@forgezero/agent 0.1.69 → 0.1.71

package/README.md

@@ -644,7 +644,7 @@ import type {
 <a id="forgezero-agent-cloudflare-bootstrap"></a>
 ## @forgezero/agent/cloudflare-bootstrap
 
-Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. This entry exposes 13 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. This entry exposes 14 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
@@ -659,6 +659,7 @@ import {
   runAttendedCloudflareBootstrap,
   validateCloudflareBootstrapCoordinates,
   validateCloudflareBootstrapTokens,
+  validateCloudflareBootstrapTopology,
   verifyCloudflareBootstrapAcceptance,
   writeOwnerBootstrapOutput,
 } from '@forgezero/agent/cloudflare-bootstrap';
@@ -676,6 +677,7 @@ import type {
   CloudflareBootstrapPhaseRunner,
   CloudflareBootstrapPlan,
   CloudflareBootstrapTokens,
+  CloudflareBootstrapTopology,
   CloudflareConnectorHandoff,
   CloudflareHostHandoff,
   CloudflareMeshCoordinates,

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.69";
+var VERSION3 = "0.1.71";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -450,20 +450,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -570,9 +567,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -580,6 +574,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -1396,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.69";
+var VERSION = "0.1.71";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,4 +1,4 @@
-import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokens } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokens, type CloudflareBootstrapNodeCoordinates } from '../cloudflare-bootstrap';
 import { discoverCloudflareBootstrapResources, type CloudflareBootstrapDiscovery } from '../cloudflare-edge';
 export interface CloudflareBootstrapCommandConfig {
     format: 1;
@@ -6,6 +6,29 @@ export interface CloudflareBootstrapCommandConfig {
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
 }
+/**
+ * Human-reviewable discovery coordinates used by the integrated platform
+ * launch. Cloudflare ids are deliberately absent: the two hidden tokens resolve
+ * and bind them immediately before apply.
+ */
+export interface CloudflareBootstrapDiscoveryCommandConfig {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-discovery-request';
+    checkpointPath: string;
+    discovery: {
+        zoneName: string;
+        kvNamespaceTitle: string;
+        workerScriptName?: string;
+        endpoint?: string;
+        producer?: string;
+    };
+    nodes: readonly CloudflareBootstrapNodeCoordinates[];
+}
+export interface CloudflareBootstrapCommandPlan {
+    checkpointPath: string;
+    nodes: readonly CloudflareBootstrapNodeCoordinates[];
+    discovery?: CloudflareBootstrapDiscoveryCommandConfig['discovery'];
+}
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
@@ -33,11 +56,24 @@ export declare function createCloudflareBootstrapCommandConfig(input: {
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
 }): CloudflareBootstrapCommandConfig;
+/** Create the secret-free, name-based request used by one-command genesis. */
+export declare function createCloudflareBootstrapDiscoveryCommandConfig(input: {
+    checkpointPath: string;
+    discovery: CloudflareBootstrapDiscoveryCommandConfig['discovery'];
+    nodes: readonly CloudflareBootstrapNodeCoordinates[];
+}): CloudflareBootstrapDiscoveryCommandConfig;
 /**
  * Read reviewed non-secret coordinates for the attended operator phase. Raw
  * token values and a persisted mode are not schema fields.
  */
 export declare function readCloudflareBootstrapCommandConfig(path: string, mode: 'plan' | 'apply'): AttendedCloudflareBootstrapRequest;
+export declare function readCloudflareBootstrapDiscoveryCommandConfig(path: string): CloudflareBootstrapDiscoveryCommandConfig;
+/** Read either supported request shape without contacting Cloudflare. */
+export declare function readCloudflareBootstrapCommandPlan(path: string): CloudflareBootstrapCommandPlan;
+/** Resolve name selectors with hidden credentials immediately before apply. */
+export declare function resolveCloudflareBootstrapCommandConfig(path: string, tokens: CloudflareBootstrapTokens, dependencies?: {
+    discover?: typeof discoverCloudflareBootstrapCommandResources;
+}): Promise<AttendedCloudflareBootstrapRequest>;
 export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, tokens?: CloudflareBootstrapTokens, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function runCloudflareBootstrapVerificationCommand(checkpointPath: string, dependencies?: {
     verify?: typeof verifyCloudflareBootstrapAcceptance;

package/dist/cloudflare-bootstrap.d.ts

@@ -115,6 +115,13 @@ export interface CloudflareBootstrapDependencies {
 }
 export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
 export declare function validateCloudflareBootstrapTokens(input: unknown): CloudflareBootstrapTokens;
+export interface CloudflareBootstrapTopology {
+    meshDevicePolicyId?: string;
+    realtime?: CloudflareRealtimeCoordinates;
+    nodes: CloudflareBootstrapNodeCoordinates[];
+}
+/** Validate the fleet/realtime shape without inventing resource identifiers. */
+export declare function validateCloudflareBootstrapTopology(input: CloudflareBootstrapTopology): CloudflareBootstrapTopology;
 export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
 export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
 export interface CloudflareConnectorHandoff {

package/dist/cloudflare-bootstrap.js

@@ -450,20 +450,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -570,9 +567,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -580,6 +574,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -1211,6 +1231,7 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 export {
   writeOwnerBootstrapOutput,
   verifyCloudflareBootstrapAcceptance,
+  validateCloudflareBootstrapTopology,
   validateCloudflareBootstrapTokens,
   validateCloudflareBootstrapCoordinates,
   runAttendedCloudflareBootstrap,

package/dist/fz-agent.js

@@ -8588,7 +8588,7 @@ import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/version.ts
-var VERSION2 = "0.1.69";
+var VERSION2 = "0.1.71";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.69";
+var VERSION2 = "0.1.71";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12551,20 +12551,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -12671,9 +12668,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -12681,6 +12675,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -14970,6 +14990,56 @@ function createCloudflareBootstrapCommandConfig(input) {
     coordinates: validateCloudflareBootstrapCoordinates(input.coordinates)
   };
 }
+var normalizeDiscovery = (input) => {
+  const zoneName = input.zoneName.trim().toLowerCase().replace(/\.$/, "");
+  const kvNamespaceTitle = input.kvNamespaceTitle.trim();
+  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(zoneName)) {
+    throw new Error("Cloudflare zone name is invalid");
+  }
+  if (!kvNamespaceTitle || kvNamespaceTitle.length > 512) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const workerScriptName = input.workerScriptName?.trim();
+  const endpoint2 = input.endpoint?.trim();
+  const producer = input.producer?.trim();
+  if ([workerScriptName, endpoint2, producer].filter((value) => value !== undefined).length !== 0 && (!workerScriptName || !endpoint2 || !producer)) {
+    throw new Error("Cloudflare realtime discovery requires Worker name, endpoint, and producer together");
+  }
+  return {
+    zoneName,
+    kvNamespaceTitle,
+    ...workerScriptName ? { workerScriptName, endpoint: endpoint2, producer } : {}
+  };
+};
+function createCloudflareBootstrapDiscoveryCommandConfig(input) {
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  const discovery = normalizeDiscovery(input.discovery);
+  const normalized = validateCloudflareBootstrapTopology({
+    ...discovery.workerScriptName ? { realtime: {
+      workerScriptName: discovery.workerScriptName,
+      endpoint: discovery.endpoint,
+      producer: discovery.producer
+    } } : {},
+    nodes: [...input.nodes]
+  });
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-discovery-request",
+    checkpointPath: input.checkpointPath.trim(),
+    discovery: {
+      zoneName: discovery.zoneName,
+      kvNamespaceTitle: discovery.kvNamespaceTitle,
+      ...normalized.realtime ? {
+        workerScriptName: normalized.realtime.workerScriptName,
+        endpoint: normalized.realtime.endpoint,
+        producer: normalized.realtime.producer
+      } : {}
+    },
+    nodes: normalized.nodes
+  };
+}
 function readOwnerConfig(path) {
   const absolute2 = resolve7(path);
   let descriptor;
@@ -15037,6 +15107,79 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
     checkpointPath: resolve7(baseDirectory, input.checkpointPath)
   };
 }
+function readCloudflareBootstrapDiscoveryCommandConfig(path) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap discovery config");
+  const baseDirectory = dirname10(resolve7(path));
+  exactKeys3(input, ["format", "kind", "checkpointPath", "discovery", "nodes"], "Cloudflare bootstrap discovery config");
+  if (input.format !== 1 || input.kind !== "forgezero-cloudflare-bootstrap-discovery-request") {
+    throw new Error("Cloudflare bootstrap discovery config format/kind is invalid");
+  }
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  const discovery = record2(input.discovery, "Cloudflare bootstrap discovery selectors");
+  exactKeys3(discovery, [
+    "zoneName",
+    "kvNamespaceTitle",
+    "workerScriptName",
+    "endpoint",
+    "producer"
+  ], "Cloudflare bootstrap discovery selectors");
+  if (!Array.isArray(input.nodes))
+    throw new Error("Cloudflare bootstrap discovery nodes must be an array");
+  for (const node of input.nodes) {
+    exactKeys3(record2(node, "Cloudflare bootstrap node"), [
+      "nodeName",
+      "hostname",
+      "service",
+      "tunnelName",
+      "mesh"
+    ], "Cloudflare bootstrap node");
+  }
+  const created = createCloudflareBootstrapDiscoveryCommandConfig({
+    checkpointPath: resolve7(baseDirectory, input.checkpointPath),
+    discovery,
+    nodes: input.nodes
+  });
+  return created;
+}
+function readCloudflareBootstrapCommandPlan(path) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
+  if (input.kind === "forgezero-cloudflare-bootstrap-discovery-request") {
+    const config = readCloudflareBootstrapDiscoveryCommandConfig(path);
+    return { checkpointPath: config.checkpointPath, nodes: config.nodes, discovery: config.discovery };
+  }
+  const request = readCloudflareBootstrapCommandConfig(path, "plan");
+  return { checkpointPath: request.checkpointPath, nodes: request.coordinates.nodes };
+}
+async function resolveCloudflareBootstrapCommandConfig(path, tokens, dependencies = {}) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
+  if (input.kind !== "forgezero-cloudflare-bootstrap-discovery-request") {
+    const request = readCloudflareBootstrapCommandConfig(path, "apply");
+    request.tokens = tokens;
+    return request;
+  }
+  const config = readCloudflareBootstrapDiscoveryCommandConfig(path);
+  const coordinates = await (dependencies.discover ?? discoverCloudflareBootstrapCommandResources)({
+    zoneName: config.discovery.zoneName,
+    kvNamespaceTitle: config.discovery.kvNamespaceTitle,
+    ...config.discovery.workerScriptName ? { workerScriptName: config.discovery.workerScriptName } : {},
+    tokens
+  });
+  return {
+    mode: "apply",
+    checkpointPath: config.checkpointPath,
+    coordinates: validateCloudflareBootstrapCoordinates({
+      ...coordinates,
+      ...config.discovery.workerScriptName ? { realtime: {
+        workerScriptName: config.discovery.workerScriptName,
+        endpoint: config.discovery.endpoint,
+        producer: config.discovery.producer
+      } } : {},
+      nodes: [...config.nodes]
+    })
+  };
+}
 async function runCloudflareBootstrapCommand(configPath, apply, tokens, dependencies = {}) {
   const request = readCloudflareBootstrapCommandConfig(configPath, apply ? "apply" : "plan");
   if (apply)
@@ -15981,6 +16124,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     problems.push("metal helper socket is not ready");
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
+  const versionResult = await exec([AGENT_PATH, "--version"]);
+  const installedAgentVersion = versionResult.exitCode === 0 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(versionResult.stdout.trim()) ? versionResult.stdout.trim() : undefined;
+  if (!installedAgentVersion)
+    problems.push("installed Metal Agent version is unavailable or malformed");
   return {
     initialized: existsSync10(STATE_PATH2),
     profileValid,
@@ -15990,6 +16137,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     helperSocketReady,
     updateSocketReady,
     metalHostname,
+    installedAgentVersion,
     problems
   };
 }
@@ -16173,7 +16321,7 @@ function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudfla
     readOperatorPlatformBootstrapRequest(file);
   return writeOwnerJson2(path, request, "operator fleet request");
 }
-var validateMetalRequestValue = (value) => {
+var validateMetalRequestValue = (value, options = {}) => {
   const root = exactKeys5(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
@@ -16193,7 +16341,8 @@ var validateMetalRequestValue = (value) => {
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
-  readMetalBootstrapConfig(root.metalConfigFile);
+  if (options.validateMetalConfig !== false)
+    readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys5(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
   const guest = (value2, label) => {
     const row2 = exactKeys5(value2, [
@@ -16252,9 +16401,9 @@ var validateMetalRequestValue = (value) => {
     }
   };
 };
-function readOperatorMetalBootstrapRequest(path) {
+function readOperatorMetalBootstrapRequest(path, options = {}) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal request")));
-  return validateMetalRequestValue(value);
+  return validateMetalRequestValue(value, options);
 }
 function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
@@ -16303,7 +16452,7 @@ function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
   return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
 }
 function planOperatorMetalBootstrap(request, mode) {
-  const config = readMetalBootstrapConfig(request.metalConfigFile);
+  const config = mode === "apply" ? readMetalBootstrapConfig(request.metalConfigFile) : undefined;
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
@@ -16323,7 +16472,7 @@ function planOperatorMetalBootstrap(request, mode) {
       "remove transient local and remote staging data"
     ],
     genesisNodes,
-    secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
+    secretInputs: config?.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
 var secretSources = (config) => [
@@ -16475,7 +16624,10 @@ var defaultExec3 = async (argv2, options = {}) => {
     new Response(child.stderr).text(),
     child.exited
   ]);
-  return { exitCode, output: options.secret ? "" : `${stdout}${stderr}`.slice(0, 65536) };
+  return {
+    exitCode,
+    output: options.secret ? options.safeStdout && exitCode === 0 ? stdout.slice(0, 65536) : "" : `${stdout}${stderr}`.slice(0, 65536)
+  };
 };
 var checked5 = async (exec, argv2, label, options) => {
   const result = await exec(argv2, options);
@@ -16529,9 +16681,13 @@ var safeRemoteArg = (value) => {
   if (!/^[A-Za-z0-9_+.,:@%/=\/-]{1,1024}$/.test(value))
     throw new Error(`unsafe remote argument: ${value}`);
 };
-var remote = async (exec, request, knownHosts, argv2, label, secret = false, stdin) => {
+var remote = async (exec, request, knownHosts, argv2, label, secret = false, stdin, safeStdout = false) => {
   argv2.forEach(safeRemoteArg);
-  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv2], label, { secret, stdin });
+  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv2], label, {
+    secret,
+    stdin,
+    safeStdout
+  });
 };
 var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   safeRemoteArg(path);
@@ -16736,7 +16892,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
-` : undefined);
+` : undefined, mode === "apply");
     return { plan, output };
   } finally {
     if (knownHosts) {
@@ -18195,24 +18351,23 @@ function writePlatformGenesisFleet(directory) {
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   });
   const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
-  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapCommandConfig({
+  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
-    coordinates: {
-      accountId: bootstrapAnswer("Cloudflare account id"),
-      zoneId: bootstrapAnswer("Cloudflare zone id"),
-      kvNamespaceId: bootstrapAnswer("Existing Worker-bound KV namespace id"),
-      ...realtimeEnabled ? { realtime: {
+    discovery: {
+      zoneName: bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
+      kvNamespaceTitle: bootstrapAnswer("Existing Worker-bound KV namespace title"),
+      ...realtimeEnabled ? {
         workerScriptName: bootstrapAnswer("Existing Worker script name"),
         endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
         producer: bootstrapAnswer("Realtime producer identity", "platform-api")
-      } } : {},
-      nodes: fleet.map((guest, index) => ({
-        nodeName: guest.name,
-        hostname: nodes[index].nodeHostname,
-        service: "http://127.0.0.1:3000",
-        tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
-      }))
-    }
+      } : {}
+    },
+    nodes: fleet.map((guest, index) => ({
+      nodeName: guest.name,
+      hostname: nodes[index].nodeHostname,
+      service: "http://127.0.0.1:3000",
+      tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
+    }))
   }));
   const cloudflareAcceptance = join12(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
@@ -18363,6 +18518,50 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
     } : {}
   };
 }
+async function runAttendedPlatformFleet(fleet, apply) {
+  const plan = planOperatorPlatformFleetBootstrap(fleet, "apply");
+  const cloudflarePlan = readCloudflareBootstrapCommandPlan(fleet.cloudflareConfigFile);
+  const coordinates = operatorPlatformFleetCoordinates(fleet);
+  if (cloudflarePlan.nodes.length !== coordinates.nodes.length || coordinates.nodes.some((node, index) => {
+    const edge = cloudflarePlan.nodes[index];
+    return edge?.nodeName !== node.computeReference || edge.hostname !== node.nodeHostname || edge.service !== "http://127.0.0.1:3000";
+  })) {
+    throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
+  }
+  const attendedPlan = {
+    kind: "forgezero-attended-platform-bootstrap-plan",
+    mutation: true,
+    cloudflare: {
+      checkpointFile: cloudflarePlan.checkpointPath,
+      ...cloudflarePlan.discovery ? { discovery: cloudflarePlan.discovery } : {},
+      nodes: cloudflarePlan.nodes.map(({ nodeName, hostname: hostname2 }) => ({ nodeName, hostname: hostname2 }))
+    },
+    fleet: plan,
+    acceptanceFile: fleet.cloudflareAcceptanceFile,
+    completion: ["public ingress verified", "initial custodian invitation printed"]
+  };
+  out.line(JSON.stringify(attendedPlan, null, 2));
+  if (!apply) {
+    out.step("Review the generated plan, then apply its platform-fleet-remote.json with fz bootstrap platform fleet apply --apply.");
+    return 0;
+  }
+  const first = readOperatorPlatformBootstrapRequest(fleet.requests[0]);
+  const firstConfig = readBootstrapConfig(first.platformConfigFile);
+  if (firstConfig.kind !== "platform")
+    throw new Error("remote platform fleet requires platform configs");
+  const secrets = await promptPlatformBootstrapSecrets(firstConfig);
+  const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
+    tunnelToken: secrets.cloudflareTunnelToken,
+    apiToken: secrets.cloudflareApiToken
+  });
+  const result = await applyAttendedPlatformBootstrap(fleet, cloudflare, fleet.cloudflareAcceptanceFile, secrets);
+  out.line(JSON.stringify(result, null, 2));
+  if (!result.ok)
+    return 1;
+  out.line();
+  out.step(`Initial custodian invitation: ${result.inviteUrl}`);
+  return 0;
+}
 async function cmdBootstrap(options, args) {
   try {
     const operation = args[0] ?? "status";
@@ -18384,6 +18583,17 @@ async function cmdBootstrap(options, args) {
       out.line(JSON.stringify({ kind, ...writeMetalOperatorFiles(options.outputPath), mode: "0600" }, null, 2));
       return 0;
     }
+    if (operation === "platform" && args[1] === "launch") {
+      if (args[2] !== undefined || !options.outputPath || options.bootstrapConfigPath) {
+        throw new Error("Usage: fz bootstrap platform launch --output <absolute-owner-only-directory> [--apply]");
+      }
+      const generated = writePlatformGenesisFleet(options.outputPath);
+      const fleet = readOperatorPlatformBootstrapFleetRequest(generated.fleetRequest);
+      if (options.apply && bootstrapAnswer("Type APPLY to run the reviewed Cloudflare and three-compute plan") !== "APPLY") {
+        throw new Error("attended platform bootstrap was not confirmed");
+      }
+      return await runAttendedPlatformFleet(fleet, options.apply);
+    }
     if (operation === "platform" && args[1] === "fleet") {
       const mode = args[2];
       if (!mode || !["apply", "status"].includes(mode) || args[3] !== undefined) {
@@ -18392,50 +18602,12 @@ async function cmdBootstrap(options, args) {
       if (!options.bootstrapConfigPath)
         throw new Error("remote platform fleet bootstrap requires --bootstrap-config");
       const fleet = readOperatorPlatformBootstrapFleetRequest(options.bootstrapConfigPath);
-      const plan2 = planOperatorPlatformFleetBootstrap(fleet, mode);
-      const cloudflare = readCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, options.apply && mode === "apply" ? "apply" : "plan");
-      const coordinates = operatorPlatformFleetCoordinates(fleet);
-      if (cloudflare.coordinates.nodes.length !== coordinates.nodes.length || coordinates.nodes.some((node, index) => {
-        const edge = cloudflare.coordinates.nodes[index];
-        return edge?.nodeName !== node.computeReference || edge.hostname !== node.nodeHostname || edge.service !== "http://127.0.0.1:3000";
-      })) {
-        throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
-      }
-      if (!options.apply) {
-        out.line(JSON.stringify({
-          kind: "forgezero-attended-platform-bootstrap-plan",
-          mutation: true,
-          cloudflare: {
-            checkpointFile: cloudflare.checkpointPath,
-            nodes: cloudflare.coordinates.nodes.map(({ nodeName, hostname: hostname2 }) => ({ nodeName, hostname: hostname2 }))
-          },
-          fleet: plan2,
-          acceptanceFile: fleet.cloudflareAcceptanceFile,
-          completion: ["public ingress verified", "initial custodian invitation printed"]
-        }, null, 2));
-        out.step("Review the complete Tunnel, hostname, bundle, credential and three-node plan, then repeat with --apply.");
-        return 0;
-      }
-      const first = readOperatorPlatformBootstrapRequest(fleet.requests[0]);
-      const firstConfig = readBootstrapConfig(first.platformConfigFile);
-      if (firstConfig.kind !== "platform")
-        throw new Error("remote platform fleet requires platform configs");
       if (mode === "status") {
-        const result3 = await applyOperatorPlatformFleetBootstrap(fleet, mode);
-        out.line(JSON.stringify(result3, null, 2));
-        return result3.ok ? 0 : 1;
+        const result2 = await applyOperatorPlatformFleetBootstrap(fleet, mode);
+        out.line(JSON.stringify(result2, null, 2));
+        return result2.ok ? 0 : 1;
       }
-      const secrets2 = mode === "apply" ? await promptPlatformBootstrapSecrets(firstConfig) : undefined;
-      if (!secrets2?.cloudflareTunnelToken || !secrets2.cloudflareApiToken) {
-        throw new Error("attended platform bootstrap requires both Cloudflare tokens");
-      }
-      const result2 = await applyAttendedPlatformBootstrap(fleet, cloudflare, fleet.cloudflareAcceptanceFile, secrets2);
-      out.line(JSON.stringify(result2, null, 2));
-      if (!result2.ok)
-        return 1;
-      out.line();
-      out.step(`Initial custodian invitation: ${result2.inviteUrl}`);
-      return 0;
+      return await runAttendedPlatformFleet(fleet, options.apply);
     }
     if (operation === "platform" && args[1] === "remote") {
       const mode = args[2];
@@ -18480,7 +18652,9 @@ async function cmdBootstrap(options, args) {
       if ((mode === "host-keys" || mode === "rehearsal-host-keys") && !options.outputPath) {
         throw new Error(`${mode} requires --output <absolute-owner-only-evidence.json>`);
       }
-      const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath);
+      const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath, {
+        validateMetalConfig: mode === "apply"
+      });
       const plan2 = planOperatorMetalBootstrap(request, mode);
       if (!options.apply) {
         out.line(JSON.stringify(plan2, null, 2));
@@ -18583,7 +18757,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [launch|bundle|fleet <apply|status>|remote <apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|rehearsal-cleanup|host-keys|rehearsal-host-keys|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -19158,6 +19332,9 @@ function usage() {
                             local socket instead of holding an API key
 	 fz bootstrap platform bundle
 	                         Build one clean exact-revision API Git bundle for genesis
+	 fz bootstrap platform launch
+	                         Prompt, review and run the complete attended platform
+	                         bootstrap; --output is the owner-only working directory
 	 fz bootstrap platform remote <apply|status>
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host; apply copies and verifies that bundle

package/dist/metal-bootstrap.d.ts

@@ -28,6 +28,7 @@ export interface MetalBootstrapStatus {
     helperSocketReady: boolean;
     updateSocketReady: boolean;
     metalHostname?: string;
+    installedAgentVersion?: string;
     problems: string[];
 }
 export interface MetalBootstrapResult extends MetalBootstrapStatus {

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.69";
+var VERSION = "0.1.71";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -1181,6 +1181,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     problems.push("metal helper socket is not ready");
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
+  const versionResult = await exec([AGENT_PATH, "--version"]);
+  const installedAgentVersion = versionResult.exitCode === 0 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(versionResult.stdout.trim()) ? versionResult.stdout.trim() : undefined;
+  if (!installedAgentVersion)
+    problems.push("installed Metal Agent version is unavailable or malformed");
   return {
     initialized: existsSync(STATE_PATH),
     profileValid,
@@ -1190,6 +1194,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     helperSocketReady,
     updateSocketReady,
     metalHostname,
+    installedAgentVersion,
     problems
   };
 }

package/dist/operator-bootstrap.d.ts

@@ -115,6 +115,7 @@ export interface OperatorCommandResult {
 export type OperatorCommand = (argv: readonly string[], options?: {
     stdin?: string;
     secret?: boolean;
+    safeStdout?: boolean;
 }) => Promise<OperatorCommandResult>;
 export interface OperatorPlatformBootstrapOptions {
     exec?: OperatorCommand;
@@ -131,7 +132,9 @@ export declare function writeOperatorPlatformBootstrapFleetRequest(path: string,
     configFile: string;
     acceptanceFile: string;
 }): string;
-export declare function readOperatorMetalBootstrapRequest(path: string): OperatorMetalBootstrapRequest;
+export declare function readOperatorMetalBootstrapRequest(path: string, options?: {
+    validateMetalConfig?: boolean;
+}): OperatorMetalBootstrapRequest;
 export declare function writeOperatorMetalBootstrapRequest(path: string, request: OperatorMetalBootstrapRequest): string;
 export declare function readOperatorGuestHostKeyEvidence(path: string, request?: OperatorMetalBootstrapRequest): OperatorGuestHostKeyEvidence;
 export declare function writeOperatorGuestHostKeyEvidence(path: string, evidence: OperatorGuestHostKeyEvidence, request?: OperatorMetalBootstrapRequest): string;

package/dist/operator-bootstrap.js

@@ -450,20 +450,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -570,9 +567,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -580,6 +574,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -1396,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.69";
+var VERSION = "0.1.71";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5815,6 +5835,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     problems.push("metal helper socket is not ready");
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
+  const versionResult = await exec([AGENT_PATH, "--version"]);
+  const installedAgentVersion = versionResult.exitCode === 0 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(versionResult.stdout.trim()) ? versionResult.stdout.trim() : undefined;
+  if (!installedAgentVersion)
+    problems.push("installed Metal Agent version is unavailable or malformed");
   return {
     initialized: existsSync6(STATE_PATH2),
     profileValid,
@@ -5824,6 +5848,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     helperSocketReady,
     updateSocketReady,
     metalHostname,
+    installedAgentVersion,
     problems
   };
 }
@@ -6013,7 +6038,7 @@ function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudfla
     readOperatorPlatformBootstrapRequest(file);
   return writeOwnerJson2(path, request, "operator fleet request");
 }
-var validateMetalRequestValue = (value) => {
+var validateMetalRequestValue = (value, options = {}) => {
   const root = exactKeys3(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
@@ -6033,7 +6058,8 @@ var validateMetalRequestValue = (value) => {
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
-  readMetalBootstrapConfig(root.metalConfigFile);
+  if (options.validateMetalConfig !== false)
+    readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys3(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
   const guest = (value2, label) => {
     const row = exactKeys3(value2, [
@@ -6092,9 +6118,9 @@ var validateMetalRequestValue = (value) => {
     }
   };
 };
-function readOperatorMetalBootstrapRequest(path) {
+function readOperatorMetalBootstrapRequest(path, options = {}) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal request")));
-  return validateMetalRequestValue(value);
+  return validateMetalRequestValue(value, options);
 }
 function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
@@ -6143,7 +6169,7 @@ function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
   return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
 }
 function planOperatorMetalBootstrap(request, mode) {
-  const config = readMetalBootstrapConfig(request.metalConfigFile);
+  const config = mode === "apply" ? readMetalBootstrapConfig(request.metalConfigFile) : undefined;
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
@@ -6163,7 +6189,7 @@ function planOperatorMetalBootstrap(request, mode) {
       "remove transient local and remote staging data"
     ],
     genesisNodes,
-    secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
+    secretInputs: config?.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
 var secretSources = (config) => [
@@ -6315,7 +6341,10 @@ var defaultExec3 = async (argv, options = {}) => {
     new Response(child.stderr).text(),
     child.exited
   ]);
-  return { exitCode, output: options.secret ? "" : `${stdout}${stderr}`.slice(0, 65536) };
+  return {
+    exitCode,
+    output: options.secret ? options.safeStdout && exitCode === 0 ? stdout.slice(0, 65536) : "" : `${stdout}${stderr}`.slice(0, 65536)
+  };
 };
 var checked5 = async (exec, argv, label, options) => {
   const result = await exec(argv, options);
@@ -6369,9 +6398,13 @@ var safeRemoteArg = (value) => {
   if (!/^[A-Za-z0-9_+.,:@%/=\/-]{1,1024}$/.test(value))
     throw new Error(`unsafe remote argument: ${value}`);
 };
-var remote = async (exec, request, knownHosts, argv, label, secret = false, stdin) => {
+var remote = async (exec, request, knownHosts, argv, label, secret = false, stdin, safeStdout = false) => {
   argv.forEach(safeRemoteArg);
-  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv], label, { secret, stdin });
+  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv], label, {
+    secret,
+    stdin,
+    safeStdout
+  });
 };
 var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   safeRemoteArg(path);
@@ -6639,7 +6672,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
-` : undefined);
+` : undefined, mode === "apply");
     return { plan, output };
   } finally {
     if (knownHosts) {

package/dist/platform-fleet-verification.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.69";
+var VERSION3 = "0.1.71";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.69";
+var VERSION3 = "0.1.71";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.69";
+export declare const VERSION = "0.1.71";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.69",
+  "version": "0.1.71",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",