@forgezero/agent 0.1.56 → 0.1.57

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.56";
+var VERSION3 = "0.1.57";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.56";
+var VERSION = "0.1.57";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,4 +1,11 @@
-import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokenFiles } from '../cloudflare-bootstrap';
+export interface CloudflareBootstrapCommandConfig {
+    format: 1;
+    kind: 'forgezero-cloudflare-bootstrap-request';
+    checkpointPath: string;
+    coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
+    tokenFiles: CloudflareBootstrapTokenFiles;
+}
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
@@ -9,6 +16,15 @@ export interface CloudflareBootstrapFinalizeConfig {
     checkpointPath: string;
     acceptancePath: string;
 }
+/**
+ * Construct the exact reviewed JSON shape used by both the interactive CLI and
+ * the strict file reader. Token values are deliberately not accepted here.
+ */
+export declare function createCloudflareBootstrapCommandConfig(input: {
+    checkpointPath: string;
+    coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
+    tokenFiles: CloudflareBootstrapTokenFiles;
+}): CloudflareBootstrapCommandConfig;
 /**
  * Read reviewed non-secret coordinates and token-file paths for the attended
  * operator phase. Raw token values and a persisted mode are not schema fields.

package/dist/fz-agent.js

@@ -8448,7 +8448,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.56";
+var VERSION2 = "0.1.57";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {

package/dist/fz.js

@@ -4830,7 +4830,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.56";
+var VERSION2 = "0.1.57";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -14347,6 +14347,26 @@ var record2 = (value, label) => {
     throw new Error(`${label} must be an object`);
   return value;
 };
+function createCloudflareBootstrapCommandConfig(input) {
+  if (typeof input.checkpointPath !== "string" || !input.checkpointPath.trim()) {
+    throw new Error("Cloudflare bootstrap checkpointPath is required");
+  }
+  for (const key of ["tunnelTokenFile", "apiTokenFile"]) {
+    if (typeof input.tokenFiles?.[key] !== "string" || !input.tokenFiles[key].trim()) {
+      throw new Error(`Cloudflare bootstrap tokenFiles.${key} is required and must be a non-empty file path`);
+    }
+  }
+  return {
+    format: 1,
+    kind: "forgezero-cloudflare-bootstrap-request",
+    checkpointPath: input.checkpointPath.trim(),
+    coordinates: validateCloudflareBootstrapCoordinates(input.coordinates),
+    tokenFiles: {
+      tunnelTokenFile: input.tokenFiles.tunnelTokenFile.trim(),
+      apiTokenFile: input.tokenFiles.apiTokenFile.trim()
+    }
+  };
+}
 function readOwnerConfig(path) {
   const absolute2 = resolve6(path);
   let descriptor;
@@ -17118,6 +17138,55 @@ function writeBootstrapConfig(path, config) {
 `, { mode: 384, flag: "wx" });
   return path;
 }
+function interactiveCloudflareBootstrap() {
+  if (!process.stdin.isTTY)
+    throw new Error("interactive Cloudflare config generation requires a terminal");
+  const nodeCount = bootstrapNumber("Number of public API nodes", "3");
+  if (nodeCount < 1 || nodeCount > 32)
+    throw new Error("Number of public API nodes must be between 1 and 32");
+  const realtimeEnabled = bootstrapAnswer("Configure existing Worker realtime fan-out? (yes/no)", "yes") === "yes";
+  const meshEnabled = bootstrapAnswer("Configure private Mesh/WARP routes? (yes/no)", "no") === "yes";
+  const meshDevicePolicyId = meshEnabled ? bootstrapAnswer("Existing Mesh device policy id") : undefined;
+  const nodes = Array.from({ length: nodeCount }, (_, index) => {
+    const ordinal = index + 1;
+    const nodeName = bootstrapAnswer(`Node ${ordinal} inventory name`);
+    const nodeMesh = meshEnabled && bootstrapAnswer(`Configure Mesh routes for ${nodeName}? (yes/no)`, "yes") === "yes";
+    return {
+      nodeName,
+      hostname: bootstrapAnswer(`${nodeName} public hostname`),
+      service: bootstrapAnswer(`${nodeName} loopback API service`, "http://127.0.0.1:3000"),
+      tunnelName: bootstrapAnswer(`${nodeName} Tunnel name`, nodeName),
+      ...nodeMesh ? {
+        mesh: {
+          connectorName: bootstrapAnswer(`${nodeName} Mesh connector name`, `${nodeName}-mesh`),
+          routes: bootstrapList(`${nodeName} private CIDR routes`),
+          highAvailability: bootstrapAnswer(`${nodeName} shares a highly available Mesh connector? (yes/no)`, "no") === "yes"
+        }
+      } : {}
+    };
+  });
+  return createCloudflareBootstrapCommandConfig({
+    checkpointPath: bootstrapAnswer("Owner-only resumable checkpoint path", "./cloudflare-handoff.json"),
+    coordinates: {
+      accountId: bootstrapAnswer("Cloudflare account id"),
+      zoneId: bootstrapAnswer("Cloudflare zone id"),
+      kvNamespaceId: bootstrapAnswer("Existing Worker-bound KV namespace id"),
+      ...meshDevicePolicyId ? { meshDevicePolicyId } : {},
+      ...realtimeEnabled ? {
+        realtime: {
+          workerScriptName: bootstrapAnswer("Existing Worker script name"),
+          endpoint: bootstrapAnswer("Stable public Worker HTTPS endpoint"),
+          producer: bootstrapAnswer("Realtime producer identity", "platform-api")
+        }
+      } : {},
+      nodes
+    },
+    tokenFiles: {
+      tunnelTokenFile: bootstrapAnswer("Owner-only CF_TUNNEL_TOKEN file", "./CF_TUNNEL_TOKEN"),
+      apiTokenFile: bootstrapAnswer("Owner-only CF_API_TOKEN file", "./CF_API_TOKEN")
+    }
+  });
+}
 function genesisOutputDirectory(path) {
   if (!isAbsolute5(path) || resolve9(path) !== path)
     throw new Error("--output must be a canonical absolute directory");
@@ -17290,13 +17359,19 @@ async function cmdBootstrap(options, args) {
     const operation = args[0] ?? "status";
     if (operation === "config") {
       const kind = args[1];
-      if (kind !== "metal" && kind !== "platform" || args[2] !== undefined || !options.outputPath) {
-        throw new Error("Usage: fz bootstrap config metal --output <absolute-file> | fz bootstrap config platform --output <absolute-owner-only-directory>");
+      if (kind !== "metal" && kind !== "platform" && kind !== "cloudflare" || args[2] !== undefined || !options.outputPath) {
+        throw new Error("Usage: fz bootstrap config metal|cloudflare --output <absolute-file> | fz bootstrap config platform --output <absolute-owner-only-directory>");
       }
       if (kind === "platform") {
         out.line(JSON.stringify({ kind, ...writePlatformGenesisFleet(options.outputPath), mode: "0600" }, null, 2));
         return 0;
       }
+      if (kind === "cloudflare") {
+        const path = writeBootstrapConfig(options.outputPath, interactiveCloudflareBootstrap());
+        readCloudflareBootstrapCommandConfig(path, "plan");
+        out.line(JSON.stringify({ kind, path, mode: "0600" }, null, 2));
+        return 0;
+      }
       const config2 = interactiveMetalBootstrap();
       out.line(JSON.stringify({ kind, path: writeBootstrapConfig(options.outputPath, config2), mode: "0600" }, null, 2));
       return 0;
@@ -17432,7 +17507,7 @@ async function cmdBootstrap(options, args) {
       return 0;
     }
     if (!["platform", "repair"].includes(operation)) {
-      throw new Error("Usage: fz bootstrap config <metal|platform>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|status>]|status|repair [--bootstrap-config <path>] [--apply]");
+      throw new Error("Usage: fz bootstrap config <metal|platform|cloudflare>|platform [prepare|remote <prepare|apply|status>|cloudflare [verify|finalize]]|metal [remote <apply|genesis|rehearsal|status>]|status|repair [--bootstrap-config <path>] [--apply]");
     }
     const config = options.bootstrapConfigPath ? readBootstrapConfig(options.bootstrapConfigPath) : operation === "repair" ? (() => {
       throw new Error("repair requires --bootstrap-config so immutable coordinates are revalidated");
@@ -17997,9 +18072,9 @@ function usage() {
 	                         Run typed bootstrap from the operator laptop through
 	                         a pinned host and caller-approved SSH agent
 	 fz bootstrap platform   Install/repair a typed elastic platform compute
-	 fz bootstrap config <metal|platform>
-	                         Write a validated owner-only metal file or strict
-	                         three-node platform genesis directory; never apply locally
+	 fz bootstrap config <metal|platform|cloudflare>
+	                         Write a validated owner-only metal/Cloudflare file or
+	                         strict three-node platform genesis directory; never apply locally
 	 fz bootstrap platform cloudflare
 	                         Plan/apply attended Tunnel and DNS reconciliation
 	                         using supplied management and KV/Worker runtime token files

package/dist/metal-bootstrap.js

@@ -292,7 +292,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.56";
+var VERSION = "0.1.57";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/operator-bootstrap.js

@@ -1207,7 +1207,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.56";
+var VERSION = "0.1.57";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-fleet-verification.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.56";
+var VERSION3 = "0.1.57";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/provision.js

@@ -2086,7 +2086,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.56";
+var VERSION3 = "0.1.57";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.56";
+export declare const VERSION = "0.1.57";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.56",
+  "version": "0.1.57",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",