@forgezero/agent 0.1.85 → 0.1.87

package/dist/fz.js

@@ -4634,7 +4634,7 @@ var VaultError, runtimeEnvironment = () => typeof process !== "undefined" && pro
   } catch {
     return;
   }
-}, VERSION = "0.1.17";
+}, VERSION = "0.1.18";
 var init_dist = __esm(() => {
   init_identity();
   VaultError = class VaultError extends Error {
@@ -4810,8 +4810,9 @@ async function spawnWith(command, env, report = () => {}, options = {}) {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
+import { chmodSync as chmodSync7, existsSync as existsSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync13, readFileSync as readFileSync16, writeFileSync as writeFileSync13 } from "fs";
 import { basename as basename3, dirname as dirname14, isAbsolute as isAbsolute7, join as join13, resolve as resolve12 } from "path";
+import { randomBytes as randomBytes10 } from "crypto";
 
 // src/process-input.ts
 async function writeAndCloseProcessInput(input, value) {
@@ -4826,9 +4827,13 @@ import { hostname } from "os";
 
 // src/agent-update.ts
 var DEFAULT_AGENT_RELEASE_ROOT = "/opt/forgezero/agent";
+var DEFAULT_AGENT_CANDIDATE_LINK = `${DEFAULT_AGENT_RELEASE_ROOT}/candidate`;
 var DEFAULT_AGENT_UPDATE_SOCKET = "/run/forgezero-update/helper.sock";
 var MAX_AGENT_TARBALL_BYTES = 32 * 1024 * 1024;
 
+// src/agent-handover.ts
+var DEFAULT_AGENT_CANDIDATE_READY_SOCKET = "/run/forgezero/candidate-ready.sock";
+
 // src/agent-update-helper.ts
 var AGENT_UPDATE_GROUP = "forgezero-update";
 var AGENT_UPDATE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-agent-update-helper.service";
@@ -4837,7 +4842,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.85";
+var VERSION2 = "0.1.87";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -5454,6 +5459,7 @@ var LIFECYCLE_GROUP = "forgezero-lifecycle";
 var DEPLOYMENT_RUNNER_UNIT_PATH = "/etc/systemd/system/forgezero-deploy-runner.service";
 var AGENT_SOCKET_UNIT_PATH = "/etc/systemd/system/forgezero-agent.socket";
 var AGENT_SOCKET_PROXY_UNIT_PATH = "/etc/systemd/system/forgezero-agent-proxy.service";
+var AGENT_CANDIDATE_UNIT_PATH = "/etc/systemd/system/forgezero-agent-candidate.service";
 var DEPLOYMENT_RUNNER_SOCKET = "/run/forgezero-deploy/runner.sock";
 var ENROLMENT_UNIT_PATH = "/etc/systemd/system/forgezero-agent-enrol.service";
 var LIFECYCLE_HELPER_UNIT_PATH = "/etc/systemd/system/forgezero-lifecycle-helper.service";
@@ -5565,6 +5571,7 @@ Type=simple
 User=root
 Group=${AGENT_UPDATE_GROUP}
 Environment=FZ_AGENT_UPDATE_SOCKET=${DEFAULT_AGENT_UPDATE_SOCKET}
+Environment=FZ_AGENT_PUBLIC_SOCKET=${systemdPath(options.socketPath, "agent socket")}
 ExecStart=${bin} update-helper
 Restart=always
 RestartSec=2
@@ -5609,13 +5616,11 @@ WantedBy=sockets.target
 `;
 }
 function agentSocketProxyUnit(options) {
-  const backend = agentBackendSocketPath(options.socketPath);
+  const backend = agentRoutingSocketPath(options.socketPath);
   const user = options.user ?? "forgezero";
   return `[Unit]
 Description=ForgeZero application Vault socket proxy
 Documentation=https://www.forgezero.net/docs/agent
-Requires=forgezero-agent.service
-After=forgezero-agent.service
 
 [Service]
 User=${user}
@@ -5636,12 +5641,26 @@ RestrictAddressFamilies=AF_UNIX
 `;
 }
 function agentBackendSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend.active`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
+function agentRoutingSocketPath(publicSocketPath) {
   const socket = systemdPath(publicSocketPath, "agent socket");
   const backend = `${socket}.backend`;
   if (Buffer.byteLength(backend) > 100)
     throw new Error("agent socket path is too long for a Unix socket");
   return backend;
 }
+function agentCandidateSocketPath(publicSocketPath) {
+  const socket = systemdPath(publicSocketPath, "agent socket");
+  const backend = `${socket}.backend.candidate`;
+  if (Buffer.byteLength(backend) > 100)
+    throw new Error("agent socket path is too long for a Unix socket");
+  return backend;
+}
 var systemdPath = (value, label) => {
   if (!value || !/^\/[A-Za-z0-9._@/-]+$/.test(value))
     throw new Error(`invalid ${label} path`);
@@ -5925,7 +5944,11 @@ function agentUnit(options) {
   }
   const environment = [
     "NODE_ENV=production",
-    `FZ_SOCKET_PATH=${agentBackendSocketPath(options.socketPath)}`,
+    `FZ_SOCKET_PATH=${options.backendSocketPath ?? agentBackendSocketPath(options.socketPath)}`,
+    `FZ_AGENT_PUBLIC_SOCKET=${options.socketPath}`,
+    `FZ_AGENT_ROUTE_SOCKET=${agentRoutingSocketPath(options.socketPath)}`,
+    options.handoverCandidate ? "FZ_AGENT_HANDOVER_CANDIDATE=true" : null,
+    options.handoverCandidate ? `FZ_AGENT_HANDOVER_READY_SOCKET=${DEFAULT_AGENT_CANDIDATE_READY_SOCKET}` : null,
     `FZ_CONTROL_SOCKET=${controlSocketPath}`,
     `FZ_SEED_CREDENTIAL=agent-seed`,
     `FZ_AGENT_MODE=${options.mode}`,
@@ -6062,6 +6085,26 @@ ${deploymentWrites}
 WantedBy=multi-user.target
 `;
 }
+function agentCandidateUnit(options) {
+  return agentUnit({
+    ...options,
+    binPath: `${DEFAULT_AGENT_RELEASE_ROOT}/candidate/dist/fz-agent.js`,
+    backendSocketPath: agentCandidateSocketPath(options.socketPath),
+    handoverCandidate: true,
+    gitCredentialPath: undefined,
+    deploymentCredentials: {},
+    bootstrapSshCredentialPath: undefined,
+    bootstrapSshPublicKeyPath: undefined,
+    pullBootstrap: false,
+    pullDeployments: false,
+    pullMigrations: false,
+    lifecycleProfilePath: undefined,
+    bootstrapTargetTelemetryEndpoint: undefined,
+    repository: undefined,
+    bootstrapBundlePath: undefined,
+    bootstrapBundleManifestPath: undefined
+  }).replace("Description=ForgeZero node agent", "Description=ForgeZero candidate node agent");
+}
 var renderOperation = (operation) => {
   if (operation.kind === "commands")
     return operation.commands.map(({ argv: argv2 }) => argv2.join(" ")).join(`
@@ -6197,6 +6240,7 @@ function planProvision(options) {
     auxiliaryUnits: [
       { path: AGENT_SOCKET_UNIT_PATH, unit: agentSocketUnit(options) },
       { path: AGENT_SOCKET_PROXY_UNIT_PATH, unit: agentSocketProxyUnit(options) },
+      { path: AGENT_CANDIDATE_UNIT_PATH, unit: agentCandidateUnit(options) },
       { path: AGENT_UPDATE_HELPER_UNIT_PATH, unit: agentUpdateHelperUnit(options) },
       ...options.enforceEgress ? [
         { path: AGENT_EGRESS_UNIT_PATH, unit: agentEgressUnit(options) }
@@ -12139,12 +12183,14 @@ var httpsOrigin = (name, raw) => {
   return value.origin;
 };
 function validatePlatformInitialInventory(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["metalHostname", "region", "computes", "deployment"].includes(key)) || !/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(value.metalHostname) || !value.region || typeof value.region !== "object" || Array.isArray(value.region) || Object.keys(value.region).some((key) => !["key", "label", "country", "city", "confidentialCapable"].includes(key)) || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(value.region.key) || !/^[A-Z]{2}$/.test(value.region.country) || value.region.confidentialCapable !== true || !Array.isArray(value.computes)) {
     throw new Error("initial platform inventory coordinates are invalid");
   }
   safeAtom("initialInventory.region.label", value.region.label);
   if (value.region.city !== undefined)
     safeAtom("initialInventory.region.city", value.region.city);
+  if (value.deployment !== undefined && (!value.deployment || typeof value.deployment !== "object" || Array.isArray(value.deployment) || Object.keys(value.deployment).some((key) => !["source", "branch", "revision", "bundleSha256"].includes(key)) || value.deployment.source !== "bootstrap-bundle" || !["dev", "main"].includes(value.deployment.branch) || !/^[a-f0-9]{40}$/.test(value.deployment.revision) || !/^[a-f0-9]{64}$/.test(value.deployment.bundleSha256)))
+    throw new Error("initial platform deployment evidence is invalid");
   const computes = validatePlatformGenesisGuests(value.computes.map((compute) => {
     if (!compute || typeof compute !== "object" || Array.isArray(compute) || Object.keys(compute).some((key) => ![
       "name",
@@ -12179,7 +12225,8 @@ function validatePlatformInitialInventory(value) {
       databaseRole: compute.databaseRole,
       databaseAgency: compute.databaseAgency,
       confidential: true
-    }))
+    })),
+    ...value.deployment ? { deployment: { ...value.deployment } } : {}
   };
 }
 var systemdValue = (name, raw) => {
@@ -15143,8 +15190,10 @@ function strictBootstrapDocument(value) {
     ], "runtime environment");
     const environment = runtime.environment;
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes"], "initial inventory");
+      const inventory = exactKeys2(environment.initialInventory, ["metalHostname", "region", "computes", "deployment"], "initial inventory");
       exactKeys2(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
+      if (inventory.deployment !== undefined)
+        exactKeys2(inventory.deployment, ["source", "branch", "revision", "bundleSha256"], "initial deployment evidence");
       if (!Array.isArray(inventory.computes))
         throw new Error("initial inventory computes must be an array");
       for (const compute of inventory.computes)
@@ -16035,6 +16084,7 @@ function planMetalBootstrap(config) {
       "forgezero-metal-helper.service",
       "forgezero-agent-update-helper.service",
       "forgezero-metal-agent-egress.service",
+      "forgezero-metal-agent-candidate.service",
       "forgezero-metal-agent.service"
     ],
     steps: [
@@ -16176,6 +16226,44 @@ RestrictAddressFamilies=AF_UNIX AF_NETLINK
 
 [Install]
 WantedBy=multi-user.target
+`,
+    "forgezero-metal-agent-candidate.service": `[Unit]
+Description=ForgeZero candidate physical-host Agent
+After=network-online.target ${config.hostTelemetryUnit} forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+Requires=forgezero-agent-update-helper.service forgezero-metal-agent-egress.service
+
+[Service]
+Type=simple
+User=forgezero-metal
+Group=forgezero-metal
+SupplementaryGroups=forgezero-update
+LoadCredentialEncrypted=metal-agent-seed:${SEED_CREDENTIAL_PATH}
+Environment=FZ_SEED_CREDENTIAL=metal-agent-seed
+Environment=FZ_AGENT_ROLE=metal
+Environment=FZ_AGENT_HANDOVER_CANDIDATE=true
+Environment=FZ_AGENT_HANDOVER_READY_SOCKET=/run/forgezero/candidate-ready.sock
+Environment=FZ_METAL_HOSTNAME=${config.metalHostname}
+Environment=FZ_API=${config.profile.apiUrl}
+Environment=NODE_ENV=production
+Environment=OTEL_EXPORTER_OTLP_ENDPOINT=${config.hostTelemetryEndpoint}
+Environment=OTEL_SERVICE_NAME=forgezero-metal-agent-candidate
+ExecStart=/opt/forgezero/agent/candidate/dist/fz-agent.js
+Restart=on-failure
+RestartSec=2
+RuntimeDirectory=forgezero
+RuntimeDirectoryMode=0750
+RuntimeDirectoryPreserve=yes
+LimitCORE=0
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictSUIDSGID=true
+LockPersonality=true
+${egress}
 `,
     "forgezero-metal-agent.service": `[Unit]
 Description=ForgeZero identity-only physical-host Agent
@@ -17430,7 +17518,7 @@ async function applyAttendedPlatformBootstrap(fleetRequest, cloudflareRequest, a
 }
 
 // src/platform-genesis-config.ts
-function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region) {
+function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname, region, deployment) {
   const fleet = validatePlatformGenesisGuests(guests);
   if (!/^[A-Za-z0-9][A-Za-z0-9.-]{1,252}$/.test(metalHostname)) {
     throw new Error("platform genesis requires the reviewed metal hostname");
@@ -17458,7 +17546,8 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
       confidential: guest.confidential,
       databaseRole: index === 0 ? "master" : "joiner",
       databaseAgency: "member"
-    }))
+    })),
+    ...deployment ? { deployment } : {}
   };
   return fleet.map((guest, index) => {
     const node = nodes[index];
@@ -17499,6 +17588,122 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
   });
 }
 
+// src/platform-launch-profile.ts
+var PROFILES = {
+  development: {
+    environment: "development",
+    branch: "dev",
+    appOrigin: "https://dev.forgezero.net",
+    apiOrigin: "https://dev-api.forgezero.net",
+    zoneName: "forgezero.net",
+    kvNamespaceTitle: "forgezero-dev-nodes",
+    workerScriptName: "forgezero-api-edge-development",
+    region: { key: "in-south", label: "India South", country: "IN" },
+    agentOtlpEndpoint: "https://otel.forgezero.net",
+    privateCidrs: ["10.42.0.0/24"]
+  },
+  production: {
+    environment: "production",
+    branch: "main",
+    appOrigin: "https://www.forgezero.net",
+    apiOrigin: "https://api.forgezero.net",
+    zoneName: "forgezero.net",
+    kvNamespaceTitle: "forgezero-nodes",
+    workerScriptName: "forgezero-api-edge-production",
+    region: { key: "in-south", label: "India South", country: "IN" },
+    agentOtlpEndpoint: "https://otel.forgezero.net",
+    privateCidrs: ["10.42.0.0/24"]
+  }
+};
+function forgeZeroLaunchProfile(environment) {
+  const profile = PROFILES[environment];
+  return {
+    ...profile,
+    nodeHostname: (index) => environment === "development" ? `dev-api-n${index + 1}.forgezero.net` : `api-n${index + 1}.forgezero.net`
+  };
+}
+var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function forgeZeroLaunchTemplate(profile, guests, bundle, owner) {
+  const fleet = validatePlatformGenesisGuests(guests);
+  if (!EMAIL.test(owner.custodianEmail) || !EMAIL.test(owner.email.from)) {
+    throw new Error("bootstrap custodian and From addresses must be valid email addresses");
+  }
+  if (owner.email.provider === "smtp" && (!owner.email.host || !Number.isInteger(owner.email.port) || owner.email.port < 1 || owner.email.port > 65535 || !owner.email.user)) {
+    throw new Error("SMTP host, port and user are required");
+  }
+  if (bundle.manifest.branch !== profile.branch)
+    throw new Error("bootstrap bundle branch does not match the launch profile");
+  const coordinators = fleet.map(({ address }) => `http://${address}:8529`);
+  const nodeHostnames = fleet.map((_, index) => profile.nodeHostname(index));
+  const first = fleet[0];
+  return validateBootstrapConfig({
+    kind: "platform",
+    environment: profile.environment,
+    profile: "platform-db-api",
+    computeReference: first.name,
+    nodeHostname: nodeHostnames[0],
+    apiUrl: profile.apiOrigin,
+    bootstrapBundle: {
+      bundleFile: bundle.bundlePath,
+      manifestFile: bundle.manifestPath,
+      branch: profile.branch
+    },
+    telemetryEndpoint: profile.agentOtlpEndpoint,
+    database: {
+      role: "master",
+      agency: "member",
+      readPreferred: false,
+      serverMode: "default",
+      address: first.address,
+      coordinators
+    },
+    enrolment: { source: "genesis-derived" },
+    runtime: {
+      environment: {
+        softwareProfile: "platform-db-api",
+        databaseRole: "master",
+        databaseCoordinators: coordinators,
+        databaseReadPreferredCoordinators: [],
+        databaseAddress: first.address,
+        databaseNetworkMode: "private-lan",
+        databaseReplicationFactor: 2,
+        databaseWriteConcern: 2,
+        databaseUser: "forgezero-api",
+        nodeHostname: nodeHostnames[0],
+        nodeRegion: profile.region.key,
+        nodeRole: "guest",
+        appOrigin: profile.appOrigin,
+        apiOrigin: profile.apiOrigin,
+        publicApiPort: 3000,
+        sharedDirectory: "/opt/forgezero/shared",
+        seedSyncPeers: fleet.slice(1).flatMap(({ address }) => [3001, 3002].map((port) => `ws://${address}:${port}/_internal/forgezero/seed-mesh/v2`)),
+        seedSyncMembers: nodeHostnames,
+        seedSyncEpoch: `${profile.environment}-${bundle.manifest.revision.slice(0, 16)}`,
+        concurrencyLimit: 128,
+        drainDeadlineMs: 30000,
+        otlpEndpoint: "http://127.0.0.1:4318",
+        otlpCollectorUnit: FORGEZERO_OTEL_COLLECTOR_UNIT,
+        agentOtlpEndpoint: profile.agentOtlpEndpoint,
+        otlpFlushIntervalMs: 1e4,
+        otlpTraceSampleRatio: 0.1,
+        custodianEmail: owner.custodianEmail,
+        email: owner.email,
+        deployProfile: profile.environment
+      },
+      serviceUser: "forgezero-api",
+      slotsDirectory: "/opt/forgezero/slots",
+      bluePort: 3001,
+      greenPort: 3002,
+      healthPath: "/api/health",
+      keepReleases: 5
+    },
+    firewall: { enabled: true, sshPort: 22, privateCidrs: [...profile.privateCidrs] },
+    installCloudflared: true,
+    installWarp: false,
+    cloudflareHandoff: { handoffFile: "/run/forgezero/cloudflare-handoff.json", nodeName: first.name }
+  });
+}
+
 // src/host-maintenance.ts
 import { lstatSync as lstatSync8, readFileSync as readFileSync13 } from "fs";
 var ROOT = "/opt/forgezero";
@@ -18052,6 +18257,8 @@ function parseOptions(argv2) {
       options.dataFile = argv2[++index];
     else if (token === "--bootstrap-config")
       options.bootstrapConfigPath = argv2[++index];
+    else if (token === "--secrets-env-file")
+      options.bootstrapSecretsEnvFile = argv2[++index];
     else if (token === "--output")
       options.outputPath = argv2[++index];
     else if (token === "--query")
@@ -18648,9 +18855,100 @@ async function bootstrapSecret(question) {
     throw new Error(`${question} was not provided`);
   return value;
 }
-async function promptPlatformBootstrapSecrets(config) {
+var PLATFORM_CLUSTER_CREDENTIAL = "forgezero-platform-cluster-bootstrap-code";
+function readPlatformLaunchEnvironment(path) {
+  const absolute2 = resolve12(path);
+  const stat2 = lstatSync10(absolute2);
+  if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
+    throw new Error(`bootstrap secret environment must be one owner-only regular file: ${absolute2}`);
+  }
+  const values = new Map;
+  for (const [index, raw] of readFileSync16(absolute2, "utf8").split(/\r?\n/).entries()) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match)
+      throw new Error(`invalid environment assignment at ${absolute2}:${index + 1}`);
+    if (values.has(match[1]))
+      throw new Error(`duplicate environment assignment ${match[1]} at ${absolute2}:${index + 1}`);
+    let value = match[2].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    values.set(match[1], value);
+  }
+  const requiredValue = (name) => {
+    const value = values.get(name)?.trim();
+    if (!value)
+      throw new Error(`bootstrap secret environment is missing ${name}`);
+    return value;
+  };
+  const provider = requiredValue("FZ_EMAIL_PROVIDER");
+  if (provider !== "smtp" && provider !== "jetemail")
+    throw new Error("FZ_EMAIL_PROVIDER must be smtp or jetemail");
+  const smtpPort = provider === "smtp" ? Number(requiredValue("FZ_SMTP_PORT")) : undefined;
+  if (smtpPort !== undefined && (!Number.isInteger(smtpPort) || smtpPort < 1 || smtpPort > 65535)) {
+    throw new Error("FZ_SMTP_PORT must be an integer from 1 through 65535");
+  }
+  const owner = provider === "jetemail" ? {
+    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
+    email: {
+      provider,
+      from: requiredValue("FZ_EMAIL_FROM"),
+      eu: (values.get("FZ_JETEMAIL_EU") ?? "false").trim().toLowerCase() === "true"
+    }
+  } : {
+    custodianEmail: requiredValue("FZ_BOOTSTRAP_CUSTODIAN_EMAIL"),
+    email: {
+      provider,
+      from: requiredValue("FZ_EMAIL_FROM"),
+      host: requiredValue("FZ_SMTP_HOST"),
+      port: smtpPort,
+      user: requiredValue("FZ_SMTP_USER")
+    }
+  };
+  return {
+    owner,
+    emailSecret: requiredValue(provider === "jetemail" ? "FZ_JETEMAIL_API_KEY" : "FZ_SMTP_PASSWORD"),
+    cloudflareTunnelToken: requiredValue("CF_TUNNEL_TOKEN"),
+    cloudflareApiToken: requiredValue("CF_API_TOKEN")
+  };
+}
+async function platformLaunchClusterBootstrapCode(outputDirectory) {
+  const path = join13(dirname14(outputDirectory), `${PLATFORM_CLUSTER_CREDENTIAL}.cred`);
+  if (existsSync12(path)) {
+    const stat2 = lstatSync10(path);
+    if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1 || typeof process.getuid === "function" && stat2.uid !== process.getuid() || (stat2.mode & 63) !== 0) {
+      throw new Error(`platform cluster credential must be one owner-only regular file: ${path}`);
+    }
+    const child2 = Bun.spawn(["systemd-creds", "decrypt", `--name=${PLATFORM_CLUSTER_CREDENTIAL}`, path, "-"], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+    const [stdout, stderr2, exitCode2] = await Promise.all([
+      new Response(child2.stdout).text(),
+      new Response(child2.stderr).text(),
+      child2.exited
+    ]);
+    if (exitCode2 !== 0)
+      throw new Error(`cannot open the retained platform cluster credential: ${stderr2.trim()}`);
+    const value2 = stdout.trim();
+    if (!/^[a-f0-9]{64}$/i.test(value2))
+      throw new Error("retained platform cluster credential is invalid");
+    return value2;
+  }
+  mkdirSync13(dirname14(path), { recursive: true, mode: 448 });
+  const value = randomBytes10(32).toString("hex");
+  const child = Bun.spawn(["systemd-creds", "encrypt", `--name=${PLATFORM_CLUSTER_CREDENTIAL}`, "-", path], { stdin: "pipe", stdout: "pipe", stderr: "pipe" });
+  await writeAndCloseProcessInput(child.stdin, `${value}
+`);
+  const [stderr, exitCode] = await Promise.all([new Response(child.stderr).text(), child.exited]);
+  if (exitCode !== 0)
+    throw new Error(`cannot retain the platform cluster credential: ${stderr.trim()}`);
+  chmodSync7(path, 384);
+  return value;
+}
+async function promptPlatformBootstrapSecrets(config, generatedClusterBootstrapCode) {
   return validatePlatformBootstrapSecrets(config, {
-    clusterBootstrapCode: await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
+    clusterBootstrapCode: generatedClusterBootstrapCode ?? await bootstrapSecret("Shared 64-hex cluster bootstrap code"),
     emailSecret: await bootstrapSecret(config.runtime.environment.email?.provider === "jetemail" ? "JetEmail API key" : "SMTP password"),
     ...config.enrolment.source === "api-token" ? { enrolmentToken: await bootstrapSecret("API-issued one-time platform enrolment token") } : {},
     ...config.runtime.environment.backup ? { backupS3Secret: await bootstrapSecret("Backup S3 secret key") } : {},
@@ -18843,51 +19141,53 @@ function writeMetalOperatorFiles(directory) {
   });
   return { metalConfig, remoteRequest };
 }
-function writePlatformGenesisFleet(directory) {
+function writePlatformGenesisFleet(directory, preset) {
   const output = genesisOutputDirectory(directory);
-  const metalRequestFile = bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
+  const metalRequestFile = preset?.metalRequestFile ?? bootstrapAnswer("Owner-only metal remote request containing the reviewed genesis guests");
   const metalRequest = readOperatorMetalBootstrapRequest(metalRequestFile, { validateMetalConfig: false });
-  const guestHostKeysFile = bootstrapAnswer("Owner-only guest host-key evidence file");
+  const guestHostKeysFile = preset?.guestHostKeysFile ?? bootstrapAnswer("Owner-only guest host-key evidence file");
   const guestHostKeys = readOperatorGuestHostKeyEvidence(guestHostKeysFile, metalRequest);
   const fleet = metalRequest.genesis.nodes;
   const metalHostname = readMetalBootstrapConfig(metalRequest.metalConfigFile, {
     allowHistoricalRelease: true
   }).metalHostname;
   const checkpointPath = join13(output, "cloudflare-handoff.json");
-  const template = interactiveBootstrap("platform", fleet, checkpointPath);
-  const region = {
+  const template = preset ? forgeZeroLaunchTemplate(preset.profile, fleet, preset.bundle, preset.owner) : interactiveBootstrap("platform", fleet, checkpointPath);
+  const region = preset ? preset.profile.region : {
     label: bootstrapAnswer(`Region ${template.runtime.environment.nodeRegion} display label`),
     country: bootstrapAnswer("Region ISO 3166-1 alpha-2 country code").toUpperCase(),
     city: bootstrapAnswer("Region city")
   };
-  const nodes = fleet.map((guest, index) => index === 0 ? {
-    nodeHostname: template.nodeHostname,
+  const nodes = fleet.map((guest, index) => ({
+    nodeHostname: preset ? preset.profile.nodeHostname(index) : index === 0 ? template.nodeHostname : bootstrapAnswer(`${guest.name} public node hostname`),
     cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
-  } : {
-    nodeHostname: bootstrapAnswer(`${guest.name} public node hostname`),
-    cloudflareHandoffFile: cloudflareHostHandoffPath(checkpointPath, guest.name)
-  });
-  const realtimeEnabled = bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
+  }));
+  const realtimeEnabled = preset ? true : bootstrapBoolean("Configure existing Worker realtime fan-out?", "yes");
   const cloudflareConfig = writeBootstrapConfig(join13(output, "cloudflare.json"), createCloudflareBootstrapDiscoveryCommandConfig({
     checkpointPath,
     discovery: {
-      zoneName: bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
-      kvNamespaceTitle: bootstrapAnswer("Existing Worker-bound KV namespace title"),
+      zoneName: preset?.profile.zoneName ?? bootstrapAnswer("Cloudflare DNS zone name", "forgezero.net"),
+      kvNamespaceTitle: preset?.profile.kvNamespaceTitle ?? bootstrapAnswer("Existing Worker-bound KV namespace title"),
       ...realtimeEnabled ? {
-        workerScriptName: bootstrapAnswer("Existing Worker script name"),
-        endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
-        producer: bootstrapAnswer("Realtime producer identity", "platform-api")
+        workerScriptName: preset?.profile.workerScriptName ?? bootstrapAnswer("Existing Worker script name"),
+        endpoint: preset?.profile.apiOrigin ?? bootstrapAnswer("Stable public Worker HTTPS endpoint"),
+        producer: "platform-api"
       } : {}
     },
     nodes: fleet.map((guest, index) => ({
       nodeName: guest.name,
       hostname: nodes[index].nodeHostname,
       service: "http://127.0.0.1:3000",
-      tunnelName: bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
+      tunnelName: preset ? guest.name : bootstrapAnswer(`${guest.name} Tunnel name`, guest.name)
     }))
   }));
   const cloudflareAcceptance = join13(output, "cloudflare-acceptance.json");
-  const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region).map((config) => {
+  const configs = platformGenesisBootstrapConfigs(template, fleet, nodes, metalHostname, region, preset ? {
+    source: "bootstrap-bundle",
+    branch: preset.profile.branch,
+    revision: preset.bundle.manifest.revision,
+    bundleSha256: preset.bundle.manifest.sha256
+  } : undefined).map((config) => {
     const path = `${output}/${config.computeReference}-platform.json`;
     writeBootstrapConfig(path, config);
     return path;
@@ -18919,6 +19219,66 @@ function writePlatformGenesisFleet(directory) {
   const fleetRequest = writeOperatorPlatformBootstrapFleetRequest(join13(output, "platform-fleet-remote.json"), requests, { configFile: cloudflareConfig, acceptanceFile: cloudflareAcceptance });
   return { configs, requests, fleetRequest, cloudflareConfig, cloudflareAcceptance };
 }
+function selectedForgeZeroLaunchEnvironment(value) {
+  if (value === "app")
+    return "development";
+  if (value !== "development" && value !== "production") {
+    throw new Error("platform launch --profile must be development or production");
+  }
+  return value;
+}
+function forgeZeroLaunchOwnerInput() {
+  const custodianEmail = bootstrapAnswer("First custodian email");
+  const provider = bootstrapAnswer("Bootstrap email provider (smtp/jetemail)", "jetemail");
+  if (provider !== "smtp" && provider !== "jetemail") {
+    throw new Error("Bootstrap email provider must be smtp or jetemail");
+  }
+  const from = bootstrapAnswer("Bootstrap email From address");
+  if (provider === "jetemail") {
+    return {
+      custodianEmail,
+      email: { provider, from, eu: bootstrapBoolean("Use JetEmail EU processing?", "no") }
+    };
+  }
+  return {
+    custodianEmail,
+    email: {
+      provider,
+      from,
+      host: bootstrapAnswer("SMTP host"),
+      port: bootstrapNumber("SMTP port", "587"),
+      user: bootstrapAnswer("SMTP user")
+    }
+  };
+}
+async function prepareForgeZeroPlatformLaunch(environment, outputDirectory, projectRoot, owner) {
+  const profile = forgeZeroLaunchProfile(environment);
+  const base = dirname14(outputDirectory);
+  const metalRequestFile = join13(base, "metal", "metal-remote.json");
+  const guestHostKeysFile = join13(base, "genesis-guest-host-keys.json");
+  for (const [path, label] of [
+    [metalRequestFile, "reviewed Metal request"],
+    [guestHostKeysFile, "pinned genesis guest host-key evidence"]
+  ]) {
+    if (!existsSync12(path))
+      throw new Error(`${label} is missing at ${path}`);
+  }
+  const root = resolve12(projectRoot);
+  const nestedApi = join13(root, "api");
+  const repositoryRoot = existsSync12(join13(nestedApi, "package.json")) ? nestedApi : root;
+  const bundlePath = join13(base, "api.bundle");
+  const bundle = existsSync12(bundlePath) || existsSync12(`${bundlePath}.json`) ? await readBootstrapBundle(bundlePath) : await buildBootstrapBundle({ repositoryRoot, outputPath: bundlePath, branch: profile.branch });
+  if (bundle.manifest.branch !== profile.branch) {
+    throw new Error(`existing bootstrap bundle is for ${bundle.manifest.branch}, expected ${profile.branch}`);
+  }
+  return writePlatformGenesisFleet(outputDirectory, {
+    profile,
+    metalRequestFile,
+    guestHostKeysFile,
+    bundle,
+    owner: owner ?? forgeZeroLaunchOwnerInput()
+  });
+}
 function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint) {
   if (!process.stdin.isTTY)
     throw new Error("non-interactive bootstrap requires --bootstrap-config <private-json-file>");
@@ -19038,7 +19398,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
     } : {}
   };
 }
-async function runAttendedPlatformFleet(fleet, apply) {
+async function runAttendedPlatformFleet(fleet, apply, generatedClusterBootstrapCode, environmentInput) {
   const plan = planOperatorPlatformFleetBootstrap(fleet, "apply");
   const cloudflarePlan = readCloudflareBootstrapCommandPlan(fleet.cloudflareConfigFile);
   const coordinates = operatorPlatformFleetCoordinates(fleet);
@@ -19069,7 +19429,12 @@ async function runAttendedPlatformFleet(fleet, apply) {
   const firstConfig = readBootstrapConfig(first.platformConfigFile);
   if (firstConfig.kind !== "platform")
     throw new Error("remote platform fleet requires platform configs");
-  const secrets = await promptPlatformBootstrapSecrets(firstConfig);
+  const secrets = environmentInput ? validatePlatformBootstrapSecrets(firstConfig, {
+    clusterBootstrapCode: generatedClusterBootstrapCode,
+    emailSecret: environmentInput.emailSecret,
+    cloudflareTunnelToken: environmentInput.cloudflareTunnelToken,
+    cloudflareApiToken: environmentInput.cloudflareApiToken
+  }) : await promptPlatformBootstrapSecrets(firstConfig, generatedClusterBootstrapCode);
   const cloudflare = await resolveCloudflareBootstrapCommandConfig(fleet.cloudflareConfigFile, {
     tunnelToken: secrets.cloudflareTunnelToken,
     apiToken: secrets.cloudflareApiToken
@@ -19104,15 +19469,21 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (operation === "platform" && args[1] === "launch") {
-      if (args[2] !== undefined || !options.outputPath || options.bootstrapConfigPath) {
-        throw new Error("Usage: fz bootstrap platform launch --output <absolute-owner-only-directory> [--apply]");
+      if (args[2] !== undefined || options.bootstrapConfigPath) {
+        throw new Error("Usage: fz bootstrap platform launch [--profile development|production] [--output <absolute-owner-only-directory>] [--secrets-env-file <owner-only-env>] [--apply]");
+      }
+      const environment = selectedForgeZeroLaunchEnvironment(options.deployProfile);
+      if (environment === "production" && options.bootstrapSecretsEnvFile) {
+        throw new Error("production platform launch requires interactive hidden secret prompts");
       }
-      const generated = writePlatformGenesisFleet(options.outputPath);
+      const outputDirectory = options.outputPath ?? `/secure/forgezero/${environment}/genesis`;
+      const environmentInput = options.bootstrapSecretsEnvFile ? readPlatformLaunchEnvironment(options.bootstrapSecretsEnvFile) : undefined;
+      const generated = await prepareForgeZeroPlatformLaunch(environment, outputDirectory, options.projectRoot, environmentInput?.owner);
       const fleet = readOperatorPlatformBootstrapFleetRequest(generated.fleetRequest);
-      if (options.apply && bootstrapAnswer("Type APPLY to run the reviewed Cloudflare and three-compute plan") !== "APPLY") {
+      if (options.apply && !environmentInput && bootstrapAnswer("Type APPLY to run the reviewed Cloudflare and three-compute plan") !== "APPLY") {
         throw new Error("attended platform bootstrap was not confirmed");
       }
-      return await runAttendedPlatformFleet(fleet, options.apply);
+      return await runAttendedPlatformFleet(fleet, options.apply, options.apply ? await platformLaunchClusterBootstrapCode(outputDirectory) : undefined, environmentInput);
     }
     if (operation === "platform" && args[1] === "fleet") {
       const mode = args[2];
@@ -19922,8 +20293,9 @@ function usage() {
 	 fz bootstrap platform bundle
 	                         Build one clean exact-revision API Git bundle for genesis
 	 fz bootstrap platform launch
-	                         Prompt, review and run the complete attended platform
-	                         bootstrap; --output is the owner-only working directory
+	                         One profile-driven attended launch. Public topology,
+	                         bundle and edge names are derived; the owner supplies
+	                         only email settings, hidden provider tokens and APPLY
 	 fz bootstrap platform remote <apply|status>
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host; apply copies and verifies that bundle
@@ -20025,7 +20397,7 @@ function usage() {
     --root <path>           Project root for project/deploy commands
     --name <name>           Project or deploy name during init
     --purpose <text>        Product outcome during project init
-    --profile <name>        Initial deploy profile (default app)
+    --profile <name>        Platform launch environment or initial deploy profile
     --software <key@ver>    Initial tested software coordinate; repeatable
     --channel <name>        Catalog view: production or development (shows testing)
     --attestation           Require hardware attestation for every deploy step