@forgezero/agent 0.1.57 → 0.1.59

package/dist/cloudflare-edge.js

@@ -22,7 +22,7 @@ function privateDatabaseHostRoute(value) {
   return `${address}/${isIP(address) === 4 ? 32 : 128}`;
 }
 var endpoint = "https://api.cloudflare.com/client/v4";
-async function cf(config, path, init = {}, fetcher = fetch) {
+async function cfEnvelope(config, path, init = {}, fetcher = fetch) {
   const response = await fetcher(`${endpoint}${path}`, {
     ...init,
     headers: {
@@ -35,7 +35,68 @@ async function cf(config, path, init = {}, fetcher = fetch) {
   if (!response.ok || body.success !== true) {
     throw new Error(body.errors?.map(({ message }) => message).filter(Boolean).join("; ") || `Cloudflare returned HTTP ${response.status}`);
   }
-  return body.result;
+  return body;
+}
+async function cf(config, path, init = {}, fetcher = fetch) {
+  return (await cfEnvelope(config, path, init, fetcher)).result;
+}
+async function cfPages(config, path, perPage, fetcher) {
+  const output = [];
+  for (let page = 1;page <= 100; page += 1) {
+    const separator = path.includes("?") ? "&" : "?";
+    const envelope = await cfEnvelope(config, `${path}${separator}page=${page}&per_page=${perPage}`, {}, fetcher);
+    const result = Array.isArray(envelope.result) ? envelope.result : [];
+    output.push(...result);
+    const totalPages = envelope.result_info?.total_pages;
+    if (Number.isInteger(totalPages) ? page >= totalPages : result.length < perPage)
+      return output;
+  }
+  throw new Error("Cloudflare pagination exceeded the reviewed 100-page bound");
+}
+var exactHexId = (value, label) => {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (!/^[a-f0-9]{32}$/.test(normalized))
+    throw new Error(`${label} is malformed`);
+  return normalized;
+};
+async function discoverCloudflareBootstrapResources(config, fetcher = fetch) {
+  const zoneName = config.zoneName.trim().toLowerCase().replace(/\.$/, "");
+  const kvNamespaceTitle = config.kvNamespaceTitle.trim();
+  if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(zoneName)) {
+    throw new Error("Cloudflare zone name is invalid");
+  }
+  if (!kvNamespaceTitle || kvNamespaceTitle.length > 512) {
+    throw new Error("Cloudflare KV namespace title is invalid");
+  }
+  const [managementStatus, runtimeStatus] = await Promise.all([
+    cf({ apiToken: config.tunnelToken }, "/user/tokens/verify", {}, fetcher),
+    cf({ apiToken: config.apiToken }, "/user/tokens/verify", {}, fetcher)
+  ]);
+  if (managementStatus.status !== "active")
+    throw new Error("CF_TUNNEL_TOKEN is not active");
+  if (runtimeStatus.status !== "active")
+    throw new Error("CF_API_TOKEN is not active");
+  const zones = await cfPages({ apiToken: config.tunnelToken }, `/zones?name=${encodeURIComponent(zoneName)}&match=all&status=active`, 50, fetcher);
+  const matchingZones = zones.filter(({ name }) => name?.trim().toLowerCase() === zoneName);
+  if (matchingZones.length !== 1) {
+    throw new Error(`Cloudflare zone ${zoneName} must resolve to exactly one active zone`);
+  }
+  const zoneId = exactHexId(matchingZones[0].id, "Cloudflare zone id");
+  const accountId = exactHexId(matchingZones[0].account?.id, "Cloudflare account id");
+  const namespaces = await cfPages({ apiToken: config.apiToken }, `/accounts/${accountId}/storage/kv/namespaces?order=title&direction=asc`, 1000, fetcher);
+  const matchingNamespaces = namespaces.filter(({ title }) => title === kvNamespaceTitle);
+  if (matchingNamespaces.length !== 1) {
+    throw new Error(`Cloudflare KV namespace ${kvNamespaceTitle} must resolve to exactly one namespace`);
+  }
+  const kvNamespaceId = exactHexId(matchingNamespaces[0].id, "Cloudflare KV namespace id");
+  if (config.workerScriptName) {
+    await verifyCloudflareWorkerDurableObjects({
+      accountId,
+      scriptName: config.workerScriptName,
+      apiToken: config.apiToken
+    }, fetcher);
+  }
+  return { accountId, zoneId, kvNamespaceId };
 }
 async function ensureCloudflarePrivateRoute(config, fetcher = fetch) {
   const [address, prefixText, ...extra] = config.network.split("/");
@@ -211,7 +272,7 @@ async function verifyCloudflareWorkerDurableObjects(config, fetcher = fetch) {
   if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/.test(config.scriptName)) {
     throw new Error("Cloudflare Worker script name is invalid");
   }
-  const namespaces = await cf(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces?per_page=1000`, {}, fetcher);
+  const namespaces = await cfPages(config, `/accounts/${config.accountId}/workers/durable_objects/namespaces`, 1000, fetcher);
   const owned = namespaces.filter(({ script }) => script === config.scriptName);
   if (!owned.length)
     throw new Error(`Cloudflare Worker ${config.scriptName} has no Durable Object namespace`);
@@ -283,8 +344,21 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
   }
   return { tunnel, connectorToken, created };
 }
+async function retrieveCloudflareConnectorTokens(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId) || !/^[0-9a-f-]{36}$/i.test(config.tunnelId) || config.meshConnectorId && !/^[0-9a-f-]{36}$/i.test(config.meshConnectorId)) {
+    throw new Error("Cloudflare connector retrieval coordinates are invalid");
+  }
+  const connectorToken = await cf(config, `/accounts/${config.accountId}/cfd_tunnel/${encodeURIComponent(config.tunnelId)}/token`, {}, fetcher);
+  const meshConnectorToken = config.meshConnectorId ? await cf(config, `/accounts/${config.accountId}/warp_connector/${encodeURIComponent(config.meshConnectorId)}/token`, {}, fetcher) : undefined;
+  for (const value of [connectorToken, meshConnectorToken]) {
+    if (value !== undefined && (!value || value.length > 16384))
+      throw new Error("Cloudflare returned an invalid connector token");
+  }
+  return { connectorToken, ...meshConnectorToken ? { meshConnectorToken } : {} };
+}
 export {
   verifyCloudflareWorkerDurableObjects,
+  retrieveCloudflareConnectorTokens,
   removeCloudflareWarpDatabaseInclude,
   removeCloudflarePrivateRoute,
   removeCloudflarePrivateDatabaseRoute,
@@ -294,6 +368,7 @@ export {
   ensureCloudflarePrivateRoute,
   ensureCloudflarePrivateDatabaseRoute,
   ensureCloudflareMeshConnector,
+  discoverCloudflareBootstrapResources,
   configureCloudflareRealtimeSecrets,
   configureCloudflareEdge
 };

package/dist/credential-schema.d.ts

@@ -1,8 +1,8 @@
 /**
  * One credential policy for every place the Agent can run.
  *
- * Operator credentials are attended input files and are never installed as a
- * runtime source. Physical-metal credentials are fixed host identities loaded
+ * Operator credentials are hidden attended input and are never persisted as a
+ * plaintext source. Physical-metal credentials are fixed host identities loaded
  * only by systemd. Enrolled platform and tenant computes read their assigned
  * project/environment Vault replica first and may use only an explicitly
  * installed, same-name systemd credential while that replica cannot answer.
@@ -34,13 +34,13 @@ export declare const CLOUDFLARE_CREDENTIAL_NAMES: {
 export declare const CLOUDFLARE_CREDENTIAL_SCHEMA: {
     readonly CF_TUNNEL_TOKEN: {
         readonly permissions: readonly ["Account:Cloudflare Tunnel Write", "Account:Cloudflare One Connector: WARP Write", "Account:Cloudflare One Networks Write", "Account:Zero Trust Write", "Zone:DNS Write"];
-        readonly platformBootstrap: "attended-file";
-        readonly platformRuntime: "vault";
+        readonly platformBootstrap: "hidden-prompt-to-systemd";
+        readonly platformRuntime: "vault-then-systemd";
         readonly tenantControl: "vault";
     };
     readonly CF_API_TOKEN: {
         readonly permissions: readonly ["Account:Workers KV Storage Write", "Account:Workers Scripts Write"];
-        readonly platformBootstrap: "attended-file";
+        readonly platformBootstrap: "hidden-prompt-to-systemd";
         readonly platformRuntime: "vault-then-systemd";
         readonly tenantControl: "vault";
     };
@@ -67,22 +67,22 @@ export declare const AGENT_CREDENTIAL_POLICY: {
     readonly operator: {
         readonly vault: false;
         readonly systemdFallback: false;
-        readonly attendedFile: true;
+        readonly hiddenInput: true;
     };
     readonly metal: {
         readonly vault: false;
         readonly systemdFallback: true;
-        readonly attendedFile: false;
+        readonly hiddenInput: false;
     };
     readonly 'platform-compute': {
         readonly vault: true;
         readonly systemdFallback: true;
-        readonly attendedFile: false;
+        readonly hiddenInput: false;
     };
     readonly 'tenant-compute': {
         readonly vault: true;
         readonly systemdFallback: true;
-        readonly attendedFile: false;
+        readonly hiddenInput: false;
     };
 };
 export interface DeploymentCredentialBinding {

package/dist/credential-schema.js

@@ -300,13 +300,13 @@ var CLOUDFLARE_CREDENTIAL_SCHEMA = {
       "Account:Zero Trust Write",
       "Zone:DNS Write"
     ],
-    platformBootstrap: "attended-file",
-    platformRuntime: "vault",
+    platformBootstrap: "hidden-prompt-to-systemd",
+    platformRuntime: "vault-then-systemd",
     tenantControl: "vault"
   },
   CF_API_TOKEN: {
     permissions: ["Account:Workers KV Storage Write", "Account:Workers Scripts Write"],
-    platformBootstrap: "attended-file",
+    platformBootstrap: "hidden-prompt-to-systemd",
     platformRuntime: "vault-then-systemd",
     tenantControl: "vault"
   },
@@ -330,10 +330,10 @@ var CLOUDFLARE_CREDENTIAL_SCHEMA = {
   }
 };
 var AGENT_CREDENTIAL_POLICY = {
-  operator: { vault: false, systemdFallback: false, attendedFile: true },
-  metal: { vault: false, systemdFallback: true, attendedFile: false },
-  "platform-compute": { vault: true, systemdFallback: true, attendedFile: false },
-  "tenant-compute": { vault: true, systemdFallback: true, attendedFile: false }
+  operator: { vault: false, systemdFallback: false, hiddenInput: true },
+  metal: { vault: false, systemdFallback: true, hiddenInput: false },
+  "platform-compute": { vault: true, systemdFallback: true, hiddenInput: false },
+  "tenant-compute": { vault: true, systemdFallback: true, hiddenInput: false }
 };
 var CREDENTIAL_NAME = /^[A-Z_][A-Z0-9_]*$/;
 var SCOPE_PART2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;

package/dist/fz-agent.js

@@ -8448,7 +8448,7 @@ function assertSupportedGuestImage(imageKey) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.57";
+var VERSION2 = "0.1.59";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -8583,7 +8583,7 @@ var verifiedBunArchive = async (directory) => {
   writeFileSync4(archive, bytes, { mode: 384, flag: "wx" });
   return archive;
 };
-var remote = (exec, ssh, destination, code, argv2, secret = false) => checked(exec, ["ssh", ...ssh, destination, "--", ...argv2], code, { secret });
+var remote = (exec, ssh, destination, code, argv2, secret = false, stdin) => checked(exec, ["ssh", ...ssh, destination, "--", ...argv2], code, { secret, ...stdin !== undefined ? { stdin } : {} });
 async function executeSshBootstrap(claim, options) {
   validateClaim(claim);
   if (!options.sshKeyPath.startsWith("/") || /[\r\n]/.test(options.sshKeyPath))
@@ -8622,14 +8622,11 @@ async function executeSshBootstrap(claim, options) {
       realm: claim.realm,
       nodeHostname: claim.target.nodeHostname,
       telemetryEndpoint: telemetry.origin,
-      enrolTokenFile: "/run/forgezero-bootstrap/enrol.token",
       profile: "app",
       software: [{ id: "bun", version: PINNED_BUN_VERSION }]
     };
     const files = {
       "config.json": `${JSON.stringify(config, null, 2)}
-`,
-      "enrol.token": `${claim.enrolmentToken}
 `
     };
     for (const [name, content] of Object.entries(files))
@@ -8753,7 +8750,7 @@ async function executeSshBootstrap(claim, options) {
       "/usr/local/lib/forgezero/agent/fz.js",
       "/usr/local/bin/fz"
     ]);
-    for (const name of ["config.json", "enrol.token"])
+    for (const name of ["config.json"])
       await remote(exec, ssh, destination, "REMOTE_CONFIG_INSTALL_FAILED", [
         "/usr/bin/sudo",
         "-n",
@@ -8769,10 +8766,12 @@ async function executeSshBootstrap(claim, options) {
       "/usr/local/bin/fz",
       "agent",
       "activate",
+      "credentials-stdin",
       "--bootstrap-config",
       "/run/forgezero-bootstrap/config.json",
       "--apply"
-    ], true);
+    ], true, `${JSON.stringify({ enrolmentToken: claim.enrolmentToken })}
+`);
     await remote(exec, ssh, destination, "REMOTE_CLEANUP_FAILED", [
       "/usr/bin/sudo",
       "-n",
@@ -13078,10 +13077,10 @@ var AGENT_CREDENTIAL_LOCATIONS = [
   "tenant-compute"
 ];
 var AGENT_CREDENTIAL_POLICY = {
-  operator: { vault: false, systemdFallback: false, attendedFile: true },
-  metal: { vault: false, systemdFallback: true, attendedFile: false },
-  "platform-compute": { vault: true, systemdFallback: true, attendedFile: false },
-  "tenant-compute": { vault: true, systemdFallback: true, attendedFile: false }
+  operator: { vault: false, systemdFallback: false, hiddenInput: true },
+  metal: { vault: false, systemdFallback: true, hiddenInput: false },
+  "platform-compute": { vault: true, systemdFallback: true, hiddenInput: false },
+  "tenant-compute": { vault: true, systemdFallback: true, hiddenInput: false }
 };
 var CREDENTIAL_NAME = /^[A-Z_][A-Z0-9_]*$/;
 var SCOPE_PART2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
@@ -13365,7 +13364,7 @@ async function runRecoveryHost(args, run2 = execute2) {
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
-      nonEmpty("/etc/forgezero/creds/backup-s3-secret.cred");
+      nonEmpty("/etc/forgezero/creds/backup.s3.secretAccessKey.cred");
       nonEmpty("/etc/forgezero/creds/backup-recovery-root.cred");
     }
     const slot = activeSlot();
@@ -13412,7 +13411,7 @@ async function runRecoveryHost(args, run2 = execute2) {
       "--property=LoadCredentialEncrypted=arangodb-jwt:/etc/forgezero/creds/arangodb-jwt.cred",
       ...args.includes("--fleet-fenced") ? ["--property=Environment=FZ_RECOVERY_FLEET_FENCED=all-api-and-scheduler-replicas-are-stopped"] : [],
       ...args.includes("--backup-credentials") ? [
-        "--property=LoadCredentialEncrypted=backup-s3-secret:/etc/forgezero/creds/backup-s3-secret.cred",
+        "--property=LoadCredentialEncrypted=backup.s3.secretAccessKey:/etc/forgezero/creds/backup.s3.secretAccessKey.cred",
         "--property=LoadCredentialEncrypted=backup-recovery-root:/etc/forgezero/creds/backup-recovery-root.cred"
       ] : []
     ];
@@ -14177,10 +14176,11 @@ function planProvision(options) {
   const warpEnabled = warpValues.every(Boolean);
   if (warpValues.some(Boolean) && !warpEnabled)
     throw new Error("WARP configuration must be supplied together");
-  const enrolmentEnabled = Boolean(options.enrolTokenSourcePath && options.enrolTokenCredentialPath && options.enrolStatePath);
-  if (Boolean(options.enrolTokenSourcePath) !== Boolean(options.enrolTokenCredentialPath) || Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath))
-    throw new Error("direct enrolment paths must be supplied together");
-  const enrolTokenSourcePath = enrolmentEnabled ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
+  const enrolmentEnabled = Boolean(options.enrolTokenCredentialPath && options.enrolStatePath);
+  if (Boolean(options.enrolTokenCredentialPath) !== Boolean(options.enrolStatePath) || options.enrolTokenSourcePath && !enrolmentEnabled) {
+    throw new Error("direct enrolment credential and state paths must be supplied together");
+  }
+  const enrolTokenSourcePath = options.enrolTokenSourcePath ? systemdPath(options.enrolTokenSourcePath, "enrolment source") : undefined;
   const enrolTokenCredentialPath = enrolmentEnabled ? systemdPath(options.enrolTokenCredentialPath, "enrolment credential") : undefined;
   const enrolStatePath = enrolmentEnabled ? systemdPath(options.enrolStatePath, "enrolment state") : undefined;
   const enrolStateDir = enrolStatePath?.replace(/\/[^/]+$/, "");
@@ -14308,7 +14308,12 @@ function planProvision(options) {
       ] : [],
       ...enrolmentEnabled ? [
         step2("enrolment state directory", { kind: "directories", directories: [{ path: enrolStateDir, mode: 448, owner: user, group: user }] }),
-        step2("encrypted one-time enrolment capability", { kind: "ensure-enrolment", state: enrolStatePath, source: enrolTokenSourcePath, credential: enrolTokenCredentialPath })
+        ...enrolTokenSourcePath ? [step2("encrypted one-time enrolment capability", {
+          kind: "ensure-enrolment",
+          state: enrolStatePath,
+          source: enrolTokenSourcePath,
+          credential: enrolTokenCredentialPath
+        })] : []
       ] : [],
       ...deploymentEnabled ? [step2("deployment directories", { kind: "directories", directories: [
         { path: deployRoot, mode: 493, owner: "root", group: "root" },
@@ -14657,6 +14662,7 @@ var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
+var CF_TUNNEL_API_CREDENTIAL = `${CREDS}/CF_TUNNEL_TOKEN.cred`;
 var WARP_CONNECTOR_CREDENTIAL = `${CREDS}/CF_WARP_CONNECTOR_TOKEN.cred`;
 var REALTIME_PUBLISH_CREDENTIAL = `${CREDS}/REALTIME_PUBLISH_SECRET.cred`;
 var REALTIME_TICKET_CREDENTIAL = `${CREDS}/REALTIME_TICKET_SECRET.cred`;
@@ -14887,10 +14893,10 @@ function localBootstrapHost() {
         throw new Error(`Agent software requirements failed: ${result.output.trim()}`);
       return result;
     },
-    async installAgent(config, enrolTokenSourcePath) {
+    async installAgent(config) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync19("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || existsSync19(ENROL_CREDENTIAL) || existsSync19("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -14933,8 +14939,7 @@ function localBootstrapHost() {
         telemetryEndpoint: config.telemetryEndpoint,
         binPath: "/usr/local/lib/forgezero/agent/fz-agent",
         sourceBinPath: PACKAGED_AGENT_BIN,
-        ...config.kind === "enrolled-compute" || enrolTokenSourcePath ? {
-          enrolTokenSourcePath: config.kind === "enrolled-compute" ? config.enrolTokenFile : enrolTokenSourcePath,
+        ...hasBinding ? {
           enrolTokenCredentialPath: ENROL_CREDENTIAL,
           enrolStatePath: "/var/lib/forgezero/enrolment.json",
           apiUrl: config.apiUrl,