Array.isArray(root.requests) || root.requests.length !== 3 || root.requests.some((entry) => typeof entry !== "string")) {
@@ -5982,10 +5988,25 @@ function readOperatorPlatformBootstrapFleetRequest(path) {
     throw new Error("operator fleet request files must be unique");
   for (const request of requests)
     readOperatorPlatformBootstrapRequest(request);
-  return { kind: "platform-fleet-remote", requests };
+  if (typeof root.cloudflareConfigFile !== "string" || typeof root.cloudflareAcceptanceFile !== "string") {
+    throw new Error("operator fleet requires Cloudflare coordinates and an acceptance evidence path");
+  }
+  const cloudflareConfigFile = canonicalOutputPath(root.cloudflareConfigFile, "operator fleet Cloudflare config");
+  const cloudflareAcceptanceFile = canonicalOutputPath(root.cloudflareAcceptanceFile, "operator fleet Cloudflare acceptance evidence");
+  return {
+    kind: "platform-fleet-remote",
+    requests,
+    cloudflareConfigFile,
+    cloudflareAcceptanceFile
+  };
 }
-function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles) {
-  const request = { kind: "platform-fleet-remote", requests: requestFiles };
+function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudflare) {
+  const request = {
+    kind: "platform-fleet-remote",
+    requests: requestFiles,
+    cloudflareConfigFile: canonicalOutputPath(cloudflare.configFile, "operator fleet Cloudflare config"),
+    cloudflareAcceptanceFile: canonicalOutputPath(cloudflare.acceptanceFile, "operator fleet Cloudflare acceptance evidence")
+  };
   if (new Set(requestFiles).size !== 3)
     throw new Error("operator fleet request files must be unique");
   for (const file of requestFiles)

package/dist/platform-fleet-verification.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.68";
+var VERSION3 = "0.1.69";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.68";
+var VERSION3 = "0.1.69";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.68";
+export declare const VERSION = "0.1.69";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.68",
+  "version": "0.1.69",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",