@forgezero/agent 0.1.70 → 0.1.72

package/README.md

@@ -644,7 +644,7 @@ import type {
 <a id="forgezero-agent-cloudflare-bootstrap"></a>
 ## @forgezero/agent/cloudflare-bootstrap
 
-Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. This entry exposes 13 named value exports and 16 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. This entry exposes 14 named value exports and 17 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
@@ -659,6 +659,7 @@ import {
   runAttendedCloudflareBootstrap,
   validateCloudflareBootstrapCoordinates,
   validateCloudflareBootstrapTokens,
+  validateCloudflareBootstrapTopology,
   verifyCloudflareBootstrapAcceptance,
   writeOwnerBootstrapOutput,
 } from '@forgezero/agent/cloudflare-bootstrap';
@@ -676,6 +677,7 @@ import type {
   CloudflareBootstrapPhaseRunner,
   CloudflareBootstrapPlan,
   CloudflareBootstrapTokens,
+  CloudflareBootstrapTopology,
   CloudflareConnectorHandoff,
   CloudflareHostHandoff,
   CloudflareMeshCoordinates,
@@ -1023,7 +1025,7 @@ import type {
 <a id="forgezero-agent-metal-bootstrap"></a>
 ## @forgezero/agent/metal-bootstrap
 
-Physical-metal bootstrap planning, application and status evidence. This entry exposes 10 named value exports and 6 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
+Physical-metal bootstrap planning, application and status evidence. This entry exposes 10 named value exports and 7 named type exports. The generated import block lists one name per line for scanning and copying; keep only the names used by your file.
 
 ```text
 import {
@@ -1046,6 +1048,7 @@ import type {
   MetalBootstrapPlan,
   MetalBootstrapResult,
   MetalBootstrapStatus,
+  MetalBootstrapValidationOptions,
 } from '@forgezero/agent/metal-bootstrap';
 ```
 

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.70";
+var VERSION3 = "0.1.72";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -450,20 +450,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -570,9 +567,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -580,6 +574,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -1396,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.70";
+var VERSION = "0.1.72";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,4 +1,4 @@
-import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokens } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokens, type CloudflareBootstrapNodeCoordinates } from '../cloudflare-bootstrap';
 import { discoverCloudflareBootstrapResources, type CloudflareBootstrapDiscovery } from '../cloudflare-edge';
 export interface CloudflareBootstrapCommandConfig {
     format: 1;
@@ -6,6 +6,29 @@ export interface CloudflareBootstrapCommandConfig {
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
 }
+/**
+ * Human-reviewable discovery coordinates used by the integrated platform
+ * launch. Cloudflare ids are deliberately absent: the two hidden tokens resolve
+ * and bind them immediately before apply.
+ */
+export interface CloudflareBootstrapDiscoveryCommandConfig {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-discovery-request';
+    checkpointPath: string;
+    discovery: {
+        zoneName: string;
+        kvNamespaceTitle: string;
+        workerScriptName?: string;
+        endpoint?: string;
+        producer?: string;
+    };
+    nodes: readonly CloudflareBootstrapNodeCoordinates[];
+}
+export interface CloudflareBootstrapCommandPlan {
+    checkpointPath: string;
+    nodes: readonly CloudflareBootstrapNodeCoordinates[];
+    discovery?: CloudflareBootstrapDiscoveryCommandConfig['discovery'];
+}
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
@@ -33,11 +56,24 @@ export declare function createCloudflareBootstrapCommandConfig(input: {
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
 }): CloudflareBootstrapCommandConfig;
+/** Create the secret-free, name-based request used by one-command genesis. */
+export declare function createCloudflareBootstrapDiscoveryCommandConfig(input: {
+    checkpointPath: string;
+    discovery: CloudflareBootstrapDiscoveryCommandConfig['discovery'];
+    nodes: readonly CloudflareBootstrapNodeCoordinates[];
+}): CloudflareBootstrapDiscoveryCommandConfig;
 /**
  * Read reviewed non-secret coordinates for the attended operator phase. Raw
  * token values and a persisted mode are not schema fields.
  */
 export declare function readCloudflareBootstrapCommandConfig(path: string, mode: 'plan' | 'apply'): AttendedCloudflareBootstrapRequest;
+export declare function readCloudflareBootstrapDiscoveryCommandConfig(path: string): CloudflareBootstrapDiscoveryCommandConfig;
+/** Read either supported request shape without contacting Cloudflare. */
+export declare function readCloudflareBootstrapCommandPlan(path: string): CloudflareBootstrapCommandPlan;
+/** Resolve name selectors with hidden credentials immediately before apply. */
+export declare function resolveCloudflareBootstrapCommandConfig(path: string, tokens: CloudflareBootstrapTokens, dependencies?: {
+    discover?: typeof discoverCloudflareBootstrapCommandResources;
+}): Promise<AttendedCloudflareBootstrapRequest>;
 export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, tokens?: CloudflareBootstrapTokens, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function runCloudflareBootstrapVerificationCommand(checkpointPath: string, dependencies?: {
     verify?: typeof verifyCloudflareBootstrapAcceptance;

package/dist/cloudflare-bootstrap.d.ts

@@ -115,6 +115,13 @@ export interface CloudflareBootstrapDependencies {
 }
 export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
 export declare function validateCloudflareBootstrapTokens(input: unknown): CloudflareBootstrapTokens;
+export interface CloudflareBootstrapTopology {
+    meshDevicePolicyId?: string;
+    realtime?: CloudflareRealtimeCoordinates;
+    nodes: CloudflareBootstrapNodeCoordinates[];
+}
+/** Validate the fleet/realtime shape without inventing resource identifiers. */
+export declare function validateCloudflareBootstrapTopology(input: CloudflareBootstrapTopology): CloudflareBootstrapTopology;
 export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
 export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
 export interface CloudflareConnectorHandoff {

package/dist/cloudflare-bootstrap.js

@@ -450,20 +450,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -570,9 +567,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -580,6 +574,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -1211,6 +1231,7 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 export {
   writeOwnerBootstrapOutput,
   verifyCloudflareBootstrapAcceptance,
+  validateCloudflareBootstrapTopology,
   validateCloudflareBootstrapTokens,
   validateCloudflareBootstrapCoordinates,
   runAttendedCloudflareBootstrap,

package/dist/fz-agent.js

@@ -8588,7 +8588,7 @@ import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/version.ts
-var VERSION2 = "0.1.70";
+var VERSION2 = "0.1.72";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4829,7 +4829,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.70";
+var VERSION2 = "0.1.72";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12551,20 +12551,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -12671,9 +12668,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -12681,6 +12675,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -14970,6 +14990,56 @@ function createCloudflareBootstrapCommandConfig(input) {
     coordinates: validateCloudflareBootstrapCoordinates(input.coordinates)
   };
 }
+var normalizeDiscovery = (input) => {
+  const zoneName = input.zoneName.trim().toLowerCase().replace(/\.$/, "");
+  const kvNamespaceTitle = input.kvNamespaceTitle.trim();
+  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(zoneName)) {
+    throw new Error("Cloudflare zone name is invalid");
+  }
+  if (!kvNamespaceTitle || kvNamespaceTitle.length > 512) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const workerScriptName = input.workerScriptName?.trim();
+  const endpoint2 = input.endpoint?.trim();
+  const producer = input.producer?.trim();
+  if ([workerScriptName, endpoint2, producer].filter((value) => value !== undefined).length !== 0 && (!workerScriptName || !endpoint2 || !producer)) {
+    throw new Error("Cloudflare realtime discovery requires Worker name, endpoint, and producer together");
+  }
+  return {
+    zoneName,
+    kvNamespaceTitle,
+    ...workerScriptName ? { workerScriptName, endpoint: endpoint2, producer } : {}
+  };
+};
+function createCloudflareBootstrapDiscoveryCommandConfig(input) {
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  const discovery = normalizeDiscovery(input.discovery);
+  const normalized = validateCloudflareBootstrapTopology({
+    ...discovery.workerScriptName ? { realtime: {
+      workerScriptName: discovery.workerScriptName,
+      endpoint: discovery.endpoint,
+      producer: discovery.producer
+    } } : {},
+    nodes: [...input.nodes]
+  });
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-discovery-request",
+    checkpointPath: input.checkpointPath.trim(),
+    discovery: {
+      zoneName: discovery.zoneName,
+      kvNamespaceTitle: discovery.kvNamespaceTitle,
+      ...normalized.realtime ? {
+        workerScriptName: normalized.realtime.workerScriptName,
+        endpoint: normalized.realtime.endpoint,
+        producer: normalized.realtime.producer
+      } : {}
+    },
+    nodes: normalized.nodes
+  };
+}
 function readOwnerConfig(path) {
   const absolute2 = resolve7(path);
   let descriptor;
@@ -15037,6 +15107,79 @@ function readCloudflareBootstrapCommandConfig(path, mode) {
     checkpointPath: resolve7(baseDirectory, input.checkpointPath)
   };
 }
+function readCloudflareBootstrapDiscoveryCommandConfig(path) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap discovery config");
+  const baseDirectory = dirname10(resolve7(path));
+  exactKeys3(input, ["format", "kind", "checkpointPath", "discovery", "nodes"], "Cloudflare bootstrap discovery config");
+  if (input.format !== 1 || input.kind !== "forgezero-cloudflare-bootstrap-discovery-request") {
+    throw new Error("Cloudflare bootstrap discovery config format/kind is invalid");
+  }
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  const discovery = record2(input.discovery, "Cloudflare bootstrap discovery selectors");
+  exactKeys3(discovery, [
+    "zoneName",
+    "kvNamespaceTitle",
+    "workerScriptName",
+    "endpoint",
+    "producer"
+  ], "Cloudflare bootstrap discovery selectors");
+  if (!Array.isArray(input.nodes))
+    throw new Error("Cloudflare bootstrap discovery nodes must be an array");
+  for (const node of input.nodes) {
+    exactKeys3(record2(node, "Cloudflare bootstrap node"), [
+      "nodeName",
+      "hostname",
+      "service",
+      "tunnelName",
+      "mesh"
+    ], "Cloudflare bootstrap node");
+  }
+  const created = createCloudflareBootstrapDiscoveryCommandConfig({
+    checkpointPath: resolve7(baseDirectory, input.checkpointPath),
+    discovery,
+    nodes: input.nodes
+  });
+  return created;
+}
+function readCloudflareBootstrapCommandPlan(path) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
+  if (input.kind === "forgezero-cloudflare-bootstrap-discovery-request") {
+    const config = readCloudflareBootstrapDiscoveryCommandConfig(path);
+    return { checkpointPath: config.checkpointPath, nodes: config.nodes, discovery: config.discovery };
+  }
+  const request = readCloudflareBootstrapCommandConfig(path, "plan");
+  return { checkpointPath: request.checkpointPath, nodes: request.coordinates.nodes };
+}
+async function resolveCloudflareBootstrapCommandConfig(path, tokens, dependencies = {}) {
+  const input = record2(readOwnerConfig(path), "Cloudflare bootstrap config");
+  if (input.kind !== "forgezero-cloudflare-bootstrap-discovery-request") {
+    const request = readCloudflareBootstrapCommandConfig(path, "apply");
+    request.tokens = tokens;
+    return request;
+  }
+  const config = readCloudflareBootstrapDiscoveryCommandConfig(path);
+  const coordinates = await (dependencies.discover ?? discoverCloudflareBootstrapCommandResources)({
+    zoneName: config.discovery.zoneName,
+    kvNamespaceTitle: config.discovery.kvNamespaceTitle,
+    ...config.discovery.workerScriptName ? { workerScriptName: config.discovery.workerScriptName } : {},
+    tokens
+  });
+  return {
+    mode: "apply",
+    checkpointPath: config.checkpointPath,
+    coordinates: validateCloudflareBootstrapCoordinates({
+      ...coordinates,
+      ...config.discovery.workerScriptName ? { realtime: {
+        workerScriptName: config.discovery.workerScriptName,
+        endpoint: config.discovery.endpoint,
+        producer: config.discovery.producer
+      } } : {},
+      nodes: [...config.nodes]
+    })
+  };
+}
 async function runCloudflareBootstrapCommand(configPath, apply, tokens, dependencies = {}) {
   const request = readCloudflareBootstrapCommandConfig(configPath, apply ? "apply" : "plan");
   if (apply)
@@ -15379,7 +15522,7 @@ var validUnit = (unit) => {
     throw new MetalBootstrapError("the OTLP collector must be independently supervised");
   }
 };
-function validateMetalBootstrapConfig(config) {
+function validateMetalBootstrapConfig(config, options = {}) {
   if (!config || typeof config !== "object")
     throw new MetalBootstrapError("metal bootstrap config must be an object");
   exactKeys4(config, ["kind", "metalHostname", "profile", "hostTelemetryEndpoint", "hostTelemetryUnit", "agentSeedFile"], "metal bootstrap config");
@@ -15423,7 +15566,7 @@ function validateMetalBootstrapConfig(config) {
   for (const image of Object.values(config.profile.images))
     if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve8(image.path) !== image.path || /[\0\r\n]/.test(image.path))
       throw new MetalBootstrapError("every pinned guest image must use the fixed image directory");
-  if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION2) {
+  if (!options.allowHistoricalRelease && (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION2)) {
     throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
   }
   let api;
@@ -15469,7 +15612,7 @@ function validateOwnerOnlyPath(path, requireRootOwner) {
     throw new MetalBootstrapError(requireRootOwner ? "private bootstrap file must be root-owned" : "private bootstrap file has an unexpected owner");
   }
 }
-function readMetalBootstrapConfig(path) {
+function readMetalBootstrapConfig(path, options = {}) {
   validateOwnerOnlyPath(path, false);
   const metadata = statSync(path);
   if (metadata.size < 2 || metadata.size > MAX_CONFIG_BYTES)
@@ -15480,7 +15623,7 @@ function readMetalBootstrapConfig(path) {
   } catch {
     throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
   }
-  return validateMetalBootstrapConfig(parsed);
+  return validateMetalBootstrapConfig(parsed, options);
 }
 function planMetalBootstrap(config) {
   validateMetalBootstrapConfig(config);
@@ -15981,6 +16124,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     problems.push("metal helper socket is not ready");
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
+  const versionResult = await exec([AGENT_PATH, "--version"]);
+  const installedAgentVersion = versionResult.exitCode === 0 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(versionResult.stdout.trim()) ? versionResult.stdout.trim() : undefined;
+  if (!installedAgentVersion)
+    problems.push("installed Metal Agent version is unavailable or malformed");
   return {
     initialized: existsSync10(STATE_PATH2),
     profileValid,
@@ -15990,6 +16137,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     helperSocketReady,
     updateSocketReady,
     metalHostname,
+    installedAgentVersion,
     problems
   };
 }
@@ -16173,7 +16321,7 @@ function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudfla
     readOperatorPlatformBootstrapRequest(file);
   return writeOwnerJson2(path, request, "operator fleet request");
 }
-var validateMetalRequestValue = (value) => {
+var validateMetalRequestValue = (value, options = {}) => {
   const root = exactKeys5(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
@@ -16193,7 +16341,8 @@ var validateMetalRequestValue = (value) => {
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
-  readMetalBootstrapConfig(root.metalConfigFile);
+  if (options.validateMetalConfig !== false)
+    readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys5(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
   const guest = (value2, label) => {
     const row2 = exactKeys5(value2, [
@@ -16252,9 +16401,9 @@ var validateMetalRequestValue = (value) => {
     }
   };
 };
-function readOperatorMetalBootstrapRequest(path) {
+function readOperatorMetalBootstrapRequest(path, options = {}) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal request")));
-  return validateMetalRequestValue(value);
+  return validateMetalRequestValue(value, options);
 }
 function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
@@ -16303,7 +16452,7 @@ function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
   return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
 }
 function planOperatorMetalBootstrap(request, mode) {
-  const config = readMetalBootstrapConfig(request.metalConfigFile);
+  const config = mode === "apply" ? readMetalBootstrapConfig(request.metalConfigFile) : undefined;
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
@@ -16323,7 +16472,7 @@ function planOperatorMetalBootstrap(request, mode) {
       "remove transient local and remote staging data"
     ],
     genesisNodes,
-    secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
+    secretInputs: config?.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
 var secretSources = (config) => [
@@ -16475,7 +16624,10 @@ var defaultExec3 = async (argv2, options = {}) => {
     new Response(child.stderr).text(),
     child.exited
   ]);
-  return { exitCode, output: options.secret ? "" : `${stdout}${stderr}`.slice(0, 65536) };
+  return {
+    exitCode,
+    output: options.secret ? options.safeStdout && exitCode === 0 ? stdout.slice(0, 65536) : "" : `${stdout}${stderr}`.slice(0, 65536)
+  };
 };
 var checked5 = async (exec, argv2, label, options) => {
   const result = await exec(argv2, options);
@@ -16529,9 +16681,13 @@ var safeRemoteArg = (value) => {
   if (!/^[A-Za-z0-9_+.,:@%/=\/-]{1,1024}$/.test(value))
     throw new Error(`unsafe remote argument: ${value}`);
 };
-var remote = async (exec, request, knownHosts, argv2, label, secret = false, stdin) => {
+var remote = async (exec, request, knownHosts, argv2, label, secret = false, stdin, safeStdout = false) => {
   argv2.forEach(safeRemoteArg);
-  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv2], label, { secret, stdin });
+  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv2], label, {
+    secret,
+    stdin,
+    safeStdout
+  });
 };
 var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   safeRemoteArg(path);
@@ -16736,7 +16892,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
-` : undefined);
+` : undefined, mode === "apply");
     return { plan, output };
   } finally {
     if (knownHosts) {
@@ -18175,11 +18331,13 @@ function writeMetalOperatorFiles(directory) {
 function writePlatformGenesisFleet(directory) {
   const output = genesisOutputDirectory(directory);
   const metalRequestFile = bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
-  const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile);
+  const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile, { validateMetalConfig: false });
   const guestHostKeysFile = bootstrapAnswer("Owner-only guest host-key evidence file");
   const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
-  const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile).metalHostname;
+  const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile, {
+    allowHistoricalRelease: true
+  }).metalHostname;
   const checkpointPath = join12(output, "cloudflare-handoff.json");
   const template = interactiveBootstrap("platform", fleet, checkpointPath);
   const region = {
@@ -18195,24 +18353,23 @@ function writePlatformGenesisFleet(directory) {
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
   });
   const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
-  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapCommandConfig({
+  const cloudflareConfig = writeBootstrapConfig(join12(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
-    coordinates: {
-      accountId: bootstrapAnswer("Cloudflare account id"),
-      zoneId: bootstrapAnswer("Cloudflare zone id"),
-      kvNamespaceId: bootstrapAnswer("Existing Worker-bound KV namespace id"),
-      ...realtimeEnabled ? { realtime: {
+    discovery: {
+      zoneName: bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
+      kvNamespaceTitle: bootstrapAnswer("Existing Worker-bound KV namespace title"),
+      ...realtimeEnabled ? {
         workerScriptName: bootstrapAnswer("Existing Worker script name"),
         endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
         producer: bootstrapAnswer("Realtime producer identity", "platform-api")
-      } } : {},
-      nodes: fleet.map((guest, index) => ({
-        nodeName: guest.name,
-        hostname: nodes[index].nodeHostname,
-        service: "http://127.0.0.1:3000",
-        tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
-      }))
-    }
+      } : {}
+    },
+    nodes: fleet.map((guest, index) => ({
+      nodeName: guest.name,
+      hostname: nodes[index].nodeHostname,
+      service: "http://127.0.0.1:3000",
+      tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
+    }))
   }));
   const cloudflareAcceptance = join12(output, "cloudflare-acceptance.json");
   const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
@@ -18288,7 +18445,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
   const backupBucket = backupEndpoint ? bootstrapAnswer("Backup S3 bucket") : undefined;
   const backupAccessKeyId = backupEndpoint ? bootstrapAnswer("Backup S3 access-key id") : undefined;
   const cloudflareHandoffFile = genesis ? cloudflareHostHandoffPath(genesisCloudflareCheckpoint, computeReference) : bootstrapAnswer("Node-specific Cloudflare host handoff (blank for no public edge)", "");
-  const cloudflareNodeName = cloudflareHandoffFile ? bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
+  const cloudflareNodeName = cloudflareHandoffFile ? genesis ? computeReference : bootstrapAnswer("Cloudflare handoff node name", computeReference) : undefined;
   const databaseNetworkMode = "private-lan";
   const enrolmentSource = genesis ? "genesis-derived" : bootstrapAnswer("Enrolment source (genesis-derived/api-token)", "genesis-derived");
   return {
@@ -18365,10 +18522,10 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
 }
 async function runAttendedPlatformFleet(fleet, apply) {
   const plan = planOperatorPlatformFleetBootstrap(fleet, "apply");
-  const cloudflare = readCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, apply ? "apply" : "plan");
+  const cloudflarePlan = readCloudflareBootstrapCommandPlan(fleet.cloudflareConfigFile);
   const coordinates = operatorPlatformFleetCoordinates(fleet);
-  if (cloudflare.coordinates.nodes.length !== coordinates.nodes.length || coordinates.nodes.some((node, index) => {
-    const edge = cloudflare.coordinates.nodes[index];
+  if (cloudflarePlan.nodes.length !== coordinates.nodes.length || coordinates.nodes.some((node, index) => {
+    const edge = cloudflarePlan.nodes[index];
     return edge?.nodeName !== node.computeReference || edge.hostname !== node.nodeHostname || edge.service !== "http://127.0.0.1:3000";
   })) {
     throw new Error("Cloudflare coordinates do not match the exact reviewed platform fleet");
@@ -18377,8 +18534,9 @@ async function runAttendedPlatformFleet(fleet, apply) {
     kind: "forgezero-attended-platform-bootstrap-plan",
     mutation: true,
     cloudflare: {
-      checkpointFile: cloudflare.checkpointPath,
-      nodes: cloudflare.coordinates.nodes.map(({ nodeName, hostname: hostname2 }) => ({ nodeName, hostname: hostname2 }))
+      checkpointFile: cloudflarePlan.checkpointPath,
+      ...cloudflarePlan.discovery ? { discovery: cloudflarePlan.discovery } : {},
+      nodes: cloudflarePlan.nodes.map(({ nodeName, hostname: hostname2 }) => ({ nodeName, hostname: hostname2 }))
     },
     fleet: plan,
     acceptanceFile: fleet.cloudflareAcceptanceFile,
@@ -18386,7 +18544,7 @@ async function runAttendedPlatformFleet(fleet, apply) {
   };
   out.line(JSON.stringify(attendedPlan, null, 2));
   if (!apply) {
-    out.step("Review the complete Tunnel, hostname, bundle, credential and three-node plan, then repeat with --apply.");
+    out.step("Review the generated plan, then apply its platform-fleet-remote.json with fz bootstrap platform fleet apply --apply.");
     return 0;
   }
   const first = readOperatorPlatformBootstrapRequest(fleet.requests[0]);
@@ -18394,6 +18552,10 @@ async function runAttendedPlatformFleet(fleet, apply) {
   if (firstConfig.kind !== "platform")
     throw new Error("remote platform fleet requires platform configs");
   const secrets = await promptPlatformBootstrapSecrets(firstConfig);
+  const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
+    tunnelToken: secrets.cloudflareTunnelToken,
+    apiToken: secrets.cloudflareApiToken
+  });
   const result = await applyAttendedPlatformBootstrap(fleet, cloudflare, fleet.cloudflareAcceptanceFile, secrets);
   out.line(JSON.stringify(result, null, 2));
   if (!result.ok)
@@ -18492,7 +18654,9 @@ async function cmdBootstrap(options, args) {
       if ((mode === "host-keys" || mode === "rehearsal-host-keys") && !options.outputPath) {
         throw new Error(`${mode} requires --output <absolute-owner-only-evidence.json>`);
       }
-      const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath);
+      const request = readOperatorMetalBootstrapRequest(options.bootstrapConfigPath, {
+        validateMetalConfig: mode === "apply"
+      });
       const plan2 = planOperatorMetalBootstrap(request, mode);
       if (!options.apply) {
         out.line(JSON.stringify(plan2, null, 2));

package/dist/metal-bootstrap.d.ts

@@ -28,6 +28,7 @@ export interface MetalBootstrapStatus {
     helperSocketReady: boolean;
     updateSocketReady: boolean;
     metalHostname?: string;
+    installedAgentVersion?: string;
     problems: string[];
 }
 export interface MetalBootstrapResult extends MetalBootstrapStatus {
@@ -43,10 +44,17 @@ export interface MetalBootstrapApplyOptions {
 export declare class MetalBootstrapError extends Error {
 }
 export declare function normalizeMetalPublicIdentity(value: string): string;
-export declare function validateMetalBootstrapConfig(config: MetalBootstrapConfig): MetalBootstrapConfig;
+export interface MetalBootstrapValidationOptions {
+    /**
+     * Read identity/topology from a config that was already applied by an older
+     * Agent release. New installs and repairs must never set this flag.
+     */
+    allowHistoricalRelease?: boolean;
+}
+export declare function validateMetalBootstrapConfig(config: MetalBootstrapConfig, options?: MetalBootstrapValidationOptions): MetalBootstrapConfig;
 /** Reject symlinks and group/world access before parsing coordinates or entropy. */
 export declare function validateOwnerOnlyPath(path: string, requireRootOwner: boolean): void;
-export declare function readMetalBootstrapConfig(path: string): MetalBootstrapConfig;
+export declare function readMetalBootstrapConfig(path: string, options?: MetalBootstrapValidationOptions): MetalBootstrapConfig;
 export declare function planMetalBootstrap(config: MetalBootstrapConfig): MetalBootstrapPlan;
 export declare function renderMetalUnits(config: MetalBootstrapConfig): Record<string, string>;
 export declare function applyMetalBootstrap(config: MetalBootstrapConfig, options: MetalBootstrapApplyOptions): Promise<MetalBootstrapResult>;

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.70";
+var VERSION = "0.1.72";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -579,7 +579,7 @@ var validUnit = (unit) => {
     throw new MetalBootstrapError("the OTLP collector must be independently supervised");
   }
 };
-function validateMetalBootstrapConfig(config) {
+function validateMetalBootstrapConfig(config, options = {}) {
   if (!config || typeof config !== "object")
     throw new MetalBootstrapError("metal bootstrap config must be an object");
   exactKeys(config, ["kind", "metalHostname", "profile", "hostTelemetryEndpoint", "hostTelemetryUnit", "agentSeedFile"], "metal bootstrap config");
@@ -623,7 +623,7 @@ function validateMetalBootstrapConfig(config) {
   for (const image of Object.values(config.profile.images))
     if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve(image.path) !== image.path || /[\0\r\n]/.test(image.path))
       throw new MetalBootstrapError("every pinned guest image must use the fixed image directory");
-  if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION) {
+  if (!options.allowHistoricalRelease && (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION)) {
     throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
   }
   let api;
@@ -669,7 +669,7 @@ function validateOwnerOnlyPath(path, requireRootOwner) {
     throw new MetalBootstrapError(requireRootOwner ? "private bootstrap file must be root-owned" : "private bootstrap file has an unexpected owner");
   }
 }
-function readMetalBootstrapConfig(path) {
+function readMetalBootstrapConfig(path, options = {}) {
   validateOwnerOnlyPath(path, false);
   const metadata = statSync(path);
   if (metadata.size < 2 || metadata.size > MAX_CONFIG_BYTES)
@@ -680,7 +680,7 @@ function readMetalBootstrapConfig(path) {
   } catch {
     throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
   }
-  return validateMetalBootstrapConfig(parsed);
+  return validateMetalBootstrapConfig(parsed, options);
 }
 function planMetalBootstrap(config) {
   validateMetalBootstrapConfig(config);
@@ -1181,6 +1181,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     problems.push("metal helper socket is not ready");
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
+  const versionResult = await exec([AGENT_PATH, "--version"]);
+  const installedAgentVersion = versionResult.exitCode === 0 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(versionResult.stdout.trim()) ? versionResult.stdout.trim() : undefined;
+  if (!installedAgentVersion)
+    problems.push("installed Metal Agent version is unavailable or malformed");
   return {
     initialized: existsSync(STATE_PATH),
     profileValid,
@@ -1190,6 +1194,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     helperSocketReady,
     updateSocketReady,
     metalHostname,
+    installedAgentVersion,
     problems
   };
 }

package/dist/operator-bootstrap.d.ts

@@ -115,6 +115,7 @@ export interface OperatorCommandResult {
 export type OperatorCommand = (argv: readonly string[], options?: {
     stdin?: string;
     secret?: boolean;
+    safeStdout?: boolean;
 }) => Promise<OperatorCommandResult>;
 export interface OperatorPlatformBootstrapOptions {
     exec?: OperatorCommand;
@@ -131,7 +132,9 @@ export declare function writeOperatorPlatformBootstrapFleetRequest(path: string,
     configFile: string;
     acceptanceFile: string;
 }): string;
-export declare function readOperatorMetalBootstrapRequest(path: string): OperatorMetalBootstrapRequest;
+export declare function readOperatorMetalBootstrapRequest(path: string, options?: {
+    validateMetalConfig?: boolean;
+}): OperatorMetalBootstrapRequest;
 export declare function writeOperatorMetalBootstrapRequest(path: string, request: OperatorMetalBootstrapRequest): string;
 export declare function readOperatorGuestHostKeyEvidence(path: string, request?: OperatorMetalBootstrapRequest): OperatorGuestHostKeyEvidence;
 export declare function writeOperatorGuestHostKeyEvidence(path: string, evidence: OperatorGuestHostKeyEvidence, request?: OperatorMetalBootstrapRequest): string;

package/dist/operator-bootstrap.js

@@ -450,20 +450,17 @@ var privateMeshCidr = (value) => {
   }
   return `${address}/${prefix}`;
 };
-function validateCloudflareBootstrapCoordinates(input) {
+function validateCloudflareBootstrapTopology(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Cloudflare bootstrap coordinates must be an object");
+    throw new Error("Cloudflare bootstrap topology must be an object");
   }
   const unsupported = Object.keys(input).filter((key) => ![
-    "accountId",
-    "zoneId",
-    "kvNamespaceId",
     "meshDevicePolicyId",
     "realtime",
     "nodes"
   ].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+    throw new Error(`Cloudflare bootstrap topology contains unsupported field ${unsupported[0]}`);
   const nodeInputs = input.nodes;
   if (!Array.isArray(nodeInputs))
     throw new Error("Cloudflare bootstrap requires an explicit nodes array");
@@ -570,9 +567,6 @@ function validateCloudflareBootstrapCoordinates(input) {
     realtime = { workerScriptName, endpoint: endpoint2.origin, producer };
   }
   return {
-    accountId: validateId(input.accountId, "Cloudflare account id"),
-    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
-    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
     ...input.meshDevicePolicyId ? {
       meshDevicePolicyId: validateName(input.meshDevicePolicyId, "Cloudflare Mesh device policy id")
     } : {},
@@ -580,6 +574,32 @@ function validateCloudflareBootstrapCoordinates(input) {
     nodes
   };
 }
+function validateCloudflareBootstrapCoordinates(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("Cloudflare bootstrap coordinates must be an object");
+  }
+  const unsupported = Object.keys(input).filter((key) => ![
+    "accountId",
+    "zoneId",
+    "kvNamespaceId",
+    "meshDevicePolicyId",
+    "realtime",
+    "nodes"
+  ].includes(key));
+  if (unsupported.length)
+    throw new Error(`Cloudflare bootstrap coordinates contain unsupported field ${unsupported[0]}`);
+  const topology = validateCloudflareBootstrapTopology({
+    ...input.meshDevicePolicyId ? { meshDevicePolicyId: input.meshDevicePolicyId } : {},
+    ...input.realtime ? { realtime: input.realtime } : {},
+    nodes: input.nodes
+  });
+  return {
+    accountId: validateId(input.accountId, "Cloudflare account id"),
+    zoneId: validateId(input.zoneId, "Cloudflare zone id"),
+    kvNamespaceId: validateId(input.kvNamespaceId, "Cloudflare KV namespace id"),
+    ...topology
+  };
+}
 function planCloudflareBootstrap(input, outputPath) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   return {
@@ -1396,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.70";
+var VERSION = "0.1.72";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5213,7 +5233,7 @@ var validUnit = (unit) => {
     throw new MetalBootstrapError("the OTLP collector must be independently supervised");
   }
 };
-function validateMetalBootstrapConfig(config) {
+function validateMetalBootstrapConfig(config, options = {}) {
   if (!config || typeof config !== "object")
     throw new MetalBootstrapError("metal bootstrap config must be an object");
   exactKeys2(config, ["kind", "metalHostname", "profile", "hostTelemetryEndpoint", "hostTelemetryUnit", "agentSeedFile"], "metal bootstrap config");
@@ -5257,7 +5277,7 @@ function validateMetalBootstrapConfig(config) {
   for (const image of Object.values(config.profile.images))
     if (!image.path.startsWith("/var/lib/forgezero/images/") || resolve5(image.path) !== image.path || /[\0\r\n]/.test(image.path))
       throw new MetalBootstrapError("every pinned guest image must use the fixed image directory");
-  if (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION) {
+  if (!options.allowHistoricalRelease && (config.profile.bunVersion !== SUPPORTED_BUN_VERSION || config.profile.bunReleaseSha256 !== SUPPORTED_BUN_RELEASE_SHA256 || config.profile.agentVersion !== VERSION)) {
     throw new MetalBootstrapError("metal guest runtime must use the package-owned Bun and Agent release coordinates");
   }
   let api;
@@ -5303,7 +5323,7 @@ function validateOwnerOnlyPath(path, requireRootOwner) {
     throw new MetalBootstrapError(requireRootOwner ? "private bootstrap file must be root-owned" : "private bootstrap file has an unexpected owner");
   }
 }
-function readMetalBootstrapConfig(path) {
+function readMetalBootstrapConfig(path, options = {}) {
   validateOwnerOnlyPath(path, false);
   const metadata = statSync(path);
   if (metadata.size < 2 || metadata.size > MAX_CONFIG_BYTES)
@@ -5314,7 +5334,7 @@ function readMetalBootstrapConfig(path) {
   } catch {
     throw new MetalBootstrapError("metal bootstrap config is not valid JSON");
   }
-  return validateMetalBootstrapConfig(parsed);
+  return validateMetalBootstrapConfig(parsed, options);
 }
 function planMetalBootstrap(config) {
   validateMetalBootstrapConfig(config);
@@ -5815,6 +5835,10 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     problems.push("metal helper socket is not ready");
   if (!updateSocketReady)
     problems.push("Agent update helper socket is not ready");
+  const versionResult = await exec([AGENT_PATH, "--version"]);
+  const installedAgentVersion = versionResult.exitCode === 0 && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(versionResult.stdout.trim()) ? versionResult.stdout.trim() : undefined;
+  if (!installedAgentVersion)
+    problems.push("installed Metal Agent version is unavailable or malformed");
   return {
     initialized: existsSync6(STATE_PATH2),
     profileValid,
@@ -5824,6 +5848,7 @@ async function metalBootstrapStatus(exec = defaultExec2) {
     helperSocketReady,
     updateSocketReady,
     metalHostname,
+    installedAgentVersion,
     problems
   };
 }
@@ -6013,7 +6038,7 @@ function writeOperatorPlatformBootstrapFleetRequest(path, requestFiles, cloudfla
     readOperatorPlatformBootstrapRequest(file);
   return writeOwnerJson2(path, request, "operator fleet request");
 }
-var validateMetalRequestValue = (value) => {
+var validateMetalRequestValue = (value, options = {}) => {
   const root = exactKeys3(value, ["kind", "target", "metalConfigFile", "genesis"], "operator metal request");
   if (root.kind !== "metal-remote")
     throw new Error("operator metal bootstrap kind must be metal-remote");
@@ -6033,7 +6058,8 @@ var validateMetalRequestValue = (value) => {
   if (typeof root.metalConfigFile !== "string")
     throw new Error("metalConfigFile must be an absolute path");
   canonicalOutputPath(root.metalConfigFile, "metalConfigFile");
-  readMetalBootstrapConfig(root.metalConfigFile);
+  if (options.validateMetalConfig !== false)
+    readMetalBootstrapConfig(root.metalConfigFile);
   const genesis = exactKeys3(root.genesis, ["nodes", "rehearsalNode", "sshPublicKeyFiles"], "operator metal genesis");
   const guest = (value2, label) => {
     const row = exactKeys3(value2, [
@@ -6092,9 +6118,9 @@ var validateMetalRequestValue = (value) => {
     }
   };
 };
-function readOperatorMetalBootstrapRequest(path) {
+function readOperatorMetalBootstrapRequest(path, options = {}) {
   const value = JSON.parse(new TextDecoder().decode(ownerFile(path, REQUEST_LIMIT, "operator metal request")));
-  return validateMetalRequestValue(value);
+  return validateMetalRequestValue(value, options);
 }
 function writeOperatorMetalBootstrapRequest(path, request) {
   validateMetalRequestValue(request);
@@ -6143,7 +6169,7 @@ function writeOperatorGuestHostKeyEvidence(path, evidence, request) {
   return writeOwnerJson2(path, validateGuestHostKeyEvidenceValue(evidence, request), "operator guest host-key evidence");
 }
 function planOperatorMetalBootstrap(request, mode) {
-  const config = readMetalBootstrapConfig(request.metalConfigFile);
+  const config = mode === "apply" ? readMetalBootstrapConfig(request.metalConfigFile) : undefined;
   const keys = request.genesis.sshPublicKeyFiles.map((path) => publicIdentity(path));
   if ((mode === "rehearsal" || mode === "rehearsal-cleanup") && !request.genesis.rehearsalNode) {
     throw new Error("the reviewed metal request has no rehearsal node");
@@ -6163,7 +6189,7 @@ function planOperatorMetalBootstrap(request, mode) {
       "remove transient local and remote staging data"
     ],
     genesisNodes,
-    secretInputs: config.agentSeedFile ? ["metal-agent-seed"] : []
+    secretInputs: config?.agentSeedFile ? ["metal-agent-seed"] : []
   };
 }
 var secretSources = (config) => [
@@ -6315,7 +6341,10 @@ var defaultExec3 = async (argv, options = {}) => {
     new Response(child.stderr).text(),
     child.exited
   ]);
-  return { exitCode, output: options.secret ? "" : `${stdout}${stderr}`.slice(0, 65536) };
+  return {
+    exitCode,
+    output: options.secret ? options.safeStdout && exitCode === 0 ? stdout.slice(0, 65536) : "" : `${stdout}${stderr}`.slice(0, 65536)
+  };
 };
 var checked5 = async (exec, argv, label, options) => {
   const result = await exec(argv, options);
@@ -6369,9 +6398,13 @@ var safeRemoteArg = (value) => {
   if (!/^[A-Za-z0-9_+.,:@%/=\/-]{1,1024}$/.test(value))
     throw new Error(`unsafe remote argument: ${value}`);
 };
-var remote = async (exec, request, knownHosts, argv, label, secret = false, stdin) => {
+var remote = async (exec, request, knownHosts, argv, label, secret = false, stdin, safeStdout = false) => {
   argv.forEach(safeRemoteArg);
-  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv], label, { secret, stdin });
+  return checked5(exec, ["ssh", ...sshOptions(request, knownHosts), destination2(request.target), "--", ...argv], label, {
+    secret,
+    stdin,
+    safeStdout
+  });
 };
 var remoteRegularFileExists = async (exec, request, knownHosts, path) => {
   safeRemoteArg(path);
@@ -6639,7 +6672,7 @@ async function applyOperatorPlatformBootstrap(request, mode, options = {}) {
     const command = ["/usr/bin/sudo", "-n", "/usr/local/bin/fz", "bootstrap", "platform", "credentials-stdin"];
     command.push("--bootstrap-config", `${REMOTE_STAGE}/platform-config.json`, "--apply");
     const output = await remote(exec, request, knownHosts, command, "remote typed bootstrap", mode === "apply", secrets ? `${JSON.stringify(secrets)}
-` : undefined);
+` : undefined, mode === "apply");
     return { plan, output };
   } finally {
     if (knownHosts) {

package/dist/platform-fleet-verification.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.70";
+var VERSION3 = "0.1.72";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2125,7 +2125,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.70";
+var VERSION3 = "0.1.72";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.70";
+export declare const VERSION = "0.1.72";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.70",
+  "version": "0.1.72",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",