@forgezero/agent 0.1.38 → 0.1.40

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,4 +1,4 @@
-import { type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
+import { verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
@@ -9,3 +9,7 @@ export interface CloudflareBootstrapCommandDependencies {
  */
 export declare function readCloudflareBootstrapCommandConfig(path: string, mode: 'plan' | 'apply'): AttendedCloudflareBootstrapRequest;
 export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
+export declare function runCloudflareBootstrapVerificationCommand(checkpointPath: string, dependencies?: {
+    verify?: typeof verifyCloudflareBootstrapAcceptance;
+    write?: (text: string) => void;
+}): Promise<CloudflareBootstrapAcceptanceEvidence>;

package/dist/cli/index.d.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env bun
-import { type AgentIdentity } from '@forgezero/runtime/ssh-agent';
 /**
  * What every CLI request carries.
  *
@@ -9,7 +8,6 @@ import { type AgentIdentity } from '@forgezero/runtime/ssh-agent';
  * notice. A header nobody can see is a header nobody maintains.
  */
 export declare function requestHeaders(apiBase: string, cookie: string | null): Record<string, string>;
-export declare function useCustodyIdentity(identity: AgentIdentity, socketPath?: string): void;
 export declare function safeApiPath(value: string): string;
 export declare function targetCoordinate(value: string): {
     computeReference: string;

package/dist/cloudflare-bootstrap.d.ts

@@ -1,19 +1,9 @@
-import { type CloudflareAccessCredentials, type CloudflareAccountRuntimeToken, type CloudflareApiTokens } from './cloudflare-edge';
+import { type CloudflareApiTokens } from './cloudflare-edge';
 export interface CloudflareBootstrapNodeCoordinates {
     nodeName: string;
     hostname: string;
     service: string;
     tunnelName: string;
-    applicationName: string;
-    /** Present only on DB nodes that publish an exact private host route. */
-    privateAddress?: string;
-}
-export interface CloudflarePrivateNetworkCoordinates {
-    warpOrganization: string;
-    virtualNetworkName: string;
-    deviceProfileName: string;
-    enrollmentApplicationName: string;
-    deviceProfilePrecedence?: number;
 }
 export interface CloudflareBootstrapCoordinates {
     accountId: string;
@@ -22,88 +12,49 @@ export interface CloudflareBootstrapCoordinates {
     hostname: string;
     service: string;
     tunnelName: string;
-    kvNamespaceTitle: string;
-    workerScriptName: string;
-    serviceTokenName: string;
-    policyName: string;
-    applicationName: string;
-    workerDirectory: string;
-    workerMain: string;
-    workerCompatibilityDate: string;
-    publicDomains: string[];
-    createRuntimeTokens: boolean;
-    createPrivateNetworkRuntimeToken: boolean;
-    runtimeTokenNamePrefix: string;
+    /** Existing namespace bound to the separately deployed Worker. */
+    kvNamespaceId: string;
     nodes?: CloudflareBootstrapNodeCoordinates[];
-    privateNetwork?: CloudflarePrivateNetworkCoordinates;
 }
 export interface CloudflareBootstrapTokenFiles {
+    /** One owner-supplied token with Tunnel Write, DNS Write and KV Write. */
     apiTokenFile?: string;
+    /** Recommended bootstrap token: Tunnel Write + DNS Write. */
+    managementApiTokenFile?: string;
+    /** Recommended normal-runtime token: Workers KV Storage Write. */
+    runtimeApiTokenFile?: string;
+    /** Optional split management/runtime tokens. */
     tunnelApiTokenFile?: string;
     dnsApiTokenFile?: string;
     kvApiTokenFile?: string;
-    accessApiTokenFile?: string;
-    workerApiTokenFile?: string;
+}
+interface CloudflareBootstrapNodeResource extends CloudflareBootstrapNodeCoordinates {
+    tunnelId: string;
+    connectorToken: string;
 }
 interface CloudflareBootstrapResources {
+    /** First-node compatibility fields. */
     tunnelId: string;
     kvNamespaceId: string;
     hostname: string;
     service: string;
     connectorToken: string;
-    access?: CloudflareAccessCredentials & {
-        policyId?: string;
-        applicationId?: string;
-    };
-    nodes: Array<{
-        nodeName: string;
-        hostname: string;
-        service: string;
-        tunnelName: string;
-        tunnelId: string;
-        connectorToken: string;
-        applicationId?: string;
-    }>;
-    worker?: {
-        scriptName: string;
-        publicDomains: string[];
-        deployed: true;
-    };
-    runtimeTokens?: {
-        kv: CloudflareAccountRuntimeToken;
-        privateNetwork?: CloudflareAccountRuntimeToken;
-    };
-    privateNetwork?: {
-        warpOrganization: string;
-        virtualNetworkId: string;
-        deviceProfileId: string;
-        enrollmentApplicationId: string;
-        routes: Array<{
-            nodeName: string;
-            routeId: string;
-            privateAddress: string;
-        }>;
-    };
+    /** Owner-supplied Workers KV Storage Write token, sealed into each host handoff. */
+    kvRuntimeToken: string;
+    nodes: CloudflareBootstrapNodeResource[];
 }
 export interface CloudflareBootstrapOutput {
     format: 1;
     kind: 'forgezero-cloudflare-bootstrap';
-    phase: 'edge-resources-provisioned' | 'runtime-tokens-created' | 'worker-deployed' | 'access-token-provisioned' | 'complete';
+    phase: 'edge-resources-provisioned' | 'complete';
     updatedAt: string;
     coordinates: CloudflareBootstrapCoordinates;
     resources: CloudflareBootstrapResources;
     created?: {
         tunnel: boolean;
-        kvNamespace: boolean;
-        serviceToken: boolean;
-        policy: boolean;
-        application: boolean;
-        privateNetwork: boolean;
-        workerDeployed: true;
         nodes: Array<{
             nodeName: string;
             tunnel: boolean;
-            application: boolean;
         }>;
     };
 }
@@ -116,12 +67,6 @@ export interface CloudflareBootstrapPlan {
     operations: readonly string[];
     secrets: readonly string[];
 }
-/**
- * The published `fz bootstrap platform` boundary. It deliberately accepts
- * token *paths*, never token values, so a caller cannot accidentally put the
- * Cloudflare management credential into a platform manifest, runtime config,
- * child argv, or evidence journal.
- */
 export interface AttendedCloudflareBootstrapRequest {
     mode: 'plan' | 'apply';
     coordinates: CloudflareBootstrapCoordinates;
@@ -135,22 +80,26 @@ export interface CloudflareBootstrapEvidence {
     phase: 'planned' | 'complete';
     checkpointFile: string;
     kvNamespaceId?: string;
-    workerScriptName: string;
-    publicDomains: readonly string[];
-    runtimeTokenIds?: {
-        kv?: string;
-        privateNetwork?: string;
-    };
     nodes: ReadonlyArray<{
         nodeName: string;
         hostname: string;
+        handoffFile?: string;
         tunnelId?: string;
-        applicationId?: string;
+    }>;
+}
+export interface CloudflareBootstrapAcceptanceEvidence {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-acceptance';
+    checkpointFile: string;
+    verifiedAt: string;
+    nodes: ReadonlyArray<{
+        nodeName: string;
+        hostname: string;
+        status: number;
     }>;
 }
 export interface CloudflareBootstrapDependencies {
     fetcher?: typeof fetch;
-    workerRunner?: CloudflareWorkerCommandRunner;
 }
 export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
 /** Read exactly one API token from a non-symlinked, owner-only regular file. */
@@ -158,18 +107,6 @@ export declare function readOwnerApiToken(path: string): Promise<string>;
 export declare function readCloudflareBootstrapTokens(files: CloudflareBootstrapTokenFiles): Promise<CloudflareApiTokens>;
 export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
 export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
-export interface CloudflareWorkerCommand {
-    command: readonly string[];
-    cwd: string;
-    env: Readonly<Record<string, string>>;
-}
-export type CloudflareWorkerCommandRunner = (request: CloudflareWorkerCommand) => Promise<{
-    exitCode: number;
-    stdout: string;
-    stderr: string;
-}>;
-/** Deploy one Worker from an ephemeral config containing the runtime-created KV id. */
-export declare function deployCloudflareWorker(coordinates: CloudflareBootstrapCoordinates, kvNamespaceId: string, apiToken: string, runner?: CloudflareWorkerCommandRunner): Promise<void>;
 export interface CloudflareConnectorHandoff {
     nodeName: string;
     hostname: string;
@@ -182,6 +119,7 @@ export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
     zoneId: string;
     kvNamespaceId: string;
     kvRuntimeToken: string;
+    /** Backward-compatible private-network coordinates; not produced by this public-hostname bootstrap. */
     privateNetworkRuntimeToken?: string;
     warp?: {
         organization: string;
@@ -191,28 +129,12 @@ export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
         deviceProfileId: string;
     };
 }
-/**
- * Select one node's connector credential directly from the completed fleet
- * checkpoint. Host bootstrap can pipe this value into `systemd-creds` without
- * creating another plaintext token file or accepting the whole JSON as a
- * connector token.
- */
+export declare function cloudflareHostHandoffPath(checkpointPath: string, nodeName: string): string;
 export declare function readCloudflareConnectorHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareConnectorHandoff>;
-/** Complete secret-bearing handoff consumed once by root host bootstrap. */
-export declare function readCloudflareHostHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
-/** Atomically persist sensitive bootstrap material without making it runtime configuration. */
+export declare function readCloudflareHostHandoff(handoffPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
 export declare function writeOwnerBootstrapOutput(path: string, output: CloudflareBootstrapOutput): Promise<void>;
-/**
- * Attended, resumable Cloudflare bootstrap. The output is checkpointed after
- * every one-time secret is obtained, so a later API failure cannot orphan it.
- */
-export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareApiTokens, outputPath: string, fetcher?: typeof fetch, workerRunner?: CloudflareWorkerCommandRunner): Promise<CloudflareBootstrapOutput>;
-/**
- * Run the attended Cloudflare phase for `fz bootstrap platform`.
- *
- * Plans are offline. Applies read management tokens only inside this function,
- * persist one-time handoff values only in the owner-only checkpoint, and return
- * a deliberately secret-free evidence record to the outer bootstrap journal.
- */
+/** Attended, resumable Tunnel/DNS/KV handoff bootstrap. */
+export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareApiTokens, outputPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapOutput>;
 export declare function runAttendedCloudflareBootstrap(request: AttendedCloudflareBootstrapRequest, dependencies?: CloudflareBootstrapDependencies): Promise<CloudflareBootstrapEvidence>;
+export declare function verifyCloudflareBootstrapAcceptance(checkpointPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
 export {};