@forgezero/agent 0.1.40 → 0.1.42

package/dist/cli/agent-install.d.ts

@@ -1,4 +1,4 @@
-import { type Capabilities, type ProvisionPlan } from '../provision';
+import { type Capabilities, type CapabilityOperation, type ProvisionOperation, type ProvisionPlan } from '../provision';
 /**
  * `fz agent install` — run the provision plan on THIS machine.
  *
@@ -26,12 +26,11 @@ export declare function parseTcpPorts(value: string | undefined): readonly numbe
  * SSH come from the same test, so a box that reports `attested` to an operator
  * cannot report `enrolled` to the platform.
  */
-export declare function readCapabilities(run: (command: string) => Promise<{
+export declare function readCapabilities(run: (operation: CapabilityOperation) => Promise<{
     stdout: string;
     exitCode: number;
 }>): Promise<Capabilities>;
-/** Run a command locally. The SSH executor is the platform's half. */
-export declare function localRunner(command: string): Promise<{
+export declare function localRunner(operation: CapabilityOperation | ProvisionOperation): Promise<{
     stdout: string;
     exitCode: number;
 }>;
@@ -58,6 +57,8 @@ export interface InstallOptions {
     pullMigrations?: boolean;
     pullBootstrap?: boolean;
     bootstrapSshCredentialPath?: string;
+    bootstrapSshSourcePath?: string;
+    bootstrapSshPublicKeyPath?: string;
     bootstrapTargetTelemetryEndpoint?: string;
     lifecycleProfilePath?: string;
     lifecycleHelperSocketPath?: string;
@@ -83,7 +84,7 @@ export interface InstallOptions {
 }
 export declare function planInstall(options: InstallOptions): ProvisionPlan;
 /** Execute the same ordered plan the control plane executes over SSH. */
-export declare function applyPlan(plan: ProvisionPlan, run: (command: string) => Promise<{
+export declare function applyPlan(plan: ProvisionPlan, run: (operation: CapabilityOperation | ProvisionOperation) => Promise<{
     stdout: string;
     exitCode: number;
 }>): Promise<readonly {

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,8 +1,14 @@
-import { verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
 }
+export interface CloudflareBootstrapFinalizeConfig {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-finalize';
+    checkpointPath: string;
+    acceptancePath: string;
+}
 /**
  * Read reviewed non-secret coordinates and token-file paths for the attended
  * operator phase. Raw token values and a persisted mode are not schema fields.
@@ -13,3 +19,8 @@ export declare function runCloudflareBootstrapVerificationCommand(checkpointPath
     verify?: typeof verifyCloudflareBootstrapAcceptance;
     write?: (text: string) => void;
 }): Promise<CloudflareBootstrapAcceptanceEvidence>;
+export declare function readCloudflareBootstrapFinalizeConfig(path: string): CloudflareBootstrapFinalizeRequest;
+export declare function runCloudflareBootstrapFinalizeCommand(configPath: string, dependencies?: {
+    finalize?: typeof finalizeCloudflareBootstrapAcceptance;
+    write?: (text: string) => void;
+}): Promise<CloudflareBootstrapAcceptanceEvidence>;

package/dist/cli/maintenance.d.ts

@@ -0,0 +1,23 @@
+export type RepositoryOperation = 'dev-reset' | 'db-backup' | 'db-recover' | 'db-inspect-recovery-target' | 'db-verify-recovery-cluster' | 'db-consolidate' | 'rehearse-recovery' | 'rehearse-transactions' | 'community-cluster-api' | 'platform-fleet' | 'platform-recovery';
+/**
+ * Global fz options must not disappear before a maintenance parser sees them.
+ * Only --root selects the reviewed checkout; --apply/--json are deliberately
+ * reinserted for the operation. Every other recognized global option is an
+ * error instead of a silently ignored mutation bypass such as --force.
+ */
+export declare function unsupportedRepositoryCliOption(argv: readonly string[]): string | undefined;
+export interface ResolvedRepositoryOperation {
+    operation: RepositoryOperation;
+    root: string;
+    cwd: string;
+    entrypoint: string;
+}
+/**
+ * Resolve only reviewed repository-owned operations.
+ *
+ * This is deliberately a closed table, not `fz exec <path>`. The published
+ * Agent can launch maintenance from a checkout, but a typo or untrusted value
+ * cannot turn that facility into arbitrary script execution.
+ */
+export declare function resolveRepositoryOperation(operation: RepositoryOperation, requestedRoot: string): ResolvedRepositoryOperation;
+export declare function runRepositoryOperation(operation: RepositoryOperation, requestedRoot: string, args?: readonly string[]): Promise<number>;

package/dist/cli/run.d.ts

@@ -89,4 +89,6 @@ export declare function exitCodeFor(status: {
  * forwarded signals, propagated status — and none of it is provable against a
  * mock.
  */
-export declare function spawnWith(command: readonly string[], env: Record<string, string>, report?: (line: string) => void): Promise<number>;
+export declare function spawnWith(command: readonly string[], env: Record<string, string>, report?: (line: string) => void, options?: {
+    cwd?: string;
+}): Promise<number>;

package/dist/cli/session-store.d.ts

@@ -3,7 +3,12 @@ export interface CliSession {
     api: string;
     /** Browser application origin that approved this session and fresh actions. */
     app?: string;
+    /** Internal URL selector. `platform` or the tenant slug; never presented as identity. */
     realm: string;
+    /** Stable database/crypto identity returned by the API. */
+    realmId?: string;
+    /** Human-readable routing coordinate, when this is a tenant session. */
+    tenantSlug?: string;
     cookie: string;
     createdAtTs: number;
     lastUsedAtTs: number;

package/dist/cloudflare-bootstrap.d.ts

@@ -1,46 +1,64 @@
-import { type CloudflareApiTokens } from './cloudflare-edge';
+export interface CloudflareMeshCoordinates {
+    /** Unique account-scoped Mesh/WARP Connector name. */
+    connectorName: string;
+    /** Exact private CIDRs reachable behind this metal/compute. */
+    routes: string[];
+    /** Mesh replicas sharing one connector may be active/passive. */
+    highAvailability?: boolean;
+}
 export interface CloudflareBootstrapNodeCoordinates {
     nodeName: string;
     hostname: string;
     service: string;
     tunnelName: string;
+    /** Optional bidirectional private networking, independent of public ingress. */
+    mesh?: CloudflareMeshCoordinates;
+}
+export interface CloudflareRealtimeCoordinates {
+    /** Existing Worker script deployed independently through Cloudflare Git integration. */
+    workerScriptName: string;
+    /** Stable public HTTPS Worker origin used by API publishers and WebSocket clients. */
+    endpoint: string;
+    /** Signed producer identity emitted by this platform API fleet. */
+    producer: string;
 }
 export interface CloudflareBootstrapCoordinates {
     accountId: string;
     zoneId: string;
-    /** Legacy single-node coordinates; normalized into `nodes[0]`. */
-    hostname: string;
-    service: string;
-    tunnelName: string;
     /** Existing namespace bound to the separately deployed Worker. */
     kvNamespaceId: string;
-    nodes?: CloudflareBootstrapNodeCoordinates[];
+    /** Existing dedicated Mesh device profile whose include list ForgeZero owns. */
+    meshDevicePolicyId?: string;
+    /** Optional existing Worker/DO realtime boundary. No Worker source is deployed here. */
+    realtime?: CloudflareRealtimeCoordinates;
+    nodes: CloudflareBootstrapNodeCoordinates[];
 }
 export interface CloudflareBootstrapTokenFiles {
-    /** One owner-supplied token with Tunnel Write, DNS Write and KV Write. */
-    apiTokenFile?: string;
-    /** Recommended bootstrap token: Tunnel Write + DNS Write. */
-    managementApiTokenFile?: string;
-    /** Recommended normal-runtime token: Workers KV Storage Write. */
-    runtimeApiTokenFile?: string;
-    /** Optional split management/runtime tokens. */
-    tunnelApiTokenFile?: string;
-    dnsApiTokenFile?: string;
-    kvApiTokenFile?: string;
+    /** CF_TUNNEL_TOKEN: Tunnel, DNS, Mesh connector/network and device-profile writes. */
+    tunnelTokenFile: string;
+    /** Exact-account Workers KV Storage Write plus existing-Worker Scripts Write. */
+    apiTokenFile: string;
+}
+export interface CloudflareBootstrapTokens {
+    tunnelToken: string;
+    apiToken: string;
 }
 interface CloudflareBootstrapNodeResource extends CloudflareBootstrapNodeCoordinates {
     tunnelId: string;
     connectorToken: string;
+    mesh?: CloudflareMeshCoordinates & {
+        connectorId: string;
+        connectorToken: string;
+    };
 }
 interface CloudflareBootstrapResources {
-    /** First-node compatibility fields. */
-    tunnelId: string;
     kvNamespaceId: string;
-    hostname: string;
-    service: string;
-    connectorToken: string;
-    /** Owner-supplied Workers KV Storage Write token, sealed into each host handoff. */
-    kvRuntimeToken: string;
+    /** Owner-supplied CF_API_TOKEN, sealed into each host handoff. */
+    apiToken: string;
+    realtime?: {
+        publishSecret: string;
+        ticketSecret: string;
+    };
     nodes: CloudflareBootstrapNodeResource[];
 }
 export interface CloudflareBootstrapOutput {
@@ -51,10 +69,10 @@ export interface CloudflareBootstrapOutput {
     coordinates: CloudflareBootstrapCoordinates;
     resources: CloudflareBootstrapResources;
     created?: {
-        tunnel: boolean;
         nodes: Array<{
             nodeName: string;
             tunnel: boolean;
+            mesh: boolean;
         }>;
     };
 }
@@ -98,13 +116,21 @@ export interface CloudflareBootstrapAcceptanceEvidence {
         status: number;
     }>;
 }
+export interface CloudflareBootstrapAcceptedNode {
+    nodeName: string;
+    hostname: string;
+}
+export interface CloudflareBootstrapFinalizeRequest {
+    checkpointPath: string;
+    acceptancePath: string;
+}
 export interface CloudflareBootstrapDependencies {
     fetcher?: typeof fetch;
 }
 export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
 /** Read exactly one API token from a non-symlinked, owner-only regular file. */
 export declare function readOwnerApiToken(path: string): Promise<string>;
-export declare function readCloudflareBootstrapTokens(files: CloudflareBootstrapTokenFiles): Promise<CloudflareApiTokens>;
+export declare function readCloudflareBootstrapTokens(files: CloudflareBootstrapTokenFiles): Promise<CloudflareBootstrapTokens>;
 export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
 export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
 export interface CloudflareConnectorHandoff {
@@ -113,20 +139,21 @@ export interface CloudflareConnectorHandoff {
     service: string;
     tunnelId: string;
     connectorToken: string;
+    mesh?: {
+        connectorId: string;
+        connectorToken: string;
+        routes: readonly string[];
+    };
 }
 export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
     accountId: string;
     zoneId: string;
     kvNamespaceId: string;
-    kvRuntimeToken: string;
-    /** Backward-compatible private-network coordinates; not produced by this public-hostname bootstrap. */
-    privateNetworkRuntimeToken?: string;
-    warp?: {
-        organization: string;
-        clientId: string;
-        clientSecret: string;
-        virtualNetworkId: string;
-        deviceProfileId: string;
+    /** CF_API_TOKEN: Workers KV Storage Write plus existing-Worker Scripts Write. */
+    apiToken: string;
+    realtime?: CloudflareRealtimeCoordinates & {
+        publishSecret: string;
+        ticketSecret: string;
     };
 }
 export declare function cloudflareHostHandoffPath(checkpointPath: string, nodeName: string): string;
@@ -134,7 +161,18 @@ export declare function readCloudflareConnectorHandoff(checkpointPath: string, n
 export declare function readCloudflareHostHandoff(handoffPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
 export declare function writeOwnerBootstrapOutput(path: string, output: CloudflareBootstrapOutput): Promise<void>;
 /** Attended, resumable Tunnel/DNS/KV handoff bootstrap. */
-export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareApiTokens, outputPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapOutput>;
+export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareBootstrapTokens, outputPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapOutput>;
 export declare function runAttendedCloudflareBootstrap(request: AttendedCloudflareBootstrapRequest, dependencies?: CloudflareBootstrapDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function verifyCloudflareBootstrapAcceptance(checkpointPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
+/**
+ * Read finalized, secret-free Cloudflare acceptance after the capability-bearing
+ * checkpoint has been removed. This is the durable input consumed by the fleet
+ * rehearsal; it never attempts to reopen the deleted handoff.
+ */
+export declare function readCloudflareBootstrapAcceptanceEvidence(acceptancePath: string, expectedNodes?: readonly CloudflareBootstrapAcceptedNode[]): Promise<CloudflareBootstrapAcceptanceEvidence>;
+/**
+ * Prove every public node, persist secret-free acceptance evidence, then remove
+ * the resumable checkpoint and node handoffs that contain runtime capabilities.
+ */
+export declare function finalizeCloudflareBootstrapAcceptance(request: CloudflareBootstrapFinalizeRequest, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
 export {};