@forgezero/agent 0.1.57 → 0.1.59

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,15 +1,24 @@
-import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokenFiles } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokens } from '../cloudflare-bootstrap';
+import { discoverCloudflareBootstrapResources, type CloudflareBootstrapDiscovery } from '../cloudflare-edge';
 export interface CloudflareBootstrapCommandConfig {
     format: 1;
     kind: 'forgezero-cloudflare-bootstrap-request';
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
-    tokenFiles: CloudflareBootstrapTokenFiles;
 }
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
     write?: (text: string) => void;
 }
+export declare function discoverCloudflareBootstrapCommandResources(input: {
+    zoneName: string;
+    kvNamespaceTitle: string;
+    workerScriptName?: string;
+    tokens: CloudflareBootstrapTokens;
+}, dependencies?: {
+    fetcher?: typeof fetch;
+    discover?: typeof discoverCloudflareBootstrapResources;
+}): Promise<CloudflareBootstrapDiscovery>;
 export interface CloudflareBootstrapFinalizeConfig {
     format: 1;
     kind: 'forgezero-cloudflare-bootstrap-finalize';
@@ -23,14 +32,13 @@ export interface CloudflareBootstrapFinalizeConfig {
 export declare function createCloudflareBootstrapCommandConfig(input: {
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
-    tokenFiles: CloudflareBootstrapTokenFiles;
 }): CloudflareBootstrapCommandConfig;
 /**
- * Read reviewed non-secret coordinates and token-file paths for the attended
- * operator phase. Raw token values and a persisted mode are not schema fields.
+ * Read reviewed non-secret coordinates for the attended operator phase. Raw
+ * token values and a persisted mode are not schema fields.
  */
 export declare function readCloudflareBootstrapCommandConfig(path: string, mode: 'plan' | 'apply'): AttendedCloudflareBootstrapRequest;
-export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
+export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, tokens?: CloudflareBootstrapTokens, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function runCloudflareBootstrapVerificationCommand(checkpointPath: string, dependencies?: {
     verify?: typeof verifyCloudflareBootstrapAcceptance;
     write?: (text: string) => void;

package/dist/cloudflare-bootstrap.d.ts

@@ -33,32 +33,18 @@ export interface CloudflareBootstrapCoordinates {
     realtime?: CloudflareRealtimeCoordinates;
     nodes: CloudflareBootstrapNodeCoordinates[];
 }
-export interface CloudflareBootstrapTokenFiles {
-    /** CF_TUNNEL_TOKEN: Tunnel, DNS, Mesh connector/network and device-profile writes. */
-    tunnelTokenFile: string;
-    /** Exact-account Workers KV Storage Write plus existing-Worker Scripts Write. */
-    apiTokenFile: string;
-}
 export interface CloudflareBootstrapTokens {
     tunnelToken: string;
     apiToken: string;
 }
 interface CloudflareBootstrapNodeResource extends CloudflareBootstrapNodeCoordinates {
     tunnelId: string;
-    connectorToken: string;
     mesh?: CloudflareMeshCoordinates & {
         connectorId: string;
-        connectorToken: string;
     };
 }
 interface CloudflareBootstrapResources {
     kvNamespaceId: string;
-    /** Owner-supplied CF_API_TOKEN, sealed into each host handoff. */
-    apiToken: string;
-    realtime?: {
-        publishSecret: string;
-        ticketSecret: string;
-    };
     nodes: CloudflareBootstrapNodeResource[];
 }
 export interface CloudflareBootstrapOutput {
@@ -79,7 +65,7 @@ export interface CloudflareBootstrapOutput {
 export interface CloudflareBootstrapPlan {
     format: 1;
     kind: 'forgezero-cloudflare-bootstrap-plan';
-    mode: 'attended-token-file';
+    mode: 'attended-hidden-input';
     outputFile: string;
     coordinates: CloudflareBootstrapCoordinates;
     operations: readonly string[];
@@ -88,7 +74,7 @@ export interface CloudflareBootstrapPlan {
 export interface AttendedCloudflareBootstrapRequest {
     mode: 'plan' | 'apply';
     coordinates: CloudflareBootstrapCoordinates;
-    tokenFiles?: CloudflareBootstrapTokenFiles;
+    tokens?: CloudflareBootstrapTokens;
     checkpointPath: string;
 }
 /** Secret-free evidence safe to embed in the platform bootstrap journal. */
@@ -128,9 +114,7 @@ export interface CloudflareBootstrapDependencies {
     fetcher?: typeof fetch;
 }
 export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
-/** Read exactly one API token from a non-symlinked, owner-only regular file. */
-export declare function readOwnerApiToken(path: string): Promise<string>;
-export declare function readCloudflareBootstrapTokens(files: CloudflareBootstrapTokenFiles): Promise<CloudflareBootstrapTokens>;
+export declare function validateCloudflareBootstrapTokens(input: unknown): CloudflareBootstrapTokens;
 export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
 export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
 export interface CloudflareConnectorHandoff {
@@ -138,10 +122,8 @@ export interface CloudflareConnectorHandoff {
     hostname: string;
     service: string;
     tunnelId: string;
-    connectorToken: string;
     mesh?: {
         connectorId: string;
-        connectorToken: string;
         routes: readonly string[];
     };
 }
@@ -149,30 +131,29 @@ export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
     accountId: string;
     zoneId: string;
     kvNamespaceId: string;
-    /** CF_API_TOKEN: Workers KV Storage Write plus existing-Worker Scripts Write. */
-    apiToken: string;
-    realtime?: CloudflareRealtimeCoordinates & {
-        publishSecret: string;
-        ticketSecret: string;
-    };
+    realtime?: CloudflareRealtimeCoordinates;
 }
 export declare function cloudflareHostHandoffPath(checkpointPath: string, nodeName: string): string;
 export declare function readCloudflareConnectorHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareConnectorHandoff>;
 export declare function readCloudflareHostHandoff(handoffPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
 export declare function writeOwnerBootstrapOutput(path: string, output: CloudflareBootstrapOutput): Promise<void>;
+export declare const deriveCloudflareRealtimeSecrets: (apiToken: string) => {
+    publishSecret: string;
+    ticketSecret: string;
+};
 /** Attended, resumable Tunnel/DNS/KV handoff bootstrap. */
 export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareBootstrapTokens, outputPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapOutput>;
 export declare function runAttendedCloudflareBootstrap(request: AttendedCloudflareBootstrapRequest, dependencies?: CloudflareBootstrapDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function verifyCloudflareBootstrapAcceptance(checkpointPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
 /**
- * Read finalized, secret-free Cloudflare acceptance after the capability-bearing
+ * Read finalized, secret-free Cloudflare acceptance after the working
  * checkpoint has been removed. This is the durable input consumed by the fleet
  * rehearsal; it never attempts to reopen the deleted handoff.
  */
 export declare function readCloudflareBootstrapAcceptanceEvidence(acceptancePath: string, expectedNodes?: readonly CloudflareBootstrapAcceptedNode[]): Promise<CloudflareBootstrapAcceptanceEvidence>;
 /**
  * Prove every public node, persist secret-free acceptance evidence, then remove
- * the resumable checkpoint and node handoffs that contain runtime capabilities.
+ * the resumable secret-free checkpoint and node handoffs.
  */
 export declare function finalizeCloudflareBootstrapAcceptance(request: CloudflareBootstrapFinalizeRequest, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
 export {};

package/dist/cloudflare-bootstrap.js

@@ -22,7 +22,7 @@ function privateDatabaseHostRoute(value) {
   return `${address}/${isIP(address) === 4 ? 32 : 128}`;
 }
 var endpoint = "https://api.cloudflare.com/client/v4";
-async function cf(config, path, init = {}, fetcher = fetch) {
+async function cfEnvelope(config, path, init = {}, fetcher = fetch) {
   const response = await fetcher(`${endpoint}${path}`, {
     ...init,
     headers: {
@@ -35,7 +35,68 @@ async function cf(config, path, init = {}, fetcher = fetch) {
   if (!response.ok || body.success !== true) {
     throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
   }
-  return body.result;
+  return body;
+}
+async function cf(config, path, init = {}, fetcher = fetch) {
+  return (await cfEnvelope(config, path, init, fetcher)).result;
+}
+async function cfPages(config, path, perPage, fetcher) {
+  const output = [];
+  for (let page = 1;page <= 100; page += 1) {
+    const separator = path.includes("?") ? "&" : "?";
+    const envelope = await cfEnvelope(config, `${path}${separator}page=${page}&per_page=${perPage}`, {}, fetcher);
+    const result = Array.isArray(envelope.result) ? envelope.result : [];
+    output.push(...result);
+    const totalPages = envelope.result_info?.total_pages;
+    if (Number.isInteger(totalPages) ? page >= totalPages : result.length < perPage)
+      return output;
+  }
+  throw new Error("Cloudflare pagination exceeded the reviewed 100-page bound");
+}
+var exactHexId = (value, label) => {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (!/^[a-f0-9]{32}$/.test(normalized))
+    throw new Error(`${label} is malformed`);
+  return normalized;
+};
+async function discoverCloudflareBootstrapResources(config, fetcher = fetch) {
+  const zoneName = config.zoneName.trim().toLowerCase().replace(/\.$/, "");
+  const kvNamespaceTitle = config.kvNamespaceTitle.trim();
+  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(zoneName)) {
+    throw new Error("Cloudflare zone name is invalid");
+  }
+  if (!kvNamespaceTitle || kvNamespaceTitle.length > 512) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const [managementStatus, runtimeStatus] = await Promise.all([
+    cf({ apiToken: config.tunnelToken }, "/user/tokens/verify", {}, fetcher),
+    cf({ apiToken: config.apiToken }, "/user/tokens/verify", {}, fetcher)
+  ]);
+  if (managementStatus.status !== "active")
+    throw new Error("CF_TUNNEL_TOKEN is not active");
+  if (runtimeStatus.status !== "active")
+    throw new Error("CF_API_TOKEN is not active");
+  const zones = await cfPages({ apiToken: config.tunnelToken }, `/zones?name=${encodeURIComponent(zoneName)}&match=all&status=active`, 50, fetcher);
+  const matchingZones = zones.filter(({ name }) => name?.trim().toLowerCase() === zoneName);
+  if (matchingZones.length !== 1) {
+    throw new Error(`Cloudflare zone ${zoneName} must resolve to exactly one active zone`);
+  }
+  const zoneId = exactHexId(matchingZones[0].id, "Cloudflare zone id");
+  const accountId = exactHexId(matchingZones[0].account?.id, "Cloudflare account id");
+  const namespaces = await cfPages({ apiToken: config.apiToken }, `/accounts/${accountId}/storage/kv/namespaces?order=title&direction=asc`, 1000, fetcher);
+  const matchingNamespaces = namespaces.filter(({ title }) => title === kvNamespaceTitle);
+  if (matchingNamespaces.length !== 1) {
+    throw new Error(`Cloudflare KV namespace ${kvNamespaceTitle} must resolve to exactly one namespace`);
+  }
+  const kvNamespaceId = exactHexId(matchingNamespaces[0].id, "Cloudflare KV namespace id");
+  if (config.workerScriptName) {
+    await verifyCloudflareWorkerDurableObjects({
+      accountId,
+      scriptName: config.workerScriptName,
+      apiToken: config.apiToken
+    }, fetcher);
+  }
+  return { accountId, zoneId, kvNamespaceId };
 }
 async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
   const [address, prefixText, ...extra] = config.network.split("/");
@@ -211,7 +272,7 @@ async function verifyCloudflareWorkerDurableObjects(config, fetcher = fetch) {
   if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/.test(config.scriptName)) {
     throw new Error("Cloudflare Worker script name is invalid");
   }
-  const namespaces = await cf(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces?per_page=1000`, {}, fetcher);
+  const namespaces = await cfPages(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces`, 1000, fetcher);
   const owned = namespaces.filter(({ script }) => script === config.scriptName);
   if (!owned.length)
     throw new Error(`Cloudflare Worker ${config.scriptName} has no Durable Object namespace`);
@@ -283,18 +344,28 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
   }
   return { tunnel, connectorToken, created };
 }
+async function retrieveCloudflareConnectorTokens(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId) || !/^[0-9a-f-]{36}$/i.test(config.tunnelId) || config.meshConnectorId && !/^[0-9a-f-]{36}$/i.test(config.meshConnectorId)) {
+    throw new Error("Cloudflare connector retrieval coordinates are invalid");
+  }
+  const connectorToken = await cf(config, `/accounts/${config.accountId}/cfd_tunnel/${encodeURIComponent(config.tunnelId)}/token`, {}, fetcher);
+  const meshConnectorToken = config.meshConnectorId ? await cf(config, `/accounts/${config.accountId}/warp_connector/${encodeURIComponent(config.meshConnectorId)}/token`, {}, fetcher) : undefined;
+  for (const value of [connectorToken, meshConnectorToken]) {
+    if (value !== undefined && (!value || value.length > 16384))
+      throw new Error("Cloudflare returned an invalid connector token");
+  }
+  return { connectorToken, ...meshConnectorToken ? { meshConnectorToken } : {} };
+}
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { randomBytes, randomUUID } from "crypto";
+import { createHmac, randomUUID } from "crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
 import { dirname, join, resolve } from "path";
 import { isIP as isIP2 } from "net";
 var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
-var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
-var REALTIME_SECRET = /^[A-Za-z0-9_-]{64,128}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -328,26 +399,17 @@ async function readOwnerOnlyFile(path, maximumBytes) {
     await handle?.close();
   }
 }
-async function readOwnerApiToken(path) {
-  const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!TOKEN.test(token))
-    throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
-  return token;
-}
-async function readCloudflareBootstrapTokens(files) {
-  const unsupported = Object.keys(files).filter((key) => ![
-    "tunnelTokenFile",
-    "apiTokenFile"
-  ].includes(key));
+function validateCloudflareBootstrapTokens(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Cloudflare bootstrap tokens must be an object");
+  const source = input;
+  const unsupported = Object.keys(source).filter((key) => !["tunnelToken", "apiToken"].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap token files contain unsupported field ${unsupported[0]}`);
-  if (!files.tunnelTokenFile?.trim() || !files.apiTokenFile?.trim()) {
-    throw new Error("Cloudflare bootstrap requires exactly tunnelTokenFile and apiTokenFile");
-  }
-  const [tunnelToken, apiToken] = await Promise.all([
-    readOwnerApiToken(files.tunnelTokenFile),
-    readOwnerApiToken(files.apiTokenFile)
-  ]);
+    throw new Error(`Cloudflare bootstrap tokens contain unsupported field ${unsupported[0]}`);
+  const tunnelToken = typeof source.tunnelToken === "string" ? source.tunnelToken.trim() : "";
+  const apiToken = typeof source.apiToken === "string" ? source.apiToken.trim() : "";
+  if (!TOKEN.test(tunnelToken) || !TOKEN.test(apiToken))
+    throw new Error("Cloudflare bootstrap requires two valid API tokens");
   if (tunnelToken === apiToken) {
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege tokens");
   }
@@ -523,7 +585,7 @@ function planCloudflareBootstrap(input, outputPath) {
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-plan",
-    mode: "attended-token-file",
+    mode: "attended-hidden-input",
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
@@ -531,19 +593,19 @@ function planCloudflareBootstrap(input, outputPath) {
       ...coordinates.realtime ? [
         "prove the existing Worker owns a Durable Object namespace and install its publish/ticket secrets with CF_API_TOKEN"
       ] : [],
-      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint only its non-secret id",
       ...coordinates.nodes.some(({ mesh }) => mesh) ? [
-        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint its registration token",
+        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint only its non-secret id",
         "reconcile every unique private CIDR to its Mesh connector and include all declared CIDRs in the dedicated Mesh device profile"
       ] : [],
       "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
       "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
-      "write one node-specific handoff containing the connector token and owner-supplied KV/Worker runtime token"
+      "write one secret-free node handoff containing only bound Cloudflare ids and public coordinates"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never placed in argv or stdout",
-      "CF_TUNNEL_TOKEN is never persisted; cloudflared, Mesh, CF_API_TOKEN and generated realtime capabilities are atomically checkpointed with mode 0600",
-      "the normal API process receives only CF_API_TOKEN and never Tunnel, DNS or Mesh management authority"
+      "API tokens are accepted only from a hidden prompt and are never placed in JSON, files, argv or stdout",
+      "checkpoint and host handoffs contain no connector, management, runtime or realtime secret",
+      "the target Agent retrieves its connector tokens and seals both Vault fallback tokens directly"
     ]
   };
 }
@@ -608,25 +670,15 @@ async function readExistingOutput(path) {
   const resources = output.resources;
   const unsupportedResource = Object.keys(resources).filter((key) => ![
     "kvNamespaceId",
-    "apiToken",
-    "realtime",
     "nodes"
   ].includes(key));
   if (unsupportedResource.length) {
     throw new Error(`${resolve(path)} resources contain unsupported field ${unsupportedResource[0]}`);
   }
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
-  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !TOKEN.test(String(resources.apiToken ?? "")) || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
+  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
     throw new Error(`${resolve(path)} has malformed Cloudflare bootstrap resources`);
   }
-  if (coordinates.realtime) {
-    const realtime = resources.realtime;
-    if (!realtime || !REALTIME_SECRET.test(String(realtime.publishSecret ?? "")) || !REALTIME_SECRET.test(String(realtime.ticketSecret ?? "")) || realtime.publishSecret === realtime.ticketSecret) {
-      throw new Error(`${resolve(path)} has malformed Cloudflare realtime resources`);
-    }
-  } else if (resources.realtime !== undefined) {
-    throw new Error(`${resolve(path)} contains undeclared Cloudflare realtime resources`);
-  }
   const seen = new Set;
   for (const item of resources.nodes) {
     if (!item || typeof item !== "object" || Array.isArray(item)) {
@@ -639,16 +691,15 @@ async function readExistingOutput(path) {
       "service",
       "tunnelName",
       "tunnelId",
-      "connectorToken",
       "mesh"
     ].includes(key));
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
-    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? "")) || !CONNECTOR_TOKEN.test(String(node.connectorToken ?? ""))) {
+    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? ""))) {
       throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare node resource`);
     }
     if (expected.mesh) {
       const mesh = node.mesh;
-      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? "")) || !CONNECTOR_TOKEN.test(String(mesh.connectorToken ?? ""))) {
+      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? ""))) {
         throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare Mesh resource`);
       }
     } else if (node.mesh !== undefined) {
@@ -689,7 +740,7 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
   }
   const resource = matches[0];
-  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId) || !CONNECTOR_TOKEN.test(resource.connectorToken)) {
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId)) {
     throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
   }
   return {
@@ -697,10 +748,8 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     hostname: resource.hostname,
     service: resource.service,
     tunnelId: resource.tunnelId,
-    connectorToken: resource.connectorToken,
     ...resource.mesh ? { mesh: {
       connectorId: resource.mesh.connectorId,
-      connectorToken: resource.mesh.connectorToken,
       routes: resource.mesh.routes
     } } : {}
   };
@@ -724,11 +773,9 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     "hostname",
     "service",
     "tunnelId",
-    "connectorToken",
     "accountId",
     "zoneId",
     "kvNamespaceId",
-    "apiToken",
     "mesh",
     "realtime"
   ].includes(key));
@@ -739,11 +786,11 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   try {
     service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.apiToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
   if (output.mesh !== undefined) {
-    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !CONNECTOR_TOKEN.test(output.mesh.connectorToken) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
+    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
       try {
         return privateMeshCidr(route) !== route;
       } catch {
@@ -772,7 +819,7 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     } catch {
       throw new Error("Cloudflare host handoff contains malformed realtime coordinates");
     }
-    if (!REALTIME_SECRET.test(output.realtime.publishSecret) || !REALTIME_SECRET.test(output.realtime.ticketSecret) || output.realtime.publishSecret === output.realtime.ticketSecret || realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
+    if (realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
       throw new Error("Cloudflare host handoff contains malformed realtime credentials");
     }
   }
@@ -837,18 +884,12 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       hostname: node.hostname,
       service: node.service,
       tunnelId: node.tunnelId,
-      connectorToken: node.connectorToken,
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      apiToken: output.resources.apiToken,
-      ...output.coordinates.realtime && output.resources.realtime ? { realtime: {
-        ...output.coordinates.realtime,
-        ...output.resources.realtime
-      } } : {},
+      ...output.coordinates.realtime ? { realtime: output.coordinates.realtime } : {},
       ...node.mesh ? { mesh: {
         connectorId: node.mesh.connectorId,
-        connectorToken: node.mesh.connectorToken,
         routes: node.mesh.routes
       } } : {}
     };
@@ -856,7 +897,10 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
   }
 }
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-var newRealtimeSecret = () => randomBytes(48).toString("base64url");
+var deriveCloudflareRealtimeSecrets = (apiToken) => ({
+  publishSecret: createHmac("sha512", apiToken).update("forgezero/realtime/publish/v1").digest("base64url"),
+  ticketSecret: createHmac("sha512", apiToken).update("forgezero/realtime/ticket/v1").digest("base64url")
+});
 async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
@@ -874,10 +918,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege capabilities");
   }
   await preflightCloudflareKvRuntime(coordinates, apiToken, fetcher);
-  const realtime = coordinates.realtime ? existing?.resources.realtime ?? {
-    publishSecret: newRealtimeSecret(),
-    ticketSecret: newRealtimeSecret()
-  } : undefined;
+  const realtime = coordinates.realtime ? deriveCloudflareRealtimeSecrets(apiToken) : undefined;
   if (coordinates.realtime && realtime) {
     await verifyCloudflareWorkerDurableObjects({
       accountId: coordinates.accountId,
@@ -892,8 +933,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        realtime,
         nodes: existing?.resources.nodes ?? []
       }
     });
@@ -912,7 +951,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     let resource;
     let created = false;
     if (checkpointed) {
-      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId)) {
         throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
       }
       resource = checkpointed;
@@ -933,15 +972,13 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         }, fetcher);
         mesh = {
           ...node.mesh,
-          connectorId: ensured.connector.id,
-          connectorToken: ensured.connectorToken
+          connectorId: ensured.connector.id
         };
       }
       const { mesh: _declaredMesh, ...publicNode } = node;
       resource = {
         ...publicNode,
         tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken,
         ...mesh ? { mesh } : {}
       };
     }
@@ -955,8 +992,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        ...realtime ? { realtime } : {},
         nodes: [...nodeResources]
       }
     });
@@ -1000,8 +1035,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     coordinates,
     resources: {
       kvNamespaceId: coordinates.kvNamespaceId,
-      apiToken,
-      ...realtime ? { realtime } : {},
       nodes: nodeResources
     },
     created: {
@@ -1023,10 +1056,10 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
-  if (!request.tokenFiles) {
-    throw new Error("Cloudflare apply requires exactly two owner-only token file paths");
+  if (!request.tokens) {
+    throw new Error("Cloudflare apply requires exactly two attended API tokens");
   }
-  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const tokens = validateCloudflareBootstrapTokens(request.tokens);
   const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
@@ -1178,15 +1211,15 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 export {
   writeOwnerBootstrapOutput,
   verifyCloudflareBootstrapAcceptance,
+  validateCloudflareBootstrapTokens,
   validateCloudflareBootstrapCoordinates,
   runAttendedCloudflareBootstrap,
-  readOwnerApiToken,
   readCloudflareHostHandoff,
   readCloudflareConnectorHandoff,
-  readCloudflareBootstrapTokens,
   readCloudflareBootstrapAcceptanceEvidence,
   planCloudflareBootstrap,
   finalizeCloudflareBootstrapAcceptance,
+  deriveCloudflareRealtimeSecrets,
   cloudflareHostHandoffPath,
   applyCloudflareBootstrap
 };

package/dist/cloudflare-edge.d.ts

@@ -7,6 +7,24 @@ export interface CloudflareEdgeConfig {
     /** The single attended management capability used for both Tunnel and DNS writes. */
     apiToken: string;
 }
+export interface CloudflareBootstrapDiscovery {
+    accountId: string;
+    zoneId: string;
+    kvNamespaceId: string;
+}
+/**
+ * Resolve stable Cloudflare ids from owner-recognizable names without ever
+ * persisting or printing either token. The management token is used only for
+ * the exact zone lookup; the runtime token is used only for the existing KV
+ * namespace and optional Worker/DO ownership proof.
+ */
+export declare function discoverCloudflareBootstrapResources(config: {
+    zoneName: string;
+    kvNamespaceTitle: string;
+    workerScriptName?: string;
+    tunnelToken: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<CloudflareBootstrapDiscovery>;
 export interface CloudflarePrivateRouteConfig {
     accountId: string;
     tunnelId: string;
@@ -166,4 +184,14 @@ export declare function ensureCloudflareTunnel(config: {
     connectorToken: string;
     created: boolean;
 }>;
+/** Retrieve node-scoped connector capabilities only in the target Agent process. */
+export declare function retrieveCloudflareConnectorTokens(config: {
+    accountId: string;
+    tunnelId: string;
+    meshConnectorId?: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    connectorToken: string;
+    meshConnectorToken?: string;
+}>;
 export {};