@forgezero/agent 0.1.85 → 0.1.86

package/README.md

@@ -11,7 +11,7 @@ The node agent deploys on a compute; tenant mode also holds one complete project
 
 ## Package overview
 
-Every managed compute. It owns node identity, attestation and repository pipelines. Tenant mode additionally holds one whole project across its environments in RAM and answers over a unix socket; platform mode never replicates the API vault beside the process that already holds every unlocked realm seed. Supported runtimes: bun, node. Package root: @forgezero/agent. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
+Every managed compute. It owns node identity, attestation and repository pipelines. An SNP compute may hold its assigned whole project across environments in RAM after current attestation. Ordinary compute is API-only unless an administrator explicitly records the versioned non-TEE risk acceptance for that concrete machine. Platform mode never replicates realm-wide API authority beside the process that already holds unlocked realm seeds. Supported runtimes: bun, node. Package root: @forgezero/agent. The sections below show the actual named imports emitted by each declaration entry point; wildcard imports are intentionally not used in the documentation.
 
 ```text
 bun add -g @forgezero/agent
@@ -38,7 +38,7 @@ Every row links to the detailed explanation and named-import/example area below.
 | fz | The operator command: keys, status, genesis, unlock, run, and agent install. | Bun/Node host | [Reference + usage](#fz) |
 | fz run | The fallback for software that cannot read the local socket: start a process with scoped vault values in its environment. | Bun/Node host | [Reference + usage](#fz-run) |
 | fz agent install | Provision the same hardened agent service locally that the platform provisions remotely. | Bun/Node host | [Reference + usage](#fz-agent-install) |
-| fz-agent | The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project Vault replica scope, and an SNP guest completes its first live attestation before Vault synchronization begins. | Bun/Node host | [Reference + usage](#fz-agent) |
+| fz-agent | The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project scope. Vault synchronization succeeds only when the API sees current SNP evidence or an audited versioned non-TEE acceptance; ordinary compute otherwise remains API-only and a revocation clears its resident cache. | Bun/Node host | [Reference + usage](#fz-agent) |
 | fz-agent (socket) | identity, sign, attest, get, sync and held — the whole interface an application sees. | Bun/Node host | [Reference + usage](#fz-agent-socket) |
 | @forgezero/agent/migration-pull | PQ-authenticated outbound lifecycle claims with fenced renewal, awaited async execution, idempotent acknowledgement and bounded shutdown drain. The executor reports local facts only. | Bun/Node host | [Reference + usage](#forgezero-agent-migration-pull) |
 | @forgezero/agent/lifecycle-helper | The root-owned fixed-operation boundary for migration work. Signed controller claims can request only private reachability probes, local health checks, or stops of units named in a root-owned profile; they cannot carry commands. | Bun/Node host | [Reference + usage](#forgezero-agent-lifecycle-helper) |
@@ -79,7 +79,7 @@ Every row links to the detailed explanation and named-import/example area below.
 | @forgezero/agent/software | Exact managed-software inventory, requirement and evidence contracts. | Bun/Node host | [Reference + usage](#forgezero-agent-software) |
 | @forgezero/agent/software-helper | Root-owned fixed installation/update boundary for declared software. | Bun/Node host | [Reference + usage](#forgezero-agent-software-helper) |
 | @forgezero/agent/ubuntu | The closed guest-image view: pinned Ubuntu 26.04 LTS x64 supports ordinary or SEV-SNP compute, while pinned Ubuntu 24.04 LTS x64 is limited to ordinary non-confidential compute. Every other OS remains rejected until its own pinned strategy and acceptance evidence are added. | Bun/Node host | [Reference + usage](#forgezero-agent-ubuntu) |
-| fz-agent (replica) | The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. | Bun/Node host | [Reference + usage](#fz-agent-replica) |
+| fz-agent (replica) | The authorized project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, cleared when local authority is revoked, and refusing a read it can no longer vouch for. | Bun/Node host | [Reference + usage](#fz-agent-replica) |
 
 ## Commands
 
@@ -89,8 +89,8 @@ fz deploy init --runtime containerd --os ubuntu-24.04 --replicas 1 --cpu-cores 2
 fz deploy init --runtime kata-snp --os ubuntu-26.04 --replicas 1 --cpu-cores 2 --memory-mib 4096 --storage-gib 40 --reuse require — Create one Kata QEMU SEV-SNP definition on existing eligible capacity. Use reuse prefer only with the explicit provisioning and spend-ceiling flags shown by fz deploy init --help.
 fz deploy compile — Compile and validate TypeScript deployment intent into .fz/deploy.plan.json.
 fz deploy check — Refuse stale plans, unsafe provider/action coordinates and unresolved deployment blockers.
-fz bootstrap platform bundle --root /absolute/api --branch dev --output /secure/forgezero/development/api.bundle — Build one verified release-generation-one source bundle without a Git credential.
-fz bootstrap platform remote apply --bootstrap-config /secure/forgezero/development/dev-fz-n1-remote.json — Dry-plan one pinned operator-to-guest bootstrap; add --apply only after review.
+fz bootstrap platform launch --profile development --apply — Run the one attended ForgeZero launch: public topology and bundle are derived; answer only email settings, hidden provider tokens and APPLY.
+fz bootstrap platform fleet apply --bootstrap-config /secure/forgezero/development/genesis/platform-fleet-remote.json — Resume or diagnose an already generated fleet plan; this is not the normal first-launch path.
 fz bootstrap platform --help — Inspect attended platform bootstrap inputs before applying them.
 fz bootstrap metal --help — Inspect the identity-only physical provisioner bootstrap.
 fz host transactions|schema-plan|schema-apply — Plan fixed supervised database maintenance; add --apply only after reviewing the exact argv and credential names.
@@ -103,8 +103,8 @@ fz deploy init --runtime containerd --os ubuntu-24.04 --replicas 1 --cpu-cores 2
 fz deploy init --runtime kata-snp --os ubuntu-26.04 --replicas 1 --cpu-cores 2 --memory-mib 4096 --storage-gib 40 --reuse require
 fz deploy compile
 fz deploy check
-fz bootstrap platform bundle --root /absolute/api --branch dev --output /secure/forgezero/development/api.bundle
-fz bootstrap platform remote apply --bootstrap-config /secure/forgezero/development/dev-fz-n1-remote.json
+fz bootstrap platform launch --profile development --apply
+fz bootstrap platform fleet apply --bootstrap-config /secure/forgezero/development/genesis/platform-fleet-remote.json
 fz bootstrap platform --help
 fz bootstrap metal --help
 fz host transactions|schema-plan|schema-apply
@@ -167,7 +167,7 @@ fz agent install --help
 <a id="fz-agent"></a>
 ## fz-agent
 
-The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project Vault replica scope, and an SNP guest completes its first live attestation before Vault synchronization begins. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
+The service entry point. Identity and private Git material arrive only as systemd credentials. A platform bootstrap may use a statically configured local control socket; an enrolled tenant guest builds each deployment manager from its signed server claim and reads all commands from the checked-out .fz definition. The signed enrolment binding constructs the exact project scope. Vault synchronization succeeds only when the API sees current SNP evidence or an audited versioned non-TEE acceptance; ordinary compute otherwise remains API-only and a revocation clears its resident cache. This entry requires a Bun/Node host runtime. Run the command with `--help` before applying it.
 
 ```text
 fz-agent --help
@@ -755,14 +755,13 @@ import type {
 } from '@forgezero/agent/operator-bootstrap';
 ```
 
-## @forgezero/agent/operator-bootstrap — Run the same typed platform bootstrap from an operator laptop
+## @forgezero/agent/operator-bootstrap — Launch the platform from an operator laptop
 
-The request contains the pinned SSH transport, reviewed platform config, and one verified local Git bundle copied identically to every genesis compute. No repository key is created. Hidden credential values are sealed immediately as systemd credentials.
+The selected ForgeZero profile and pinned Metal evidence derive every public coordinate. The CLI builds the clean API bundle, retains cluster material only as an owner-host encrypted systemd credential for safe resume, deploys all three computes, seals hidden credentials, seeds inventory and prints the invitation. Low-level file commands are reserved for resume and repair.
 
 ```text
-fz bootstrap platform remote apply --bootstrap-config /secure/forgezero/development/dev-fz-n1-remote.json
-# Review, then allow the SSH-agent approval prompt:
-fz bootstrap platform remote apply --bootstrap-config /secure/forgezero/development/dev-fz-n1-remote.json --apply
+# The command prints the derived plan before its final APPLY confirmation:
+fz bootstrap platform launch --profile development --apply
 ```
 
 <a id="forgezero-agent-host-maintenance"></a>
@@ -1809,7 +1808,7 @@ export const selectedCapability = SUPPORTED_GUEST_IMAGE;
 <a id="fz-agent-replica"></a>
 ## fz-agent (replica)
 
-The project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, and refusing a read it can no longer vouch for. This is a managed runtime interface label, not an import or standalone executable.
+The authorized project-scoped vault replica: resident in RAM, never on disk, invalidated by cursor rather than by timer, cleared when local authority is revoked, and refusing a read it can no longer vouch for. This is a managed runtime interface label, not an import or standalone executable.
 
 ```text
 fz-agent (replica)

package/dist/agent-heartbeat.js

@@ -691,9 +691,11 @@ import {
 
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -740,7 +742,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason2 = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason2 || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason2 || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);
@@ -750,7 +752,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.85";
+var VERSION3 = "0.1.86";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.85";
+var VERSION = "0.1.86";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3002,12 +3002,14 @@ var httpsOrigin = (name, raw) => {
   return value.origin;
 };
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
+  if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
+    throw new Error("initial platform deployment evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -3042,7 +3044,8 @@ function validatePlatformInitialInventory(value) {
       databaseRole: compute.databaseRole,
       databaseAgency: compute.databaseAgency,
       confidential: true
-    }))
+    })),
+    ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
 var systemdValue = (name, raw) => {
@@ -4770,8 +4773,10 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.deployment !== undefined)
+        exactKeys(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))
         throw new Error("initial inventory computes must be an array");
       for (const compute of inventory.computes)

package/dist/credential-schema.js

@@ -129,9 +129,11 @@ import {
 
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -178,7 +180,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);
@@ -216,8 +218,17 @@ function tenantNodeApiUrl(apiUrl, tenantSlug) {
   return url.toString().replace(/\/$/, "");
 }
 function createNodeVaultCache(options) {
-  const post = (operation, body) => postSignedNode(options, `v1/node/vault/${operation}`, body);
-  return createSecretCache({
+  let cache;
+  const post = async (operation, body) => {
+    try {
+      return await postSignedNode(options, `v1/node/vault/${operation}`, body);
+    } catch (cause) {
+      if (cause instanceof SignedNodeHttpError && cause.code === "VAULT_API_ONLY")
+        cache?.clear();
+      throw cause;
+    }
+  };
+  cache = createSecretCache({
     ttlMs: options.ttlMs,
     maxStaleMs: options.maxStaleMs,
     list: async () => {
@@ -246,6 +257,7 @@ function createNodeVaultCache(options) {
       };
     }
   });
+  return cache;
 }
 function startNodeVaultSync(cache, options = {}) {
   const interval = Math.max(1000, options.intervalMs ?? 30000);

package/dist/fz-agent.js

@@ -4326,9 +4326,11 @@ function createSecretCache(options) {
 // src/signed-node-http.ts
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -4375,7 +4377,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);
@@ -4413,8 +4415,17 @@ function tenantNodeApiUrl(apiUrl, tenantSlug) {
   return url.toString().replace(/\/$/, "");
 }
 function createNodeVaultCache(options) {
-  const post = (operation, body) => postSignedNode(options, `v1/node/vault/${operation}`, body);
-  return createSecretCache({
+  let cache;
+  const post = async (operation, body) => {
+    try {
+      return await postSignedNode(options, `v1/node/vault/${operation}`, body);
+    } catch (cause) {
+      if (cause instanceof SignedNodeHttpError && cause.code === "VAULT_API_ONLY")
+        cache?.clear();
+      throw cause;
+    }
+  };
+  cache = createSecretCache({
     ttlMs: options.ttlMs,
     maxStaleMs: options.maxStaleMs,
     list: async () => {
@@ -4443,6 +4454,7 @@ function createNodeVaultCache(options) {
       };
     }
   });
+  return cache;
 }
 function startNodeVaultSync(cache, options = {}) {
   const interval = Math.max(1000, options.intervalMs ?? 30000);
@@ -9331,7 +9343,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.85";
+var VERSION2 = "0.1.86";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.17";
+}, VERSION = "0.1.18";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4810,8 +4810,9 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
+import { chmodSync as chmodSync7, existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
+import { randomBytes as randomBytes10 } from "crypto";
 
 // src/process-input.ts
 async function writeAndCloseProcessInput(input, value) {
@@ -4837,7 +4838,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.85";
+var VERSION2 = "0.1.86";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -12139,12 +12140,14 @@ var httpsOrigin = (name, raw) => {
   return value.origin;
 };
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
+  if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
+    throw new Error("initial platform deployment evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -12179,7 +12182,8 @@ function validatePlatformInitialInventory(value) {
       databaseRole: compute.databaseRole,
       databaseAgency: compute.databaseAgency,
       confidential: true
-    }))
+    })),
+    ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
 var systemdValue = (name, raw) => {
@@ -15143,8 +15147,10 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes"], "initial inventory");
+      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
       exactKeys2(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.deployment !== undefined)
+        exactKeys2(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))
         throw new Error("initial inventory computes must be an array");
       for (const compute of inventory.computes)
@@ -17430,7 +17436,7 @@ async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, a
 }
 
 // src/platform-genesis-config.ts
-function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region) {
+function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region, deployment) {
   const fleet = validatePlatformGenesisGuests(guests);
   if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(metalHostname)) {
     throw new Error("platform genesis requires the reviewed metal hostname");
@@ -17458,7 +17464,8 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
       confidential: guest.confidential,
       databaseRole: index === 0 ? "master" : "joiner",
       databaseAgency: "member"
-    }))
+    })),
+    ...deployment ? { deployment } : {}
   };
   return fleet.map((guest, index) => {
     const node = nodes[index];
@@ -17499,6 +17506,122 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
   });
 }
 
+// src/platform-launch-profile.ts
+var PROFILES = {
+  development: {
+    environment: "development",
+    branch: "dev",
+    appOrigin: "https://dev.forgezero.net",
+    apiOrigin: "https://dev-api.forgezero.net",
+    zoneName: "forgezero.net",
+    kvNamespaceTitle: "forgezero-dev-nodes",
+    workerScriptName: "forgezero-api-edge-development",
+    region: { key: "in-south", label: "India South", country: "IN" },
+    agentOtlpEndpoint: "https://otel.forgezero.net",
+    privateCidrs: ["10.42.0.0/24"]
+  },
+  production: {
+    environment: "production",
+    branch: "main",
+    appOrigin: "https://www.forgezero.net",
+    apiOrigin: "https://api.forgezero.net",
+    zoneName: "forgezero.net",
+    kvNamespaceTitle: "forgezero-nodes",
+    workerScriptName: "forgezero-api-edge-production",
+    region: { key: "in-south", label: "India South", country: "IN" },
+    agentOtlpEndpoint: "https://otel.forgezero.net",
+    privateCidrs: ["10.42.0.0/24"]
+  }
+};
+function forgeZeroLaunchProfile(environment) {
+  const profile = PROFILES[environment];
+  return {
+    ...profile,
+    nodeHostname: (index) => environment === "development" ? `dev-api-n${index + 1}.forgezero.net` : `api-n${index + 1}.forgezero.net`
+  };
+}
+var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
+  const fleet = validatePlatformGenesisGuests(guests);
+  if (!EMAIL.test(owner.custodianEmail) || !EMAIL.test(owner.email.from)) {
+    throw new Error("bootstrap custodian and From addresses must be valid email addresses");
+  }
+  if (owner.email.provider === "smtp" && (!owner.email.host || !Number.isInteger(owner.email.port) || owner.email.port < 1 || owner.email.port > 65535 || !owner.email.user)) {
+    throw new Error("SMTP host, port and user are required");
+  }
+  if (bundle.manifest.branch !== profile.branch)
+    throw new Error("bootstrap bundle branch does not match the launch profile");
+  const coordinators = fleet.map(({ address }) => `http://${address}:8529`);
+  const nodeHostnames = fleet.map((_, index) => profile.nodeHostname(index));
+  const first = fleet[0];
+  return validateBootstrapConfig({
+    kind: "platform",
+    environment: profile.environment,
+    profile: "platform-db-api",
+    computeReference: first.name,
+    nodeHostname: nodeHostnames[0],
+    apiUrl: profile.apiOrigin,
+    bootstrapBundle: {
+      bundleFile: bundle.bundlePath,
+      manifestFile: bundle.manifestPath,
+      branch: profile.branch
+    },
+    telemetryEndpoint: profile.agentOtlpEndpoint,
+    database: {
+      role: "master",
+      agency: "member",
+      readPreferred: false,
+      serverMode: "default",
+      address: first.address,
+      coordinators
+    },
+    enrolment: { source: "genesis-derived" },
+    runtime: {
+      environment: {
+        softwareProfile: "platform-db-api",
+        databaseRole: "master",
+        databaseCoordinators: coordinators,
+        databaseReadPreferredCoordinators: [],
+        databaseAddress: first.address,
+        databaseNetworkMode: "private-lan",
+        databaseReplicationFactor: 2,
+        databaseWriteConcern: 2,
+        databaseUser: "forgezero-api",
+        nodeHostname: nodeHostnames[0],
+        nodeRegion: profile.region.key,
+        nodeRole: "guest",
+        appOrigin: profile.appOrigin,
+        apiOrigin: profile.apiOrigin,
+        publicApiPort: 3000,
+        sharedDirectory: "/opt/forgezero/shared",
+        seedSyncPeers: fleet.slice(1).flatMap(({ address }) => [3001, 3002].map((port) => `ws://${address}:${port}/_internal/forgezero/seed-mesh/v2`)),
+        seedSyncMembers: nodeHostnames,
+        seedSyncEpoch: `${profile.environment}-${bundle.manifest.revision.slice(0, 16)}`,
+        concurrencyLimit: 128,
+        drainDeadlineMs: 30000,
+        otlpEndpoint: "http://127.0.0.1:4318",
+        otlpCollectorUnit: FORGEZERO_OTEL_COLLECTOR_UNIT,
+        agentOtlpEndpoint: profile.agentOtlpEndpoint,
+        otlpFlushIntervalMs: 1e4,
+        otlpTraceSampleRatio: 0.1,
+        custodianEmail: owner.custodianEmail,
+        email: owner.email,
+        deployProfile: profile.environment
+      },
+      serviceUser: "forgezero-api",
+      slotsDirectory: "/opt/forgezero/slots",
+      bluePort: 3001,
+      greenPort: 3002,
+      healthPath: "/api/health",
+      keepReleases: 5
+    },
+    firewall: { enabled: true, sshPort: 22, privateCidrs: [...profile.privateCidrs] },
+    installCloudflared: true,
+    installWarp: false,
+    cloudflareHandoff: { handoffFile: "/run/forgezero/cloudflare-handoff.json", nodeName: first.name }
+  });
+}
+
 // src/host-maintenance.ts
 import { lstatSync as lstatSync8, readFileSync as readFileSync13 } from "fs";
 var ROOT = "/opt/forgezero";
@@ -18052,6 +18175,8 @@ function parseOptions(argv2) {
       options.dataFile = argv2[++index];
     else if (token === "--bootstrap-config")
       options.bootstrapConfigPath = argv2[++index];
+    else if (token === "--secrets-env-file")
+      options.bootstrapSecretsEnvFile = argv2[++index];
     else if (token === "--output")
       options.outputPath = argv2[++index];
     else if (token === "--query")
@@ -18648,9 +18773,100 @@ async function bootstrapSecret(question) {
     throw new Error(`${question} was not provided`);
   return value;
 }
-async function promptPlatformBootstrapSecrets(config) {
+var PLATFORM_CLUSTER_CREDENTIAL = "forgezero-platform-cluster-bootstrap-code";
+function readPlatformLaunchEnvironment(path) {
+  const absolute2 = resolve12(path);
+  const stat2 = lstatSync10(absolute2);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
+    throw new Error(`bootstrap secret environment must be one owner-only regular file: ${absolute2}`);
+  }
+  const values = new Map;
+  for (const [index, raw] of readFileSync16(absolute2, "utf8").split(/\r?\n/).entries()) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match)
+      throw new Error(`invalid environment assignment at ${absolute2}:${index + 1}`);
+    if (values.has(match[1]))
+      throw new Error(`duplicate environment assignment ${match[1]} at ${absolute2}:${index + 1}`);
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    values.set(match[1], value);
+  }
+  const requiredValue = (name) => {
+    const value = values.get(name)?.trim();
+    if (!value)
+      throw new Error(`bootstrap secret environment is missing ${name}`);
+    return value;
+  };
+  const provider = requiredValue("FZ_EMAIL_PROVIDER");
+  if (provider !== "smtp" && provider !== "jetemail")
+    throw new Error("FZ_EMAIL_PROVIDER must be smtp or jetemail");
+  const smtpPort = provider === "smtp" ? Number(requiredValue("FZ_SMTP_PORT")) : undefined;
+  if (smtpPort !== undefined && (!Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535)) {
+    throw new Error("FZ_SMTP_PORT must be an integer from 1 through 65535");
+  }
+  const owner = provider === "jetemail" ? {
+    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
+    email: {
+      provider,
+      from: requiredValue("FZ_EMAIL_FROM"),
+      eu: (values.get("FZ_JETEMAIL_EU") ?? "false").trim().toLowerCase() === "true"
+    }
+  } : {
+    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
+    email: {
+      provider,
+      from: requiredValue("FZ_EMAIL_FROM"),
+      host: requiredValue("FZ_SMTP_HOST"),
+      port: smtpPort,
+      user: requiredValue("FZ_SMTP_USER")
+    }
+  };
+  return {
+    owner,
+    emailSecret: requiredValue(provider === "jetemail" ? "FZ_JETEMAIL_API_KEY" : "FZ_SMTP_PASSWORD"),
+    cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
+    cloudflareApiToken: requiredValue("CF_API_TOKEN")
+  };
+}
+async function platformLaunchClusterBootstrapCode(outputDirectory) {
+  const path = join13(dirname14(outputDirectory), `${PLATFORM_CLUSTER_CREDENTIAL}.cred`);
+  if (existsSync12(path)) {
+    const stat2 = lstatSync10(path);
+    if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
+      throw new Error(`platform cluster credential must be one owner-only regular file: ${path}`);
+    }
+    const child2 = Bun.spawn(["systemd-creds", "decrypt", `--name=${PLATFORM_CLUSTER_CREDENTIAL}`, path, "-"], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+    const [stdout, stderr2, exitCode2] = await Promise.all([
+      new Response(child2.stdout).text(),
+      new Response(child2.stderr).text(),
+      child2.exited
+    ]);
+    if (exitCode2 !== 0)
+      throw new Error(`cannot open the retained platform cluster credential: ${stderr2.trim()}`);
+    const value2 = stdout.trim();
+    if (!/^[a-f0-9]{64}$/i.test(value2))
+      throw new Error("retained platform cluster credential is invalid");
+    return value2;
+  }
+  mkdirSync13(dirname14(path), { recursive: true, mode: 448 });
+  const value = randomBytes10(32).toString("hex");
+  const child = Bun.spawn(["systemd-creds", "encrypt", `--name=${PLATFORM_CLUSTER_CREDENTIAL}`, "-", path], { stdin: "pipe", stdout: "pipe", stderr: "pipe" });
+  await writeAndCloseProcessInput(child.stdin, `${value}
+`);
+  const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited]);
+  if (exitCode !== 0)
+    throw new Error(`cannot retain the platform cluster credential: ${stderr.trim()}`);
+  chmodSync7(path, 384);
+  return value;
+}
+async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapCode) {
   return validatePlatformBootstrapSecrets(config, {
-    clusterBootstrapCode: await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
+    clusterBootstrapCode: generatedClusterBootstrapCode ?? await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
     emailSecret: await bootstrapSecret(config.runtime.environment.email?.provider === "jetemail" ? "JetEmail API key" : "SMTP password"),
     ...config.enrolment.source === "api-token" ? { enrolmentToken: await bootstrapSecret("API-issued one-time platform enrolment token") } : {},
     ...config.runtime.environment.backup ? { backupS3Secret: await bootstrapSecret("Backup S3 secret key") } : {},
@@ -18843,51 +19059,53 @@ function writeMetalOperatorFiles(directory) {
   });
   return { metalConfig, remoteRequest };
 }
-function writePlatformGenesisFleet(directory) {
+function writePlatformGenesisFleet(directory, preset) {
   const output = genesisOutputDirectory(directory);
-  const metalRequestFile = bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
+  const metalRequestFile = preset?.metalRequestFile ?? bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
   const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile, { validateMetalConfig: false });
-  const guestHostKeysFile = bootstrapAnswer("Owner-only guest host-key evidence file");
+  const guestHostKeysFile = preset?.guestHostKeysFile ?? bootstrapAnswer("Owner-only guest host-key evidence file");
   const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
   const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile, {
     allowHistoricalRelease: true
   }).metalHostname;
   const checkpointPath = join13(output, "cloudflare-handoff.json");
-  const template = interactiveBootstrap("platform", fleet, checkpointPath);
-  const region = {
+  const template = preset ? forgeZeroLaunchTemplate(preset.profile, fleet, preset.bundle, preset.owner) : interactiveBootstrap("platform", fleet, checkpointPath);
+  const region = preset ? preset.profile.region : {
     label: bootstrapAnswer(`Region ${template.runtime.environment.nodeRegion} display label`),
     country: bootstrapAnswer("Region ISO 3166-1 alpha-2 country code").toUpperCase(),
     city: bootstrapAnswer("Region city")
   };
-  const nodes = fleet.map((guest, index) => index === 0 ? {
-    nodeHostname: template.nodeHostname,
-    cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
-  } : {
-    nodeHostname: bootstrapAnswer(`${guest.name} public node hostname`),
+  const nodes = fleet.map((guest, index) => ({
+    nodeHostname: preset ? preset.profile.nodeHostname(index) : index === 0 ? template.nodeHostname : bootstrapAnswer(`${guest.name} public node hostname`),
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
-  });
-  const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
+  }));
+  const realtimeEnabled = preset ? true : bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
   const cloudflareConfig = writeBootstrapConfig(join13(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
     discovery: {
-      zoneName: bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
-      kvNamespaceTitle: bootstrapAnswer("Existing Worker-bound KV namespace title"),
+      zoneName: preset?.profile.zoneName ?? bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
+      kvNamespaceTitle: preset?.profile.kvNamespaceTitle ?? bootstrapAnswer("Existing Worker-bound KV namespace title"),
       ...realtimeEnabled ? {
-        workerScriptName: bootstrapAnswer("Existing Worker script name"),
-        endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
-        producer: bootstrapAnswer("Realtime producer identity", "platform-api")
+        workerScriptName: preset?.profile.workerScriptName ?? bootstrapAnswer("Existing Worker script name"),
+        endpoint: preset?.profile.apiOrigin ?? bootstrapAnswer("Stable public Worker HTTPS endpoint"),
+        producer: "platform-api"
       } : {}
     },
     nodes: fleet.map((guest, index) => ({
       nodeName: guest.name,
       hostname: nodes[index].nodeHostname,
       service: "http://127.0.0.1:3000",
-      tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
+      tunnelName: preset ? guest.name : bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
     }))
   }));
   const cloudflareAcceptance = join13(output, "cloudflare-acceptance.json");
-  const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
+  const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region, preset ? {
+    source: "bootstrap-bundle",
+    branch: preset.profile.branch,
+    revision: preset.bundle.manifest.revision,
+    bundleSha256: preset.bundle.manifest.sha256
+  } : undefined).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     writeBootstrapConfig(path, config);
     return path;
@@ -18919,6 +19137,66 @@ function writePlatformGenesisFleet(directory) {
   const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join13(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
   return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
+function selectedForgeZeroLaunchEnvironment(value) {
+  if (value === "app")
+    return "development";
+  if (value !== "development" && value !== "production") {
+    throw new Error("platform launch --profile must be development or production");
+  }
+  return value;
+}
+function forgeZeroLaunchOwnerInput() {
+  const custodianEmail = bootstrapAnswer("First custodian email");
+  const provider = bootstrapAnswer("Bootstrap email provider (smtp/jetemail)", "jetemail");
+  if (provider !== "smtp" && provider !== "jetemail") {
+    throw new Error("Bootstrap email provider must be smtp or jetemail");
+  }
+  const from = bootstrapAnswer("Bootstrap email From address");
+  if (provider === "jetemail") {
+    return {
+      custodianEmail,
+      email: { provider, from, eu: bootstrapBoolean("Use JetEmail EU processing?", "no") }
+    };
+  }
+  return {
+    custodianEmail,
+    email: {
+      provider,
+      from,
+      host: bootstrapAnswer("SMTP host"),
+      port: bootstrapNumber("SMTP port", "587"),
+      user: bootstrapAnswer("SMTP user")
+    }
+  };
+}
+async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, projectRoot, owner) {
+  const profile = forgeZeroLaunchProfile(environment);
+  const base = dirname14(outputDirectory);
+  const metalRequestFile = join13(base, "metal", "metal-remote.json");
+  const guestHostKeysFile = join13(base, "genesis-guest-host-keys.json");
+  for (const [path, label] of [
+    [metalRequestFile, "reviewed Metal request"],
+    [guestHostKeysFile, "pinned genesis guest host-key evidence"]
+  ]) {
+    if (!existsSync12(path))
+      throw new Error(`${label} is missing at ${path}`);
+  }
+  const root = resolve12(projectRoot);
+  const nestedApi = join13(root, "api");
+  const repositoryRoot = existsSync12(join13(nestedApi, "package.json")) ? nestedApi : root;
+  const bundlePath = join13(base, "api.bundle");
+  const bundle = existsSync12(bundlePath) || existsSync12(`${bundlePath}.json`) ? await readBootstrapBundle(bundlePath) : await buildBootstrapBundle({ repositoryRoot, outputPath: bundlePath, branch: profile.branch });
+  if (bundle.manifest.branch !== profile.branch) {
+    throw new Error(`existing bootstrap bundle is for ${bundle.manifest.branch}, expected ${profile.branch}`);
+  }
+  return writePlatformGenesisFleet(outputDirectory, {
+    profile,
+    metalRequestFile,
+    guestHostKeysFile,
+    bundle,
+    owner: owner ?? forgeZeroLaunchOwnerInput()
+  });
+}
 function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
@@ -19038,7 +19316,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
     } : {}
   };
 }
-async function runAttendedPlatformFleet(fleet, apply) {
+async function runAttendedPlatformFleet(fleet, apply, generatedClusterBootstrapCode, environmentInput) {
   const plan = planOperatorPlatformFleetBootstrap(fleet, "apply");
   const cloudflarePlan = readCloudflareBootstrapCommandPlan(fleet.cloudflareConfigFile);
   const coordinates = operatorPlatformFleetCoordinates(fleet);
@@ -19069,7 +19347,12 @@ async function runAttendedPlatformFleet(fleet, apply) {
   const firstConfig = readBootstrapConfig(first.platformConfigFile);
   if (firstConfig.kind !== "platform")
     throw new Error("remote platform fleet requires platform configs");
-  const secrets = await promptPlatformBootstrapSecrets(firstConfig);
+  const secrets = environmentInput ? validatePlatformBootstrapSecrets(firstConfig, {
+    clusterBootstrapCode: generatedClusterBootstrapCode,
+    emailSecret: environmentInput.emailSecret,
+    cloudflareTunnelToken: environmentInput.cloudflareTunnelToken,
+    cloudflareApiToken: environmentInput.cloudflareApiToken
+  }) : await promptPlatformBootstrapSecrets(firstConfig, generatedClusterBootstrapCode);
   const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
     tunnelToken: secrets.cloudflareTunnelToken,
     apiToken: secrets.cloudflareApiToken
@@ -19104,15 +19387,21 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (operation === "platform" && args[1] === "launch") {
-      if (args[2] !== undefined || !options.outputPath || options.bootstrapConfigPath) {
-        throw new Error("Usage: fz bootstrap platform launch --output <absolute-owner-only-directory> [--apply]");
+      if (args[2] !== undefined || options.bootstrapConfigPath) {
+        throw new Error("Usage: fz bootstrap platform launch [--profile development|production] [--output <absolute-owner-only-directory>] [--secrets-env-file <owner-only-env>] [--apply]");
       }
-      const generated = writePlatformGenesisFleet(options.outputPath);
+      const environment = selectedForgeZeroLaunchEnvironment(options.deployProfile);
+      if (environment === "production" && options.bootstrapSecretsEnvFile) {
+        throw new Error("production platform launch requires interactive hidden secret prompts");
+      }
+      const outputDirectory = options.outputPath ?? `/secure/forgezero/${environment}/genesis`;
+      const environmentInput = options.bootstrapSecretsEnvFile ? readPlatformLaunchEnvironment(options.bootstrapSecretsEnvFile) : undefined;
+      const generated = await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner);
       const fleet = readOperatorPlatformBootstrapFleetRequest(generated.fleetRequest);
-      if (options.apply && bootstrapAnswer("Type APPLY to run the reviewed Cloudflare and three-compute plan") !== "APPLY") {
+      if (options.apply && !environmentInput && bootstrapAnswer("Type APPLY to run the reviewed Cloudflare and three-compute plan") !== "APPLY") {
         throw new Error("attended platform bootstrap was not confirmed");
       }
-      return await runAttendedPlatformFleet(fleet, options.apply);
+      return await runAttendedPlatformFleet(fleet, options.apply, options.apply ? await platformLaunchClusterBootstrapCode(outputDirectory) : undefined, environmentInput);
     }
     if (operation === "platform" && args[1] === "fleet") {
       const mode = args[2];
@@ -19922,8 +20211,9 @@ function usage() {
 	 fz bootstrap platform bundle
 	                         Build one clean exact-revision API Git bundle for genesis
 	 fz bootstrap platform launch
-	                         Prompt, review and run the complete attended platform
-	                         bootstrap; --output is the owner-only working directory
+	                         One profile-driven attended launch. Public topology,
+	                         bundle and edge names are derived; the owner supplies
+	                         only email settings, hidden provider tokens and APPLY
 	 fz bootstrap platform remote <apply|status>
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host; apply copies and verifies that bundle
@@ -20025,7 +20315,7 @@ function usage() {
     --root <path>           Project root for project/deploy commands
     --name <name>           Project or deploy name during init
     --purpose <text>        Product outcome during project init
-    --profile <name>        Initial deploy profile (default app)
+    --profile <name>        Platform launch environment or initial deploy profile
     --software <key@ver>    Initial tested software coordinate; repeatable
     --channel <name>        Catalog view: production or development (shows testing)
     --attestation           Require hardware attestation for every deploy step

package/dist/guest-enrolment.js

@@ -22,9 +22,11 @@ import {
 
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -71,7 +73,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.85";
+var VERSION = "0.1.86";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/migration-pull.js

@@ -9,9 +9,11 @@ import {
 
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -58,7 +60,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);

package/dist/node-vault.js

@@ -129,9 +129,11 @@ import {
 
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -178,7 +180,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);
@@ -216,8 +218,17 @@ function tenantNodeApiUrl(apiUrl, tenantSlug) {
   return url.toString().replace(/\/$/, "");
 }
 function createNodeVaultCache(options) {
-  const post = (operation, body) => postSignedNode(options, `v1/node/vault/${operation}`, body);
-  return createSecretCache({
+  let cache;
+  const post = async (operation, body) => {
+    try {
+      return await postSignedNode(options, `v1/node/vault/${operation}`, body);
+    } catch (cause) {
+      if (cause instanceof SignedNodeHttpError && cause.code === "VAULT_API_ONLY")
+        cache?.clear();
+      throw cause;
+    }
+  };
+  cache = createSecretCache({
     ttlMs: options.ttlMs,
     maxStaleMs: options.maxStaleMs,
     list: async () => {
@@ -246,6 +257,7 @@ function createNodeVaultCache(options) {
       };
     }
   });
+  return cache;
 }
 function startNodeVaultSync(cache, options = {}) {
   const interval = Math.max(1000, options.intervalMs ?? 30000);

package/dist/operator-bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.85";
+var VERSION = "0.1.86";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3002,12 +3002,14 @@ var httpsOrigin = (name, raw) => {
   return value.origin;
 };
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
+  if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
+    throw new Error("initial platform deployment evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -3042,7 +3044,8 @@ function validatePlatformInitialInventory(value) {
       databaseRole: compute.databaseRole,
       databaseAgency: compute.databaseAgency,
       confidential: true
-    }))
+    })),
+    ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
 var systemdValue = (name, raw) => {
@@ -4770,8 +4773,10 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.deployment !== undefined)
+        exactKeys(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))
         throw new Error("initial inventory computes must be an array");
       for (const compute of inventory.computes)

package/dist/platform-bootstrap-runtime.d.ts

@@ -31,6 +31,13 @@ export interface PlatformInitialInventory {
         PlatformInitialInventoryCompute,
         PlatformInitialInventoryCompute
     ];
+    /** Generation-one release evidence; external Git automation is connected after custody opens Vault. */
+    deployment?: {
+        source: 'bootstrap-bundle';
+        branch: 'dev' | 'main';
+        revision: string;
+        bundleSha256: string;
+    };
 }
 export type PlatformBootstrapEmail = {
     provider: 'smtp';

package/dist/platform-bootstrap-runtime.js

@@ -724,12 +724,14 @@ var httpsOrigin = (name, raw) => {
   return value.origin;
 };
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
+  if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
+    throw new Error("initial platform deployment evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -764,7 +766,8 @@ function validatePlatformInitialInventory(value) {
       databaseRole: compute.databaseRole,
       databaseAgency: compute.databaseAgency,
       confidential: true
-    }))
+    })),
+    ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
 var systemdValue = (name, raw) => {

package/dist/platform-fleet-verification.js

@@ -2647,7 +2647,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.85";
+var VERSION3 = "0.1.86";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -3820,12 +3820,14 @@ var httpsOrigin = (name, raw) => {
   return value.origin;
 };
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
+  if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
+    throw new Error("initial platform deployment evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -3860,7 +3862,8 @@ function validatePlatformInitialInventory(value) {
       databaseRole: compute.databaseRole,
       databaseAgency: compute.databaseAgency,
       confidential: true
-    }))
+    })),
+    ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
 var systemdValue = (name, raw) => {

package/dist/platform-genesis-config.d.ts

@@ -10,4 +10,9 @@ export interface PlatformGenesisRegionInput {
     city?: string;
 }
 /** Expand one reviewed common template into the exact three genesis hosts. */
-export declare function platformGenesisBootstrapConfigs(template: PlatformBootstrapConfig, guests: readonly PlatformGenesisGuest[], nodes: readonly PlatformGenesisNodeConfigInput[], metalHostname: string, region: PlatformGenesisRegionInput): readonly PlatformBootstrapConfig[];
+export declare function platformGenesisBootstrapConfigs(template: PlatformBootstrapConfig, guests: readonly PlatformGenesisGuest[], nodes: readonly PlatformGenesisNodeConfigInput[], metalHostname: string, region: PlatformGenesisRegionInput, deployment?: {
+    source: 'bootstrap-bundle';
+    branch: 'dev' | 'main';
+    revision: string;
+    bundleSha256: string;
+}): readonly PlatformBootstrapConfig[];

package/dist/platform-launch-profile.d.ts

@@ -0,0 +1,44 @@
+import type { PlatformBootstrapConfig } from './bootstrap';
+import type { BootstrapBundleBuildResult } from './bootstrap-bundle';
+import type { PlatformGenesisGuest } from './platform-genesis';
+export type ForgeZeroLaunchEnvironment = 'development' | 'production';
+export interface ForgeZeroLaunchProfile {
+    environment: ForgeZeroLaunchEnvironment;
+    branch: 'dev' | 'main';
+    appOrigin: string;
+    apiOrigin: string;
+    zoneName: 'forgezero.net';
+    kvNamespaceTitle: string;
+    workerScriptName: string;
+    region: {
+        key: string;
+        label: string;
+        country: string;
+        city?: string;
+    };
+    agentOtlpEndpoint: string;
+    privateCidrs: readonly string[];
+    nodeHostname(nodeIndex: number): string;
+}
+export interface ForgeZeroLaunchOwnerInput {
+    custodianEmail: string;
+    email: {
+        provider: 'smtp';
+        host: string;
+        port: number;
+        user: string;
+        from: string;
+    } | {
+        provider: 'jetemail';
+        from: string;
+        eu: boolean;
+    };
+}
+/**
+ * ForgeZero's own genesis public coordinates. They are reviewed source data,
+ * not an operator questionnaire. Tenant and reusable Agent deployments remain
+ * driven by their own typed plans and never inherit these product coordinates.
+ */
+export declare function forgeZeroLaunchProfile(environment: ForgeZeroLaunchEnvironment): ForgeZeroLaunchProfile;
+/** Build the one common config which is expanded into the three fixed nodes. */
+export declare function forgeZeroLaunchTemplate(profile: ForgeZeroLaunchProfile, guests: readonly PlatformGenesisGuest[], bundle: BootstrapBundleBuildResult, owner: ForgeZeroLaunchOwnerInput): PlatformBootstrapConfig;

package/dist/provision.js

@@ -2647,7 +2647,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.85";
+var VERSION3 = "0.1.86";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provisioning-pull.js

@@ -9,9 +9,11 @@ import {
 
 class SignedNodeHttpError extends Error {
   status;
-  constructor(status, message) {
+  code;
+  constructor(status, message, code) {
     super(message);
     this.status = status;
+    this.code = code;
     this.name = "SignedNodeHttpError";
   }
 }
@@ -58,7 +60,7 @@ async function postSignedNode(options, path, body) {
   if (!response.ok) {
     const failure = payload;
     const reason = failure ? failure.error?.message ?? failure.message : undefined;
-    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`);
+    throw new SignedNodeHttpError(response.status, reason || `signed node request returned HTTP ${response.status}`, failure?.error?.code);
   }
   try {
     return await openResponse(recipient.secretKey, signature, payload);

package/dist/signed-node-http.d.ts

@@ -8,7 +8,8 @@ export interface SignedNodeHttpOptions {
 }
 export declare class SignedNodeHttpError extends Error {
     readonly status: number;
-    constructor(status: number, message: string);
+    readonly code?: string | undefined;
+    constructor(status: number, message: string, code?: string | undefined);
 }
 /**
  * Validate the one origin every outbound Agent client shares.

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.85";
+export declare const VERSION = "0.1.86";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.85",
+  "version": "0.1.86",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",
@@ -11,13 +11,13 @@
     "typescript": "^5.6.0",
     "@types/bun": "latest",
     "@types/node": "^22.0.0",
-    "@forgezero/access": "0.1.7",
+    "@forgezero/access": "0.1.8",
     "@noble/curves": "^2.2.0",
     "@noble/post-quantum": "^0.6.1"
   },
   "dependencies": {
-    "@forgezero/runtime": "0.1.12",
-    "@forgezero/vault": "0.1.17",
+    "@forgezero/runtime": "0.1.13",
+    "@forgezero/vault": "0.1.18",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "@noble/post-quantum": "0.6.1",