@forgezero/agent 0.1.39 → 0.1.40

package/dist/cloudflare-edge.d.ts

@@ -86,162 +86,14 @@ export declare function removeCloudflareWarpDatabaseInclude(config: Omit<Cloudfl
 /** Reconcile one remotely-managed tunnel route and its proxied DNS record. */
 export declare function configureCloudflareEdge(config: CloudflareEdgeConfig, fetcher?: typeof fetch): Promise<void>;
 export interface CloudflareApiTokens {
-    /** One scoped token may perform every operation. */
+    /** Backward-compatible single-token input; two scoped tokens are preferred. */
     apiToken?: string;
-    /** Or split tokens may constrain each operation independently. */
+    /** Attended management token mapped to Tunnel and DNS operations. */
     tunnelApiToken?: string;
     dnsApiToken?: string;
+    /** Runtime token used only for KV node-directory writes. */
     kvApiToken?: string;
-    accessApiToken?: string;
-    workerApiToken?: string;
 }
-export interface CloudflareKvNamespace {
-    id: string;
-    title: string;
-}
-export interface CloudflareAccessServiceToken {
-    id: string;
-    name: string;
-    client_id: string;
-    client_secret?: string;
-    duration?: string;
-}
-export interface CloudflareAccessCredentials {
-    tokenId: string;
-    clientId: string;
-    clientSecret: string;
-}
-export interface CloudflareAccountRuntimeToken {
-    id: string;
-    value: string;
-    name: string;
-    permissionNames: string[];
-}
-/**
- * Create one account-owned API token from exact, dynamically resolved account
- * permission groups. The value is returned once for immediate 0600 checkpoint.
- */
-export declare function createCloudflareAccountRuntimeToken(config: {
-    accountId: string;
-    name: string;
-    permissionNames: readonly string[];
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<CloudflareAccountRuntimeToken>;
-/**
- * Create the Worker's Access service token, or prove the caller supplied the
- * sealed secret for the existing token. Cloudflare intentionally returns the
- * client secret only once, so silently "reusing" an existing row without its
- * secret would configure a Worker that can never authenticate.
- */
-export declare function ensureCloudflareAccessServiceToken(config: {
-    accountId: string;
-    name: string;
-    duration?: string;
-    apiToken: string;
-    existing?: CloudflareAccessCredentials;
-}, fetcher?: typeof fetch): Promise<{
-    credentials: CloudflareAccessCredentials;
-    created: boolean;
-}>;
-interface CloudflareAccessPolicy {
-    id: string;
-    name: string;
-    decision?: string;
-    include?: unknown[];
-}
-/** Create or update one reusable Service Auth policy for the Worker token. */
-export declare function ensureCloudflareAccessPolicy(config: {
-    accountId: string;
-    name: string;
-    serviceTokenId: string;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<{
-    policy: CloudflareAccessPolicy;
-    created: boolean;
-}>;
-interface CloudflareAccessApplication {
-    id: string;
-    name: string;
-    type?: string;
-    domain?: string;
-    self_hosted_domains?: string[];
-}
-/** Protect one node hostname so only the public Worker can reach it. */
-export declare function ensureCloudflareAccessApplication(config: {
-    accountId: string;
-    name: string;
-    hostname: string;
-    policyId: string;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<{
-    application: CloudflareAccessApplication;
-    created: boolean;
-}>;
-/** Attach the same non-interactive service-auth policy to WARP enrollment. */
-export declare function ensureCloudflareWarpEnrollmentApplication(config: {
-    accountId: string;
-    name: string;
-    policyId: string;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<{
-    application: CloudflareAccessApplication;
-    created: boolean;
-}>;
-export interface CloudflareVirtualNetwork {
-    id: string;
-    name: string;
-    comment?: string;
-    is_default_network?: boolean;
-    deleted_at?: string | null;
-}
-/** Create or reuse one named VNET; never silently adopt an ambiguous/deleted row. */
-export declare function ensureCloudflareVirtualNetwork(config: {
-    accountId: string;
-    name: string;
-    comment: string;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<{
-    virtualNetwork: CloudflareVirtualNetwork;
-    created: boolean;
-}>;
-interface CloudflareDevicePolicy {
-    id: string;
-    name: string;
-    match?: string;
-    precedence?: number;
-}
-/**
- * Create a locked WARP device profile selected only by this service token.
- * Split-tunnel includes are reconciled separately so existing owned entries
- * remain visible and reviewable.
- */
-export declare function ensureCloudflareWarpDevicePolicy(config: {
-    accountId: string;
-    name: string;
-    serviceTokenId: string;
-    virtualNetworkId: string;
-    precedence?: number;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<{
-    policy: CloudflareDevicePolicy;
-    created: boolean;
-}>;
-/** Atomically replace both Worker-side Access credentials. */
-export declare function configureCloudflareWorkerAccessSecrets(config: {
-    accountId: string;
-    scriptName: string;
-    credentials: CloudflareAccessCredentials;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<void>;
-/** Create or reuse exactly one named Worker KV namespace. */
-export declare function ensureCloudflareKvNamespace(config: {
-    accountId: string;
-    title: string;
-    apiToken: string;
-}, fetcher?: typeof fetch): Promise<{
-    namespace: CloudflareKvNamespace;
-    created: boolean;
-}>;
 export interface CloudflareTunnel {
     id: string;
     name: string;

package/dist/cloudflare-edge.js

@@ -130,23 +130,32 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
   const tunnelAuth = { apiToken: config.tunnelApiToken?.trim() || config.apiToken };
   const dnsAuth = { apiToken: config.dnsApiToken?.trim() || config.apiToken };
   const tunnelPath = `/accounts/${config.accountId}/cfd_tunnel/${config.tunnelId}/configurations`;
-  const current = await cf(tunnelAuth, tunnelPath, {}, fetcher);
-  const existing = current.config?.ingress ?? [];
-  const catchAll = existing.filter((rule) => !("hostname" in rule));
-  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
-  await cf(tunnelAuth, tunnelPath, {
-    method: "PUT",
-    body: JSON.stringify({ config: { ingress: [
-      { hostname: config.hostname, service: config.service },
-      ...otherHosts,
-      ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
-    ] } })
-  }, fetcher);
   const dnsPath = `/zones/${config.zoneId}/dns_records`;
-  const records = await cf(dnsAuth, `${dnsPath}?type=CNAME&name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher);
+  const [current, records] = await Promise.all([
+    cf(tunnelAuth, tunnelPath, {}, fetcher),
+    cf(dnsAuth, `${dnsPath}?name=${encodeURIComponent(config.hostname)}&per_page=1000`, {}, fetcher)
+  ]);
   if (records.length > 1) {
     throw new Error(`Cloudflare DNS record for ${config.hostname} is ambiguous`);
   }
+  const existingRecord = records[0];
+  if (existingRecord && (existingRecord.type !== "CNAME" || existingRecord.name && existingRecord.name.toLowerCase() !== config.hostname.toLowerCase())) {
+    throw new Error(`Cloudflare DNS hostname ${config.hostname} is already owned by an incompatible ${existingRecord.type ?? "unknown"} record`);
+  }
+  const existing = current.config?.ingress ?? [];
+  const catchAll = existing.filter((rule) => !("hostname" in rule));
+  const otherHosts = existing.filter((rule) => ("hostname" in rule) && rule.hostname !== config.hostname);
+  const desiredIngress = [
+    { hostname: config.hostname, service: config.service },
+    ...otherHosts,
+    ...catchAll.length > 0 ? catchAll : [{ service: "http_status:404" }]
+  ];
+  if (JSON.stringify(existing) !== JSON.stringify(desiredIngress)) {
+    await cf(tunnelAuth, tunnelPath, {
+      method: "PUT",
+      body: JSON.stringify({ config: { ingress: desiredIngress } })
+    }, fetcher);
+  }
   const record = {
     type: "CNAME",
     name: config.hostname,
@@ -154,233 +163,13 @@ async function configureCloudflareEdge(config, fetcher = fetch) {
     proxied: true,
     ttl: 1
   };
-  await cf(dnsAuth, records[0] ? `${dnsPath}/${records[0].id}` : dnsPath, {
-    method: records[0] ? "PUT" : "POST",
-    body: JSON.stringify(record)
-  }, fetcher);
-}
-var exactAccountPermissionGroup = async (config, name, fetcher) => {
-  const groups = await cf(config, `/accounts/${config.accountId}/tokens/permission_groups?name=${encodeURIComponent(name)}` + "&scope=com.cloudflare.api.account", {}, fetcher);
-  const matches = groups.filter((group) => group.name === name && group.scopes?.includes("com.cloudflare.api.account") && Boolean(group.id && /^[a-f0-9]{32}$/i.test(group.id)));
-  if (matches.length !== 1) {
-    throw new Error(`Cloudflare account token permission group ${name} is ${matches.length === 0 ? "missing" : "ambiguous"}`);
-  }
-  return { id: matches[0].id, name };
-};
-async function createCloudflareAccountRuntimeToken(config, fetcher = fetch) {
-  if (!/^[a-f0-9]{32}$/i.test(config.accountId))
-    throw new Error("Cloudflare account id is invalid");
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,119}$/.test(name)) {
-    throw new Error("Cloudflare account runtime-token name is invalid");
-  }
-  const permissionNames = [...new Set(config.permissionNames)];
-  if (permissionNames.length === 0)
-    throw new Error("Cloudflare account runtime token needs a permission group");
-  const permissionGroups = await Promise.all(permissionNames.map((permissionName) => exactAccountPermissionGroup(config, permissionName, fetcher)));
-  const body = {
-    name,
-    policies: [{
-      effect: "allow",
-      permission_groups: permissionGroups.map(({ id }) => ({ id })),
-      resources: { [`com.cloudflare.api.account.${config.accountId}`]: "*" }
-    }]
-  };
-  const created = await cf(config, `/accounts/${config.accountId}/tokens`, { method: "POST", body: JSON.stringify(body) }, fetcher);
-  if (!created.id || !/^[a-f0-9]{32}$/i.test(created.id) || !created.value || !/^[A-Za-z0-9._-]{40,80}$/.test(created.value)) {
-    throw new Error("Cloudflare did not return the one-time account runtime-token id and value");
-  }
-  return { id: created.id, value: created.value, name, permissionNames };
-}
-async function ensureCloudflareAccessServiceToken(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare Access service-token name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/service_tokens`;
-  const tokens = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = tokens.filter((token) => token.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access service token ${name} is ambiguous`);
-  if (matches[0]) {
-    if (!config.existing || config.existing.tokenId !== matches[0].id || config.existing.clientId !== matches[0].client_id || !config.existing.clientSecret) {
-      throw new Error(`Cloudflare Access service token ${name} exists but its one-time client secret was not supplied`);
-    }
-    return { credentials: config.existing, created: false };
-  }
-  const created = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, duration: config.duration ?? "8760h" })
-  }, fetcher);
-  if (!created.id || !created.client_id || !created.client_secret) {
-    throw new Error("Cloudflare did not return the new Access service-token secret");
+  const dnsAlreadyCorrect = existingRecord?.type === record.type && existingRecord.name?.toLowerCase() === record.name.toLowerCase() && existingRecord.content?.toLowerCase() === record.content.toLowerCase() && existingRecord.proxied === true && existingRecord.ttl === 1;
+  if (!dnsAlreadyCorrect) {
+    await cf(dnsAuth, existingRecord ? `${dnsPath}/${encodeURIComponent(existingRecord.id)}` : dnsPath, {
+      method: existingRecord ? "PUT" : "POST",
+      body: JSON.stringify(record)
+    }, fetcher);
   }
-  return {
-    credentials: {
-      tokenId: created.id,
-      clientId: created.client_id,
-      clientSecret: created.client_secret
-    },
-    created: true
-  };
-}
-async function ensureCloudflareAccessPolicy(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/policies`;
-  const policies = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === config.name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access policy ${config.name} is ambiguous`);
-  const desired = {
-    name: config.name,
-    decision: "non_identity",
-    include: [{ service_token: { token_id: config.serviceTokenId } }]
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, {
-    method: matches[0] ? "PUT" : "POST",
-    body: JSON.stringify(desired)
-  }, fetcher);
-  return { policy, created: !matches[0] };
-}
-async function ensureCloudflareAccessApplication(config, fetcher = fetch) {
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.domain === config.hostname || application2.self_hosted_domains?.includes(config.hostname));
-  if (matches.length > 1)
-    throw new Error(`Cloudflare Access application for ${config.hostname} is ambiguous`);
-  const desired = {
-    name: config.name,
-    type: "self_hosted",
-    domain: config.hostname,
-    session_duration: "24h",
-    service_auth_401_redirect: true,
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareWarpEnrollmentApplication(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name)) {
-    throw new Error("Cloudflare WARP enrollment application name is invalid");
-  }
-  const path = `/accounts/${config.accountId}/access/apps`;
-  const applications = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = applications.filter((application2) => application2.type === "warp" || application2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP enrollment application ${name} is ambiguous`);
-  if (matches[0] && (matches[0].type !== "warp" || matches[0].name !== name)) {
-    throw new Error(`Cloudflare Access application ${name} is not the owned WARP enrollment application`);
-  }
-  const desired = {
-    name,
-    type: "warp",
-    policies: [{ id: config.policyId, precedence: 1 }]
-  };
-  const application = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PUT" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!application.id || application.type && application.type !== "warp") {
-    throw new Error("Cloudflare did not return the WARP enrollment application");
-  }
-  return { application, created: !matches[0] };
-}
-async function ensureCloudflareVirtualNetwork(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare VNET name is invalid");
-  const path = `/accounts/${config.accountId}/teamnet/virtual_networks`;
-  const networks = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = networks.filter((network) => !network.deleted_at && network.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare VNET ${name} is ambiguous`);
-  if (matches[0])
-    return { virtualNetwork: matches[0], created: false };
-  const virtualNetwork = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ name, comment: config.comment.slice(0, 256), is_default_network: false })
-  }, fetcher);
-  if (!virtualNetwork.id || !/^[0-9a-f-]{36}$/i.test(virtualNetwork.id)) {
-    throw new Error("Cloudflare did not return the VNET id");
-  }
-  return { virtualNetwork, created: true };
-}
-async function ensureCloudflareWarpDevicePolicy(config, fetcher = fetch) {
-  const name = config.name.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,99}$/.test(name))
-    throw new Error("Cloudflare WARP device profile name is invalid");
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(config.serviceTokenId))
-    throw new Error("Cloudflare service-token id is invalid");
-  if (!/^[0-9a-f-]{36}$/i.test(config.virtualNetworkId))
-    throw new Error("Cloudflare VNET id is invalid");
-  const precedence = config.precedence ?? 100;
-  if (!Number.isInteger(precedence) || precedence < 1 || precedence > 999999) {
-    throw new Error("Cloudflare WARP device profile precedence is invalid");
-  }
-  const match = `identity.service_token_uuid == "${config.serviceTokenId}"`;
-  const listPath = `/accounts/${config.accountId}/devices/policies`;
-  const path = `/accounts/${config.accountId}/devices/policy`;
-  const policies = await cf(config, `${listPath}?per_page=1000`, {}, fetcher);
-  const matches = policies.filter((policy2) => policy2.name === name);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare WARP device profile ${name} is ambiguous`);
-  if (matches[0]?.match && matches[0].match !== match) {
-    throw new Error(`Cloudflare WARP device profile ${name} belongs to another enrollment identity`);
-  }
-  const desired = {
-    name,
-    match,
-    precedence,
-    description: "ForgeZero non-interactive compute enrollment",
-    enabled: true,
-    allow_mode_switch: false,
-    allowed_to_leave: false,
-    auto_connect: 0,
-    switch_locked: true,
-    service_mode_v2: { mode: "warp" },
-    virtual_networks: { allowed: [config.virtualNetworkId], default: config.virtualNetworkId }
-  };
-  const policy = await cf(config, matches[0] ? `${path}/${encodeURIComponent(matches[0].id)}` : path, { method: matches[0] ? "PATCH" : "POST", body: JSON.stringify(desired) }, fetcher);
-  if (!policy.id)
-    throw new Error("Cloudflare did not return the WARP device profile id");
-  return { policy, created: !matches[0] };
-}
-async function configureCloudflareWorkerAccessSecrets(config, fetcher = fetch) {
-  if (!/^[a-z][a-z0-9-]{0,62}$/.test(config.scriptName)) {
-    throw new Error("Cloudflare Worker script name is invalid");
-  }
-  await cf(config, `/accounts/${config.accountId}/workers/scripts/${config.scriptName}/secrets-bulk`, {
-    method: "PATCH",
-    body: JSON.stringify({
-      secrets: {
-        CF_ACCESS_CLIENT_ID: {
-          name: "CF_ACCESS_CLIENT_ID",
-          type: "secret_text",
-          text: config.credentials.clientId
-        },
-        CF_ACCESS_CLIENT_SECRET: {
-          name: "CF_ACCESS_CLIENT_SECRET",
-          type: "secret_text",
-          text: config.credentials.clientSecret
-        }
-      }
-    })
-  }, fetcher);
-}
-async function ensureCloudflareKvNamespace(config, fetcher = fetch) {
-  const title = config.title.trim();
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(title)) {
-    throw new Error("Cloudflare KV namespace title is invalid");
-  }
-  const path = `/accounts/${config.accountId}/storage/kv/namespaces`;
-  const namespaces = await cf(config, `${path}?per_page=1000`, {}, fetcher);
-  const matches = namespaces.filter((namespace2) => namespace2.title === title);
-  if (matches.length > 1)
-    throw new Error(`Cloudflare KV namespace ${title} is ambiguous`);
-  if (matches[0])
-    return { namespace: matches[0], created: false };
-  const namespace = await cf(config, path, {
-    method: "POST",
-    body: JSON.stringify({ title })
-  }, fetcher);
-  return { namespace, created: true };
 }
 async function ensureCloudflareTunnel(config, fetcher = fetch) {
   const name = config.name.trim();
@@ -407,18 +196,9 @@ export {
   removeCloudflareWarpDatabaseInclude,
   removeCloudflarePrivateRoute,
   removeCloudflarePrivateDatabaseRoute,
-  ensureCloudflareWarpEnrollmentApplication,
-  ensureCloudflareWarpDevicePolicy,
   ensureCloudflareWarpDatabaseInclude,
-  ensureCloudflareVirtualNetwork,
   ensureCloudflareTunnel,
   ensureCloudflarePrivateRoute,
   ensureCloudflarePrivateDatabaseRoute,
-  ensureCloudflareKvNamespace,
-  ensureCloudflareAccessServiceToken,
-  ensureCloudflareAccessPolicy,
-  ensureCloudflareAccessApplication,
-  createCloudflareAccountRuntimeToken,
-  configureCloudflareWorkerAccessSecrets,
   configureCloudflareEdge
 };

package/dist/credential-schema.d.ts

@@ -0,0 +1,60 @@
+/**
+ * One credential policy for every place the Agent can run.
+ *
+ * Operator credentials are attended input files and are never installed as a
+ * runtime source. Physical-metal credentials are fixed host identities loaded
+ * only by systemd. Enrolled platform and tenant computes read their assigned
+ * project/environment Vault replica first and may use only an explicitly
+ * installed, same-name systemd credential while that replica cannot answer.
+ */
+export declare const AGENT_CREDENTIAL_LOCATIONS: readonly ["operator", "metal", "platform-compute", "tenant-compute"];
+export type AgentCredentialLocation = (typeof AGENT_CREDENTIAL_LOCATIONS)[number];
+export declare const AGENT_CREDENTIAL_POLICY: {
+    readonly operator: {
+        readonly vault: false;
+        readonly systemdFallback: false;
+        readonly attendedFile: true;
+    };
+    readonly metal: {
+        readonly vault: false;
+        readonly systemdFallback: true;
+        readonly attendedFile: false;
+    };
+    readonly 'platform-compute': {
+        readonly vault: true;
+        readonly systemdFallback: true;
+        readonly attendedFile: false;
+    };
+    readonly 'tenant-compute': {
+        readonly vault: true;
+        readonly systemdFallback: true;
+        readonly attendedFile: false;
+    };
+};
+export interface DeploymentCredentialBinding {
+    /** Exact environment variable requested by a checked-in pipeline step. */
+    name: string;
+    /** Exact RAM-replica cache key; never a secret value. */
+    vaultCacheKey: string;
+    /** Same name exposed by systemd, or absent when no fallback was installed. */
+    systemdCredential?: string;
+}
+export interface DeploymentCredentialSchema {
+    version: 1;
+    location: 'platform-compute' | 'tenant-compute';
+    projectKey: string;
+    environmentKey: string;
+    credentials: readonly DeploymentCredentialBinding[];
+}
+/** Build the runtime-only schema from the server-owned enrolment binding. */
+export declare function deploymentCredentialSchema(input: {
+    realm: 'platform' | 'tenant';
+    projectKey: string;
+    environmentKey: string;
+    systemdCredentials?: Iterable<string>;
+}): DeploymentCredentialSchema;
+export declare function credentialBinding(schema: DeploymentCredentialSchema, name: string): DeploymentCredentialBinding;
+/** Fixed host credentials are schema entries too, but can never enter a deploy step. */
+export declare const METAL_SYSTEMD_CREDENTIALS: {
+    readonly identity: "metal-agent-seed";
+};