@forgezero/agent 0.1.58 → 0.1.59

package/README.md

@@ -278,14 +278,15 @@ import type { AgentUpdateOutcome, AgentUpdateReceipt, AgentUpdateRequest, AgentU
 <a id="forgezero-agent-bootstrap"></a>
 ## @forgezero/agent/bootstrap
 
-Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. Named value imports: BOOTSTRAP_STATE_PATH, PLATFORM_BOOTSTRAP_PROFILES, applyBootstrap, bootstrapIdentityDigest, bootstrapStatus, localBootstrapHost, planBootstrap, preparePlatformBootstrap, readBootstrapConfig, resolveInstalledBootstrapKind, validateBootstrapConfig. Named type imports: BootstrapConfig, BootstrapEnvironment, BootstrapHost, BootstrapPlan, BootstrapResult, BootstrapStatus, BootstrapStep, DatabaseAgencyParticipation, DatabaseBootstrapRole, EnrolledComputeActivationConfig, InstalledBootstrapKind, PlatformBootstrapConfig, PlatformBootstrapPreparation, PlatformBootstrapProfile, PlatformEnrolmentSource. Import only the names used by this file.
+Typed one-time platform bootstrap and internal API-driven enrolled-compute activation contracts. Named value imports: BOOTSTRAP_STATE_PATH, PLATFORM_BOOTSTRAP_PROFILES, applyBootstrap, bootstrapIdentityDigest, bootstrapStatus, localBootstrapHost, planBootstrap, preparePlatformBootstrap, readBootstrapConfig, resolveInstalledBootstrapKind, validateBootstrapConfig, validateEnrolledComputeBootstrapSecrets, validatePlatformBootstrapSecrets. Named type imports: BootstrapConfig, BootstrapEnvironment, BootstrapHost, BootstrapPlan, BootstrapResult, BootstrapSecrets, BootstrapStatus, BootstrapStep, DatabaseAgencyParticipation, DatabaseBootstrapRole, EnrolledComputeActivationConfig, EnrolledComputeBootstrapSecrets, InstalledBootstrapKind, PlatformBootstrapConfig, PlatformBootstrapPreparation, PlatformBootstrapProfile, PlatformBootstrapSecrets, PlatformEnrolmentSource. Import only the names used by this file.
 
 ```text
 import { BOOTSTRAP_STATE_PATH, PLATFORM_BOOTSTRAP_PROFILES, applyBootstrap, bootstrapIdentityDigest, bootstrapStatus, localBootstrapHost } from '@forgezero/agent/bootstrap';
-import { planBootstrap, preparePlatformBootstrap, readBootstrapConfig, resolveInstalledBootstrapKind, validateBootstrapConfig } from '@forgezero/agent/bootstrap';
-import type { BootstrapConfig, BootstrapEnvironment, BootstrapHost, BootstrapPlan, BootstrapResult, BootstrapStatus } from '@forgezero/agent/bootstrap';
-import type { BootstrapStep, DatabaseAgencyParticipation, DatabaseBootstrapRole, EnrolledComputeActivationConfig, InstalledBootstrapKind, PlatformBootstrapConfig } from '@forgezero/agent/bootstrap';
-import type { PlatformBootstrapPreparation, PlatformBootstrapProfile, PlatformEnrolmentSource } from '@forgezero/agent/bootstrap';
+import { planBootstrap, preparePlatformBootstrap, readBootstrapConfig, resolveInstalledBootstrapKind, validateBootstrapConfig, validateEnrolledComputeBootstrapSecrets } from '@forgezero/agent/bootstrap';
+import { validatePlatformBootstrapSecrets } from '@forgezero/agent/bootstrap';
+import type { BootstrapConfig, BootstrapEnvironment, BootstrapHost, BootstrapPlan, BootstrapResult, BootstrapSecrets } from '@forgezero/agent/bootstrap';
+import type { BootstrapStatus, BootstrapStep, DatabaseAgencyParticipation, DatabaseBootstrapRole, EnrolledComputeActivationConfig, EnrolledComputeBootstrapSecrets } from '@forgezero/agent/bootstrap';
+import type { InstalledBootstrapKind, PlatformBootstrapConfig, PlatformBootstrapPreparation, PlatformBootstrapProfile, PlatformBootstrapSecrets, PlatformEnrolmentSource } from '@forgezero/agent/bootstrap';
 ```
 
 <a id="forgezero-agent-operator-bootstrap"></a>
@@ -345,26 +346,26 @@ import type { CapacityCalibration, CapacityCalibrationOptions, CapacityStage, Va
 <a id="forgezero-agent-cloudflare-bootstrap"></a>
 ## @forgezero/agent/cloudflare-bootstrap
 
-Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. Named value imports: applyCloudflareBootstrap, cloudflareHostHandoffPath, finalizeCloudflareBootstrapAcceptance, planCloudflareBootstrap, readCloudflareBootstrapAcceptanceEvidence, readCloudflareBootstrapTokens, readCloudflareConnectorHandoff, readCloudflareHostHandoff, readOwnerApiToken, runAttendedCloudflareBootstrap, validateCloudflareBootstrapCoordinates, verifyCloudflareBootstrapAcceptance, writeOwnerBootstrapOutput. Named type imports: AttendedCloudflareBootstrapRequest, CloudflareBootstrapAcceptanceEvidence, CloudflareBootstrapAcceptedNode, CloudflareBootstrapCoordinates, CloudflareBootstrapDependencies, CloudflareBootstrapEvidence, CloudflareBootstrapFinalizeRequest, CloudflareBootstrapNodeCoordinates, CloudflareBootstrapOutput, CloudflareBootstrapPhaseRunner, CloudflareBootstrapPlan, CloudflareBootstrapTokenFiles, CloudflareBootstrapTokens, CloudflareConnectorHandoff, CloudflareHostHandoff, CloudflareMeshCoordinates, CloudflareRealtimeCoordinates. Import only the names used by this file.
+Attended two-token Cloudflare Tunnel/DNS reconciliation and per-node connector/KV runtime handoff for existing KV resources. Named value imports: applyCloudflareBootstrap, cloudflareHostHandoffPath, deriveCloudflareRealtimeSecrets, finalizeCloudflareBootstrapAcceptance, planCloudflareBootstrap, readCloudflareBootstrapAcceptanceEvidence, readCloudflareConnectorHandoff, readCloudflareHostHandoff, runAttendedCloudflareBootstrap, validateCloudflareBootstrapCoordinates, validateCloudflareBootstrapTokens, verifyCloudflareBootstrapAcceptance, writeOwnerBootstrapOutput. Named type imports: AttendedCloudflareBootstrapRequest, CloudflareBootstrapAcceptanceEvidence, CloudflareBootstrapAcceptedNode, CloudflareBootstrapCoordinates, CloudflareBootstrapDependencies, CloudflareBootstrapEvidence, CloudflareBootstrapFinalizeRequest, CloudflareBootstrapNodeCoordinates, CloudflareBootstrapOutput, CloudflareBootstrapPhaseRunner, CloudflareBootstrapPlan, CloudflareBootstrapTokens, CloudflareConnectorHandoff, CloudflareHostHandoff, CloudflareMeshCoordinates, CloudflareRealtimeCoordinates. Import only the names used by this file.
 
 ```text
-import { applyCloudflareBootstrap, cloudflareHostHandoffPath, finalizeCloudflareBootstrapAcceptance, planCloudflareBootstrap, readCloudflareBootstrapAcceptanceEvidence, readCloudflareBootstrapTokens } from '@forgezero/agent/cloudflare-bootstrap';
-import { readCloudflareConnectorHandoff, readCloudflareHostHandoff, readOwnerApiToken, runAttendedCloudflareBootstrap, validateCloudflareBootstrapCoordinates, verifyCloudflareBootstrapAcceptance } from '@forgezero/agent/cloudflare-bootstrap';
+import { applyCloudflareBootstrap, cloudflareHostHandoffPath, deriveCloudflareRealtimeSecrets, finalizeCloudflareBootstrapAcceptance, planCloudflareBootstrap, readCloudflareBootstrapAcceptanceEvidence } from '@forgezero/agent/cloudflare-bootstrap';
+import { readCloudflareConnectorHandoff, readCloudflareHostHandoff, runAttendedCloudflareBootstrap, validateCloudflareBootstrapCoordinates, validateCloudflareBootstrapTokens, verifyCloudflareBootstrapAcceptance } from '@forgezero/agent/cloudflare-bootstrap';
 import { writeOwnerBootstrapOutput } from '@forgezero/agent/cloudflare-bootstrap';
 import type { AttendedCloudflareBootstrapRequest, CloudflareBootstrapAcceptanceEvidence, CloudflareBootstrapAcceptedNode, CloudflareBootstrapCoordinates, CloudflareBootstrapDependencies, CloudflareBootstrapEvidence } from '@forgezero/agent/cloudflare-bootstrap';
-import type { CloudflareBootstrapFinalizeRequest, CloudflareBootstrapNodeCoordinates, CloudflareBootstrapOutput, CloudflareBootstrapPhaseRunner, CloudflareBootstrapPlan, CloudflareBootstrapTokenFiles } from '@forgezero/agent/cloudflare-bootstrap';
-import type { CloudflareBootstrapTokens, CloudflareConnectorHandoff, CloudflareHostHandoff, CloudflareMeshCoordinates, CloudflareRealtimeCoordinates } from '@forgezero/agent/cloudflare-bootstrap';
+import type { CloudflareBootstrapFinalizeRequest, CloudflareBootstrapNodeCoordinates, CloudflareBootstrapOutput, CloudflareBootstrapPhaseRunner, CloudflareBootstrapPlan, CloudflareBootstrapTokens } from '@forgezero/agent/cloudflare-bootstrap';
+import type { CloudflareConnectorHandoff, CloudflareHostHandoff, CloudflareMeshCoordinates, CloudflareRealtimeCoordinates } from '@forgezero/agent/cloudflare-bootstrap';
 ```
 
 <a id="forgezero-agent-cloudflare-edge"></a>
 ## @forgezero/agent/cloudflare-edge
 
-Strict Cloudflare REST operations used by the attended bootstrap controller. Named value imports: configureCloudflareEdge, configureCloudflareRealtimeSecrets, discoverCloudflareBootstrapResources, ensureCloudflareMeshConnector, ensureCloudflarePrivateDatabaseRoute, ensureCloudflarePrivateRoute, ensureCloudflareTunnel, ensureCloudflareWarpDatabaseInclude, ensureCloudflareWarpNetworkIncludes, removeCloudflarePrivateDatabaseRoute, removeCloudflarePrivateRoute, removeCloudflareWarpDatabaseInclude, verifyCloudflareWorkerDurableObjects. Named type imports: CloudflareBootstrapDiscovery, CloudflareDurableObjectNamespace, CloudflareEdgeConfig, CloudflareMeshConnector, CloudflarePrivateRoute, CloudflarePrivateRouteConfig, CloudflareTunnel, CloudflareWarpIncludeConfig. Import only the names used by this file.
+Strict Cloudflare REST operations used by the attended bootstrap controller. Named value imports: configureCloudflareEdge, configureCloudflareRealtimeSecrets, discoverCloudflareBootstrapResources, ensureCloudflareMeshConnector, ensureCloudflarePrivateDatabaseRoute, ensureCloudflarePrivateRoute, ensureCloudflareTunnel, ensureCloudflareWarpDatabaseInclude, ensureCloudflareWarpNetworkIncludes, removeCloudflarePrivateDatabaseRoute, removeCloudflarePrivateRoute, removeCloudflareWarpDatabaseInclude, retrieveCloudflareConnectorTokens, verifyCloudflareWorkerDurableObjects. Named type imports: CloudflareBootstrapDiscovery, CloudflareDurableObjectNamespace, CloudflareEdgeConfig, CloudflareMeshConnector, CloudflarePrivateRoute, CloudflarePrivateRouteConfig, CloudflareTunnel, CloudflareWarpIncludeConfig. Import only the names used by this file.
 
 ```text
 import { configureCloudflareEdge, configureCloudflareRealtimeSecrets, discoverCloudflareBootstrapResources, ensureCloudflareMeshConnector, ensureCloudflarePrivateDatabaseRoute, ensureCloudflarePrivateRoute } from '@forgezero/agent/cloudflare-edge';
 import { ensureCloudflareTunnel, ensureCloudflareWarpDatabaseInclude, ensureCloudflareWarpNetworkIncludes, removeCloudflarePrivateDatabaseRoute, removeCloudflarePrivateRoute, removeCloudflareWarpDatabaseInclude } from '@forgezero/agent/cloudflare-edge';
-import { verifyCloudflareWorkerDurableObjects } from '@forgezero/agent/cloudflare-edge';
+import { retrieveCloudflareConnectorTokens, verifyCloudflareWorkerDurableObjects } from '@forgezero/agent/cloudflare-edge';
 import type { CloudflareBootstrapDiscovery, CloudflareDurableObjectNamespace, CloudflareEdgeConfig, CloudflareMeshConnector, CloudflarePrivateRoute, CloudflarePrivateRouteConfig } from '@forgezero/agent/cloudflare-edge';
 import type { CloudflareTunnel, CloudflareWarpIncludeConfig } from '@forgezero/agent/cloudflare-edge';
 ```

package/dist/agent-heartbeat.js

@@ -749,7 +749,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.58";
+var VERSION3 = "0.1.59";
 
 // src/agent-heartbeat.ts
 var unquote = (value) => value.replace(/^['"]|['"]$/g, "");

package/dist/bootstrap.d.ts

@@ -34,14 +34,10 @@ export interface PlatformBootstrapConfig {
         address?: string;
         master?: string;
         coordinators: string[];
-        /** Owner/root-only file containing the shared 64-hex bootstrap code. */
-        bootstrapSecretFile: string;
     };
     /** Explicit authority source; never inferred from a node number. */
     enrolment: {
         source: PlatformEnrolmentSource;
-        /** Required only for an API-issued post-genesis capability. */
-        tokenFile?: string;
     };
     runtime: {
         environment: PlatformSharedEnvironment;
@@ -51,10 +47,6 @@ export interface PlatformBootstrapConfig {
         greenPort: number;
         healthPath: string;
         keepReleases: number;
-        credentialFiles?: {
-            emailSecret?: string;
-            backupS3Secret?: string;
-        };
     };
     firewall: {
         enabled: boolean;
@@ -79,7 +71,6 @@ export interface EnrolledComputeActivationConfig {
     telemetryEndpoint: string;
     /** Same Vault-first, same-name systemd fallback contract as platform deploys. */
     deploymentCredentials?: Record<string, string>;
-    enrolTokenFile: string;
     repository?: string;
     branch?: string;
     profile?: string;
@@ -100,6 +91,24 @@ export interface EnrolledComputeActivationConfig {
     };
 }
 export type BootstrapConfig = PlatformBootstrapConfig | EnrolledComputeActivationConfig;
+/** Ephemeral values accepted only from hidden input and sealed on the target. */
+export interface PlatformBootstrapSecrets {
+    clusterBootstrapCode: string;
+    emailSecret: string;
+    /** Required only for an API-issued post-genesis capability. */
+    enrolmentToken?: string;
+    backupS3Secret?: string;
+    cloudflareTunnelToken?: string;
+    cloudflareApiToken?: string;
+}
+export interface EnrolledComputeBootstrapSecrets {
+    enrolmentToken: string;
+    cloudflareTunnelToken?: string;
+    cloudflareApiToken?: string;
+}
+export type BootstrapSecrets = PlatformBootstrapSecrets | EnrolledComputeBootstrapSecrets;
+export declare function validateEnrolledComputeBootstrapSecrets(config: EnrolledComputeActivationConfig, input: unknown): EnrolledComputeBootstrapSecrets;
+export declare function validatePlatformBootstrapSecrets(config: PlatformBootstrapConfig, input: unknown): PlatformBootstrapSecrets;
 export interface BootstrapStep {
     id: string;
     label: string;
@@ -167,7 +176,7 @@ export interface BootstrapHost {
     }): Promise<SoftwareCommandResult>;
     sleep?(milliseconds: number): Promise<void>;
     ensureSoftware(requirements: readonly SoftwareRequirement[]): Promise<unknown>;
-    installAgent(config: BootstrapConfig, enrolTokenSourcePath?: string): Promise<ProvisionPlan>;
+    installAgent(config: BootstrapConfig): Promise<ProvisionPlan>;
 }
 export declare const BOOTSTRAP_STATE_PATH = "/var/lib/forgezero/bootstrap.json";
 export declare function validateBootstrapConfig(value: BootstrapConfig): BootstrapConfig;
@@ -182,6 +191,8 @@ export declare function bootstrapIdentityDigest(config: BootstrapConfig): string
  */
 export declare function preparePlatformBootstrap(input: PlatformBootstrapConfig, host?: BootstrapHost): Promise<PlatformBootstrapPreparation>;
 export declare function bootstrapStatus(host?: BootstrapHost): Promise<BootstrapStatus>;
-export declare function applyBootstrap(input: BootstrapConfig, host?: BootstrapHost): Promise<BootstrapResult>;
+export declare function applyBootstrap(input: BootstrapConfig, host?: BootstrapHost, secrets?: BootstrapSecrets, dependencies?: {
+    fetcher?: typeof fetch;
+}): Promise<BootstrapResult>;
 export declare function readBootstrapConfig(path: string): BootstrapConfig;
 export declare function localBootstrapHost(): BootstrapHost;