@forgezero/agent 0.1.34 → 0.1.35

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -0,0 +1,11 @@
+import { type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
+export interface CloudflareBootstrapCommandDependencies {
+    run?: CloudflareBootstrapPhaseRunner;
+    write?: (text: string) => void;
+}
+/**
+ * Read reviewed non-secret coordinates and token-file paths for the attended
+ * operator phase. Raw token values and a persisted mode are not schema fields.
+ */
+export declare function readCloudflareBootstrapCommandConfig(path: string, mode: 'plan' | 'apply'): AttendedCloudflareBootstrapRequest;
+export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;

package/dist/cloudflare-bootstrap.d.ts

@@ -0,0 +1,218 @@
+import { type CloudflareAccessCredentials, type CloudflareAccountRuntimeToken, type CloudflareApiTokens } from './cloudflare-edge';
+export interface CloudflareBootstrapNodeCoordinates {
+    nodeName: string;
+    hostname: string;
+    service: string;
+    tunnelName: string;
+    applicationName: string;
+    /** Present only on DB nodes that publish an exact private host route. */
+    privateAddress?: string;
+}
+export interface CloudflarePrivateNetworkCoordinates {
+    warpOrganization: string;
+    virtualNetworkName: string;
+    deviceProfileName: string;
+    enrollmentApplicationName: string;
+    deviceProfilePrecedence?: number;
+}
+export interface CloudflareBootstrapCoordinates {
+    accountId: string;
+    zoneId: string;
+    /** Legacy single-node coordinates; normalized into `nodes[0]`. */
+    hostname: string;
+    service: string;
+    tunnelName: string;
+    kvNamespaceTitle: string;
+    workerScriptName: string;
+    serviceTokenName: string;
+    policyName: string;
+    applicationName: string;
+    workerDirectory: string;
+    workerMain: string;
+    workerCompatibilityDate: string;
+    publicDomains: string[];
+    createRuntimeTokens: boolean;
+    createPrivateNetworkRuntimeToken: boolean;
+    runtimeTokenNamePrefix: string;
+    nodes?: CloudflareBootstrapNodeCoordinates[];
+    privateNetwork?: CloudflarePrivateNetworkCoordinates;
+}
+export interface CloudflareBootstrapTokenFiles {
+    apiTokenFile?: string;
+    tunnelApiTokenFile?: string;
+    dnsApiTokenFile?: string;
+    kvApiTokenFile?: string;
+    accessApiTokenFile?: string;
+    workerApiTokenFile?: string;
+}
+interface CloudflareBootstrapResources {
+    tunnelId: string;
+    kvNamespaceId: string;
+    hostname: string;
+    service: string;
+    connectorToken: string;
+    access?: CloudflareAccessCredentials & {
+        policyId?: string;
+        applicationId?: string;
+    };
+    nodes: Array<{
+        nodeName: string;
+        hostname: string;
+        service: string;
+        tunnelName: string;
+        tunnelId: string;
+        connectorToken: string;
+        applicationId?: string;
+    }>;
+    worker?: {
+        scriptName: string;
+        publicDomains: string[];
+        deployed: true;
+    };
+    runtimeTokens?: {
+        kv: CloudflareAccountRuntimeToken;
+        privateNetwork?: CloudflareAccountRuntimeToken;
+    };
+    privateNetwork?: {
+        warpOrganization: string;
+        virtualNetworkId: string;
+        deviceProfileId: string;
+        enrollmentApplicationId: string;
+        routes: Array<{
+            nodeName: string;
+            routeId: string;
+            privateAddress: string;
+        }>;
+    };
+}
+export interface CloudflareBootstrapOutput {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap';
+    phase: 'edge-resources-provisioned' | 'runtime-tokens-created' | 'worker-deployed' | 'access-token-provisioned' | 'complete';
+    updatedAt: string;
+    coordinates: CloudflareBootstrapCoordinates;
+    resources: CloudflareBootstrapResources;
+    created?: {
+        tunnel: boolean;
+        kvNamespace: boolean;
+        serviceToken: boolean;
+        policy: boolean;
+        application: boolean;
+        privateNetwork: boolean;
+        workerDeployed: true;
+        nodes: Array<{
+            nodeName: string;
+            tunnel: boolean;
+            application: boolean;
+        }>;
+    };
+}
+export interface CloudflareBootstrapPlan {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-plan';
+    mode: 'attended-token-file';
+    outputFile: string;
+    coordinates: CloudflareBootstrapCoordinates;
+    operations: readonly string[];
+    secrets: readonly string[];
+}
+/**
+ * The published `fz bootstrap platform` boundary. It deliberately accepts
+ * token *paths*, never token values, so a caller cannot accidentally put the
+ * Cloudflare management credential into a platform manifest, runtime config,
+ * child argv, or evidence journal.
+ */
+export interface AttendedCloudflareBootstrapRequest {
+    mode: 'plan' | 'apply';
+    coordinates: CloudflareBootstrapCoordinates;
+    tokenFiles?: CloudflareBootstrapTokenFiles;
+    checkpointPath: string;
+}
+/** Secret-free evidence safe to embed in the platform bootstrap journal. */
+export interface CloudflareBootstrapEvidence {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-evidence';
+    phase: 'planned' | 'complete';
+    checkpointFile: string;
+    kvNamespaceId?: string;
+    workerScriptName: string;
+    publicDomains: readonly string[];
+    runtimeTokenIds?: {
+        kv?: string;
+        privateNetwork?: string;
+    };
+    nodes: ReadonlyArray<{
+        nodeName: string;
+        hostname: string;
+        tunnelId?: string;
+        applicationId?: string;
+    }>;
+}
+export interface CloudflareBootstrapDependencies {
+    fetcher?: typeof fetch;
+    workerRunner?: CloudflareWorkerCommandRunner;
+}
+export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
+/** Read exactly one API token from a non-symlinked, owner-only regular file. */
+export declare function readOwnerApiToken(path: string): Promise<string>;
+export declare function readCloudflareBootstrapTokens(files: CloudflareBootstrapTokenFiles): Promise<CloudflareApiTokens>;
+export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
+export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
+export interface CloudflareWorkerCommand {
+    command: readonly string[];
+    cwd: string;
+    env: Readonly<Record<string, string>>;
+}
+export type CloudflareWorkerCommandRunner = (request: CloudflareWorkerCommand) => Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** Deploy one Worker from an ephemeral config containing the runtime-created KV id. */
+export declare function deployCloudflareWorker(coordinates: CloudflareBootstrapCoordinates, kvNamespaceId: string, apiToken: string, runner?: CloudflareWorkerCommandRunner): Promise<void>;
+export interface CloudflareConnectorHandoff {
+    nodeName: string;
+    hostname: string;
+    service: string;
+    tunnelId: string;
+    connectorToken: string;
+}
+export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
+    accountId: string;
+    zoneId: string;
+    kvNamespaceId: string;
+    kvRuntimeToken: string;
+    privateNetworkRuntimeToken?: string;
+    warp?: {
+        organization: string;
+        clientId: string;
+        clientSecret: string;
+        virtualNetworkId: string;
+        deviceProfileId: string;
+    };
+}
+/**
+ * Select one node's connector credential directly from the completed fleet
+ * checkpoint. Host bootstrap can pipe this value into `systemd-creds` without
+ * creating another plaintext token file or accepting the whole JSON as a
+ * connector token.
+ */
+export declare function readCloudflareConnectorHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareConnectorHandoff>;
+/** Complete secret-bearing handoff consumed once by root host bootstrap. */
+export declare function readCloudflareHostHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
+/** Atomically persist sensitive bootstrap material without making it runtime configuration. */
+export declare function writeOwnerBootstrapOutput(path: string, output: CloudflareBootstrapOutput): Promise<void>;
+/**
+ * Attended, resumable Cloudflare bootstrap. The output is checkpointed after
+ * every one-time secret is obtained, so a later API failure cannot orphan it.
+ */
+export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareApiTokens, outputPath: string, fetcher?: typeof fetch, workerRunner?: CloudflareWorkerCommandRunner): Promise<CloudflareBootstrapOutput>;
+/**
+ * Run the attended Cloudflare phase for `fz bootstrap platform`.
+ *
+ * Plans are offline. Applies read management tokens only inside this function,
+ * persist one-time handoff values only in the owner-only checkpoint, and return
+ * a deliberately secret-free evidence record to the outer bootstrap journal.
+ */
+export declare function runAttendedCloudflareBootstrap(request: AttendedCloudflareBootstrapRequest, dependencies?: CloudflareBootstrapDependencies): Promise<CloudflareBootstrapEvidence>;
+export {};