@forgezero/agent 0.1.58 → 0.1.60

package/dist/cli/cloudflare-bootstrap.d.ts

@@ -1,11 +1,10 @@
-import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokenFiles } from '../cloudflare-bootstrap';
+import { finalizeCloudflareBootstrapAcceptance, verifyCloudflareBootstrapAcceptance, type AttendedCloudflareBootstrapRequest, type CloudflareBootstrapEvidence, type CloudflareBootstrapAcceptanceEvidence, type CloudflareBootstrapFinalizeRequest, type CloudflareBootstrapPhaseRunner, type CloudflareBootstrapTokens } from '../cloudflare-bootstrap';
 import { discoverCloudflareBootstrapResources, type CloudflareBootstrapDiscovery } from '../cloudflare-edge';
 export interface CloudflareBootstrapCommandConfig {
     format: 1;
     kind: 'forgezero-cloudflare-bootstrap-request';
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
-    tokenFiles: CloudflareBootstrapTokenFiles;
 }
 export interface CloudflareBootstrapCommandDependencies {
     run?: CloudflareBootstrapPhaseRunner;
@@ -15,7 +14,7 @@ export declare function discoverCloudflareBootstrapCommandResources(input: {
     zoneName: string;
     kvNamespaceTitle: string;
     workerScriptName?: string;
-    tokenFiles: CloudflareBootstrapTokenFiles;
+    tokens: CloudflareBootstrapTokens;
 }, dependencies?: {
     fetcher?: typeof fetch;
     discover?: typeof discoverCloudflareBootstrapResources;
@@ -33,14 +32,13 @@ export interface CloudflareBootstrapFinalizeConfig {
 export declare function createCloudflareBootstrapCommandConfig(input: {
     checkpointPath: string;
     coordinates: AttendedCloudflareBootstrapRequest['coordinates'];
-    tokenFiles: CloudflareBootstrapTokenFiles;
 }): CloudflareBootstrapCommandConfig;
 /**
- * Read reviewed non-secret coordinates and token-file paths for the attended
- * operator phase. Raw token values and a persisted mode are not schema fields.
+ * Read reviewed non-secret coordinates for the attended operator phase. Raw
+ * token values and a persisted mode are not schema fields.
  */
 export declare function readCloudflareBootstrapCommandConfig(path: string, mode: 'plan' | 'apply'): AttendedCloudflareBootstrapRequest;
-export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
+export declare function runCloudflareBootstrapCommand(configPath: string, apply: boolean, tokens?: CloudflareBootstrapTokens, dependencies?: CloudflareBootstrapCommandDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function runCloudflareBootstrapVerificationCommand(checkpointPath: string, dependencies?: {
     verify?: typeof verifyCloudflareBootstrapAcceptance;
     write?: (text: string) => void;

package/dist/cloudflare-bootstrap.d.ts

@@ -33,32 +33,18 @@ export interface CloudflareBootstrapCoordinates {
     realtime?: CloudflareRealtimeCoordinates;
     nodes: CloudflareBootstrapNodeCoordinates[];
 }
-export interface CloudflareBootstrapTokenFiles {
-    /** CF_TUNNEL_TOKEN: Tunnel, DNS, Mesh connector/network and device-profile writes. */
-    tunnelTokenFile: string;
-    /** Exact-account Workers KV Storage Write plus existing-Worker Scripts Write. */
-    apiTokenFile: string;
-}
 export interface CloudflareBootstrapTokens {
     tunnelToken: string;
     apiToken: string;
 }
 interface CloudflareBootstrapNodeResource extends CloudflareBootstrapNodeCoordinates {
     tunnelId: string;
-    connectorToken: string;
     mesh?: CloudflareMeshCoordinates & {
         connectorId: string;
-        connectorToken: string;
     };
 }
 interface CloudflareBootstrapResources {
     kvNamespaceId: string;
-    /** Owner-supplied CF_API_TOKEN, sealed into each host handoff. */
-    apiToken: string;
-    realtime?: {
-        publishSecret: string;
-        ticketSecret: string;
-    };
     nodes: CloudflareBootstrapNodeResource[];
 }
 export interface CloudflareBootstrapOutput {
@@ -79,7 +65,7 @@ export interface CloudflareBootstrapOutput {
 export interface CloudflareBootstrapPlan {
     format: 1;
     kind: 'forgezero-cloudflare-bootstrap-plan';
-    mode: 'attended-token-file';
+    mode: 'attended-hidden-input';
     outputFile: string;
     coordinates: CloudflareBootstrapCoordinates;
     operations: readonly string[];
@@ -88,7 +74,7 @@ export interface CloudflareBootstrapPlan {
 export interface AttendedCloudflareBootstrapRequest {
     mode: 'plan' | 'apply';
     coordinates: CloudflareBootstrapCoordinates;
-    tokenFiles?: CloudflareBootstrapTokenFiles;
+    tokens?: CloudflareBootstrapTokens;
     checkpointPath: string;
 }
 /** Secret-free evidence safe to embed in the platform bootstrap journal. */
@@ -128,9 +114,7 @@ export interface CloudflareBootstrapDependencies {
     fetcher?: typeof fetch;
 }
 export type CloudflareBootstrapPhaseRunner = (request: AttendedCloudflareBootstrapRequest) => Promise<CloudflareBootstrapEvidence>;
-/** Read exactly one API token from a non-symlinked, owner-only regular file. */
-export declare function readOwnerApiToken(path: string): Promise<string>;
-export declare function readCloudflareBootstrapTokens(files: CloudflareBootstrapTokenFiles): Promise<CloudflareBootstrapTokens>;
+export declare function validateCloudflareBootstrapTokens(input: unknown): CloudflareBootstrapTokens;
 export declare function validateCloudflareBootstrapCoordinates(input: CloudflareBootstrapCoordinates): CloudflareBootstrapCoordinates;
 export declare function planCloudflareBootstrap(input: CloudflareBootstrapCoordinates, outputPath: string): CloudflareBootstrapPlan;
 export interface CloudflareConnectorHandoff {
@@ -138,10 +122,8 @@ export interface CloudflareConnectorHandoff {
     hostname: string;
     service: string;
     tunnelId: string;
-    connectorToken: string;
     mesh?: {
         connectorId: string;
-        connectorToken: string;
         routes: readonly string[];
     };
 }
@@ -149,30 +131,29 @@ export interface CloudflareHostHandoff extends CloudflareConnectorHandoff {
     accountId: string;
     zoneId: string;
     kvNamespaceId: string;
-    /** CF_API_TOKEN: Workers KV Storage Write plus existing-Worker Scripts Write. */
-    apiToken: string;
-    realtime?: CloudflareRealtimeCoordinates & {
-        publishSecret: string;
-        ticketSecret: string;
-    };
+    realtime?: CloudflareRealtimeCoordinates;
 }
 export declare function cloudflareHostHandoffPath(checkpointPath: string, nodeName: string): string;
 export declare function readCloudflareConnectorHandoff(checkpointPath: string, nodeName: string): Promise<CloudflareConnectorHandoff>;
 export declare function readCloudflareHostHandoff(handoffPath: string, nodeName: string): Promise<CloudflareHostHandoff>;
 export declare function writeOwnerBootstrapOutput(path: string, output: CloudflareBootstrapOutput): Promise<void>;
+export declare const deriveCloudflareRealtimeSecrets: (apiToken: string) => {
+    publishSecret: string;
+    ticketSecret: string;
+};
 /** Attended, resumable Tunnel/DNS/KV handoff bootstrap. */
 export declare function applyCloudflareBootstrap(input: CloudflareBootstrapCoordinates, tokens: CloudflareBootstrapTokens, outputPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapOutput>;
 export declare function runAttendedCloudflareBootstrap(request: AttendedCloudflareBootstrapRequest, dependencies?: CloudflareBootstrapDependencies): Promise<CloudflareBootstrapEvidence>;
 export declare function verifyCloudflareBootstrapAcceptance(checkpointPath: string, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
 /**
- * Read finalized, secret-free Cloudflare acceptance after the capability-bearing
+ * Read finalized, secret-free Cloudflare acceptance after the working
  * checkpoint has been removed. This is the durable input consumed by the fleet
  * rehearsal; it never attempts to reopen the deleted handoff.
  */
 export declare function readCloudflareBootstrapAcceptanceEvidence(acceptancePath: string, expectedNodes?: readonly CloudflareBootstrapAcceptedNode[]): Promise<CloudflareBootstrapAcceptanceEvidence>;
 /**
  * Prove every public node, persist secret-free acceptance evidence, then remove
- * the resumable checkpoint and node handoffs that contain runtime capabilities.
+ * the resumable secret-free checkpoint and node handoffs.
  */
 export declare function finalizeCloudflareBootstrapAcceptance(request: CloudflareBootstrapFinalizeRequest, fetcher?: typeof fetch): Promise<CloudflareBootstrapAcceptanceEvidence>;
 export {};

package/dist/cloudflare-bootstrap.js

@@ -344,18 +344,28 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
   }
   return { tunnel, connectorToken, created };
 }
+async function retrieveCloudflareConnectorTokens(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId) || !/^[0-9a-f-]{36}$/i.test(config.tunnelId) || config.meshConnectorId && !/^[0-9a-f-]{36}$/i.test(config.meshConnectorId)) {
+    throw new Error("Cloudflare connector retrieval coordinates are invalid");
+  }
+  const connectorToken = await cf(config, `/accounts/${config.accountId}/cfd_tunnel/${encodeURIComponent(config.tunnelId)}/token`, {}, fetcher);
+  const meshConnectorToken = config.meshConnectorId ? await cf(config, `/accounts/${config.accountId}/warp_connector/${encodeURIComponent(config.meshConnectorId)}/token`, {}, fetcher) : undefined;
+  for (const value of [connectorToken, meshConnectorToken]) {
+    if (value !== undefined && (!value || value.length > 16384))
+      throw new Error("Cloudflare returned an invalid connector token");
+  }
+  return { connectorToken, ...meshConnectorToken ? { meshConnectorToken } : {} };
+}
 
 // src/cloudflare-bootstrap.ts
 import { constants } from "fs";
-import { randomBytes, randomUUID } from "crypto";
+import { createHmac, randomUUID } from "crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "fs/promises";
 import { dirname, join, resolve } from "path";
 import { isIP as isIP2 } from "net";
 var TOKEN = /^[A-Za-z0-9._-]{40,80}$/;
-var CONNECTOR_TOKEN = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
-var REALTIME_SECRET = /^[A-Za-z0-9_-]{64,128}$/;
 var ownerUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
 async function assertOwnerOnlyHandle(path, handle, maximumBytes) {
   const metadata = await handle.stat();
@@ -389,26 +399,17 @@ async function readOwnerOnlyFile(path, maximumBytes) {
     await handle?.close();
   }
 }
-async function readOwnerApiToken(path) {
-  const token = (await readOwnerOnlyFile(path, 4096)).trim();
-  if (!TOKEN.test(token))
-    throw new Error(`${resolve(path)} must contain exactly one Cloudflare API token`);
-  return token;
-}
-async function readCloudflareBootstrapTokens(files) {
-  const unsupported = Object.keys(files).filter((key) => ![
-    "tunnelTokenFile",
-    "apiTokenFile"
-  ].includes(key));
+function validateCloudflareBootstrapTokens(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input))
+    throw new Error("Cloudflare bootstrap tokens must be an object");
+  const source = input;
+  const unsupported = Object.keys(source).filter((key) => !["tunnelToken", "apiToken"].includes(key));
   if (unsupported.length)
-    throw new Error(`Cloudflare bootstrap token files contain unsupported field ${unsupported[0]}`);
-  if (!files.tunnelTokenFile?.trim() || !files.apiTokenFile?.trim()) {
-    throw new Error("Cloudflare bootstrap requires exactly tunnelTokenFile and apiTokenFile");
-  }
-  const [tunnelToken, apiToken] = await Promise.all([
-    readOwnerApiToken(files.tunnelTokenFile),
-    readOwnerApiToken(files.apiTokenFile)
-  ]);
+    throw new Error(`Cloudflare bootstrap tokens contain unsupported field ${unsupported[0]}`);
+  const tunnelToken = typeof source.tunnelToken === "string" ? source.tunnelToken.trim() : "";
+  const apiToken = typeof source.apiToken === "string" ? source.apiToken.trim() : "";
+  if (!TOKEN.test(tunnelToken) || !TOKEN.test(apiToken))
+    throw new Error("Cloudflare bootstrap requires two valid API tokens");
   if (tunnelToken === apiToken) {
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege tokens");
   }
@@ -584,7 +585,7 @@ function planCloudflareBootstrap(input, outputPath) {
   return {
     format: 1,
     kind: "forgezero-cloudflare-bootstrap-plan",
-    mode: "attended-token-file",
+    mode: "attended-hidden-input",
     outputFile: resolve(outputPath),
     coordinates,
     operations: [
@@ -592,19 +593,19 @@ function planCloudflareBootstrap(input, outputPath) {
       ...coordinates.realtime ? [
         "prove the existing Worker owns a Durable Object namespace and install its publish/ticket secrets with CF_API_TOKEN"
       ] : [],
-      "create or reuse one remotely-managed Tunnel per node and checkpoint every connector token",
+      "create or reuse one remotely-managed Tunnel per node and checkpoint only its non-secret id",
       ...coordinates.nodes.some(({ mesh }) => mesh) ? [
-        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint its registration token",
+        "create or reuse one Mesh/WARP Connector per declared private-network node and checkpoint only its non-secret id",
         "reconcile every unique private CIDR to its Mesh connector and include all declared CIDRs in the dedicated Mesh device profile"
       ] : [],
       "preflight each exact DNS hostname, refuse ambiguous or incompatible records, and update its existing CNAME or create it only when absent",
       "reconcile each Tunnel public-hostname ingress rule to the declared loopback API service",
-      "write one node-specific handoff containing the connector token and owner-supplied KV/Worker runtime token"
+      "write one secret-free node handoff containing only bound Cloudflare ids and public coordinates"
     ],
     secrets: [
-      "API tokens are read only from owner-only files and are never placed in argv or stdout",
-      "CF_TUNNEL_TOKEN is never persisted; cloudflared, Mesh, CF_API_TOKEN and generated realtime capabilities are atomically checkpointed with mode 0600",
-      "the normal API process receives only CF_API_TOKEN and never Tunnel, DNS or Mesh management authority"
+      "API tokens are accepted only from a hidden prompt and are never placed in JSON, files, argv or stdout",
+      "checkpoint and host handoffs contain no connector, management, runtime or realtime secret",
+      "the target Agent retrieves its connector tokens and seals both Vault fallback tokens directly"
     ]
   };
 }
@@ -669,25 +670,15 @@ async function readExistingOutput(path) {
   const resources = output.resources;
   const unsupportedResource = Object.keys(resources).filter((key) => ![
     "kvNamespaceId",
-    "apiToken",
-    "realtime",
     "nodes"
   ].includes(key));
   if (unsupportedResource.length) {
     throw new Error(`${resolve(path)} resources contain unsupported field ${unsupportedResource[0]}`);
   }
   const coordinates = validateCloudflareBootstrapCoordinates(output.coordinates);
-  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !TOKEN.test(String(resources.apiToken ?? "")) || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
+  if (resources.kvNamespaceId !== coordinates.kvNamespaceId || !Array.isArray(resources.nodes) || resources.nodes.length > coordinates.nodes.length) {
     throw new Error(`${resolve(path)} has malformed Cloudflare bootstrap resources`);
   }
-  if (coordinates.realtime) {
-    const realtime = resources.realtime;
-    if (!realtime || !REALTIME_SECRET.test(String(realtime.publishSecret ?? "")) || !REALTIME_SECRET.test(String(realtime.ticketSecret ?? "")) || realtime.publishSecret === realtime.ticketSecret) {
-      throw new Error(`${resolve(path)} has malformed Cloudflare realtime resources`);
-    }
-  } else if (resources.realtime !== undefined) {
-    throw new Error(`${resolve(path)} contains undeclared Cloudflare realtime resources`);
-  }
   const seen = new Set;
   for (const item of resources.nodes) {
     if (!item || typeof item !== "object" || Array.isArray(item)) {
@@ -700,16 +691,15 @@ async function readExistingOutput(path) {
       "service",
       "tunnelName",
       "tunnelId",
-      "connectorToken",
       "mesh"
     ].includes(key));
     const expected = coordinates.nodes.find((candidate) => candidate.nodeName === node.nodeName);
-    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? "")) || !CONNECTOR_TOKEN.test(String(node.connectorToken ?? ""))) {
+    if (unknownNode.length || !expected || seen.has(expected.nodeName) || node.hostname !== expected.hostname || node.service !== expected.service || node.tunnelName !== expected.tunnelName || !UUID.test(String(node.tunnelId ?? ""))) {
       throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare node resource`);
     }
     if (expected.mesh) {
       const mesh = node.mesh;
-      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? "")) || !CONNECTOR_TOKEN.test(String(mesh.connectorToken ?? ""))) {
+      if (!mesh || mesh.connectorName !== expected.mesh.connectorName || JSON.stringify(mesh.routes) !== JSON.stringify(expected.mesh.routes) || mesh.highAvailability !== expected.mesh.highAvailability || !UUID.test(String(mesh.connectorId ?? ""))) {
         throw new Error(`${resolve(path)} has a malformed or unbound Cloudflare Mesh resource`);
       }
     } else if (node.mesh !== undefined) {
@@ -750,7 +740,7 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     throw new Error(`Cloudflare connector handoff has no unique completed node ${normalizedNodeName}`);
   }
   const resource = matches[0];
-  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId) || !CONNECTOR_TOKEN.test(resource.connectorToken)) {
+  if (resource.hostname !== expected.hostname || resource.service !== expected.service || resource.tunnelName !== expected.tunnelName || !UUID.test(resource.tunnelId)) {
     throw new Error(`Cloudflare connector handoff for ${normalizedNodeName} is malformed or incomplete`);
   }
   return {
@@ -758,10 +748,8 @@ async function readCloudflareConnectorHandoff(checkpointPath, nodeName) {
     hostname: resource.hostname,
     service: resource.service,
     tunnelId: resource.tunnelId,
-    connectorToken: resource.connectorToken,
     ...resource.mesh ? { mesh: {
       connectorId: resource.mesh.connectorId,
-      connectorToken: resource.mesh.connectorToken,
       routes: resource.mesh.routes
     } } : {}
   };
@@ -785,11 +773,9 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     "hostname",
     "service",
     "tunnelId",
-    "connectorToken",
     "accountId",
     "zoneId",
     "kvNamespaceId",
-    "apiToken",
     "mesh",
     "realtime"
   ].includes(key));
@@ -800,11 +786,11 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
   try {
     service = normalizeService(output.service ?? "");
   } catch {}
-  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !CONNECTOR_TOKEN.test(output.connectorToken ?? "") || !TOKEN.test(output.apiToken ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
+  if (output.format !== 1 || output.kind !== "forgezero-cloudflare-host-handoff" || output.nodeName !== normalizedNodeName || !HOSTNAME.test(output.hostname ?? "") || !service || !UUID.test(output.tunnelId ?? "") || !/^[a-f0-9]{32}$/i.test(output.accountId ?? "") || !/^[a-f0-9]{32}$/i.test(output.zoneId ?? "") || !/^[a-f0-9]{32}$/i.test(output.kvNamespaceId ?? "")) {
     throw new Error("Cloudflare host handoff is malformed or belongs to another node");
   }
   if (output.mesh !== undefined) {
-    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !CONNECTOR_TOKEN.test(output.mesh.connectorToken) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
+    if (!output.mesh || typeof output.mesh !== "object" || !UUID.test(output.mesh.connectorId) || !Array.isArray(output.mesh.routes) || output.mesh.routes.length < 1 || output.mesh.routes.length > 64 || output.mesh.routes.some((route) => {
       try {
         return privateMeshCidr(route) !== route;
       } catch {
@@ -833,7 +819,7 @@ async function readCloudflareHostHandoff(handoffPath, nodeName) {
     } catch {
       throw new Error("Cloudflare host handoff contains malformed realtime coordinates");
     }
-    if (!REALTIME_SECRET.test(output.realtime.publishSecret) || !REALTIME_SECRET.test(output.realtime.ticketSecret) || output.realtime.publishSecret === output.realtime.ticketSecret || realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
+    if (realtime.workerScriptName !== output.realtime.workerScriptName || realtime.endpoint !== output.realtime.endpoint || realtime.producer !== output.realtime.producer) {
       throw new Error("Cloudflare host handoff contains malformed realtime credentials");
     }
   }
@@ -898,18 +884,12 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
       hostname: node.hostname,
       service: node.service,
       tunnelId: node.tunnelId,
-      connectorToken: node.connectorToken,
       accountId: output.coordinates.accountId,
       zoneId: output.coordinates.zoneId,
       kvNamespaceId: output.resources.kvNamespaceId,
-      apiToken: output.resources.apiToken,
-      ...output.coordinates.realtime && output.resources.realtime ? { realtime: {
-        ...output.coordinates.realtime,
-        ...output.resources.realtime
-      } } : {},
+      ...output.coordinates.realtime ? { realtime: output.coordinates.realtime } : {},
       ...node.mesh ? { mesh: {
         connectorId: node.mesh.connectorId,
-        connectorToken: node.mesh.connectorToken,
         routes: node.mesh.routes
       } } : {}
     };
@@ -917,7 +897,10 @@ async function writeCloudflareHostHandoffs(checkpointPath, output) {
   }
 }
 var sameCoordinates = (left, right) => JSON.stringify(left) === JSON.stringify(right);
-var newRealtimeSecret = () => randomBytes(48).toString("base64url");
+var deriveCloudflareRealtimeSecrets = (apiToken) => ({
+  publishSecret: createHmac("sha512", apiToken).update("forgezero/realtime/publish/v1").digest("base64url"),
+  ticketSecret: createHmac("sha512", apiToken).update("forgezero/realtime/ticket/v1").digest("base64url")
+});
 async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fetch) {
   const coordinates = validateCloudflareBootstrapCoordinates(input);
   const absoluteOutput = resolve(outputPath);
@@ -935,10 +918,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     throw new Error("CF_TUNNEL_TOKEN and CF_API_TOKEN must be distinct least-privilege capabilities");
   }
   await preflightCloudflareKvRuntime(coordinates, apiToken, fetcher);
-  const realtime = coordinates.realtime ? existing?.resources.realtime ?? {
-    publishSecret: newRealtimeSecret(),
-    ticketSecret: newRealtimeSecret()
-  } : undefined;
+  const realtime = coordinates.realtime ? deriveCloudflareRealtimeSecrets(apiToken) : undefined;
   if (coordinates.realtime && realtime) {
     await verifyCloudflareWorkerDurableObjects({
       accountId: coordinates.accountId,
@@ -953,8 +933,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        realtime,
         nodes: existing?.resources.nodes ?? []
       }
     });
@@ -973,7 +951,7 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     let resource;
     let created = false;
     if (checkpointed) {
-      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId) || !CONNECTOR_TOKEN.test(checkpointed.connectorToken)) {
+      if (checkpointed.hostname !== node.hostname || checkpointed.service !== node.service || checkpointed.tunnelName !== node.tunnelName || !UUID.test(checkpointed.tunnelId)) {
         throw new Error(`checkpointed Cloudflare node ${node.nodeName} is malformed`);
       }
       resource = checkpointed;
@@ -994,15 +972,13 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
         }, fetcher);
         mesh = {
           ...node.mesh,
-          connectorId: ensured.connector.id,
-          connectorToken: ensured.connectorToken
+          connectorId: ensured.connector.id
         };
       }
       const { mesh: _declaredMesh, ...publicNode } = node;
       resource = {
         ...publicNode,
         tunnelId: tunnel.tunnel.id,
-        connectorToken: tunnel.connectorToken,
         ...mesh ? { mesh } : {}
       };
     }
@@ -1016,8 +992,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
       coordinates,
       resources: {
         kvNamespaceId: coordinates.kvNamespaceId,
-        apiToken,
-        ...realtime ? { realtime } : {},
         nodes: [...nodeResources]
       }
     });
@@ -1061,8 +1035,6 @@ async function applyCloudflareBootstrap(input, tokens, outputPath, fetcher = fet
     coordinates,
     resources: {
       kvNamespaceId: coordinates.kvNamespaceId,
-      apiToken,
-      ...realtime ? { realtime } : {},
       nodes: nodeResources
     },
     created: {
@@ -1084,10 +1056,10 @@ async function runAttendedCloudflareBootstrap(request, dependencies = {}) {
       nodes: plan.coordinates.nodes.map(({ nodeName, hostname }) => ({ nodeName, hostname }))
     };
   }
-  if (!request.tokenFiles) {
-    throw new Error("Cloudflare apply requires exactly two owner-only token file paths");
+  if (!request.tokens) {
+    throw new Error("Cloudflare apply requires exactly two attended API tokens");
   }
-  const tokens = await readCloudflareBootstrapTokens(request.tokenFiles);
+  const tokens = validateCloudflareBootstrapTokens(request.tokens);
   const output = await applyCloudflareBootstrap(plan.coordinates, tokens, plan.outputFile, dependencies.fetcher ?? fetch);
   return {
     format: 1,
@@ -1239,15 +1211,15 @@ async function finalizeCloudflareBootstrapAcceptance(request, fetcher = fetch) {
 export {
   writeOwnerBootstrapOutput,
   verifyCloudflareBootstrapAcceptance,
+  validateCloudflareBootstrapTokens,
   validateCloudflareBootstrapCoordinates,
   runAttendedCloudflareBootstrap,
-  readOwnerApiToken,
   readCloudflareHostHandoff,
   readCloudflareConnectorHandoff,
-  readCloudflareBootstrapTokens,
   readCloudflareBootstrapAcceptanceEvidence,
   planCloudflareBootstrap,
   finalizeCloudflareBootstrapAcceptance,
+  deriveCloudflareRealtimeSecrets,
   cloudflareHostHandoffPath,
   applyCloudflareBootstrap
 };

package/dist/cloudflare-edge.d.ts

@@ -184,4 +184,14 @@ export declare function ensureCloudflareTunnel(config: {
     connectorToken: string;
     created: boolean;
 }>;
+/** Retrieve node-scoped connector capabilities only in the target Agent process. */
+export declare function retrieveCloudflareConnectorTokens(config: {
+    accountId: string;
+    tunnelId: string;
+    meshConnectorId?: string;
+    apiToken: string;
+}, fetcher?: typeof fetch): Promise<{
+    connectorToken: string;
+    meshConnectorToken?: string;
+}>;
 export {};

package/dist/cloudflare-edge.js

@@ -344,8 +344,21 @@ async function ensureCloudflareTunnel(config, fetcher = fetch) {
   }
   return { tunnel, connectorToken, created };
 }
+async function retrieveCloudflareConnectorTokens(config, fetcher = fetch) {
+  if (!/^[a-f0-9]{32}$/i.test(config.accountId) || !/^[0-9a-f-]{36}$/i.test(config.tunnelId) || config.meshConnectorId && !/^[0-9a-f-]{36}$/i.test(config.meshConnectorId)) {
+    throw new Error("Cloudflare connector retrieval coordinates are invalid");
+  }
+  const connectorToken = await cf(config, `/accounts/${config.accountId}/cfd_tunnel/${encodeURIComponent(config.tunnelId)}/token`, {}, fetcher);
+  const meshConnectorToken = config.meshConnectorId ? await cf(config, `/accounts/${config.accountId}/warp_connector/${encodeURIComponent(config.meshConnectorId)}/token`, {}, fetcher) : undefined;
+  for (const value of [connectorToken, meshConnectorToken]) {
+    if (value !== undefined && (!value || value.length > 16384))
+      throw new Error("Cloudflare returned an invalid connector token");
+  }
+  return { connectorToken, ...meshConnectorToken ? { meshConnectorToken } : {} };
+}
 export {
   verifyCloudflareWorkerDurableObjects,
+  retrieveCloudflareConnectorTokens,
   removeCloudflareWarpDatabaseInclude,
   removeCloudflarePrivateRoute,
   removeCloudflarePrivateDatabaseRoute,

package/dist/credential-schema.d.ts

@@ -1,8 +1,8 @@
 /**
  * One credential policy for every place the Agent can run.
  *
- * Operator credentials are attended input files and are never installed as a
- * runtime source. Physical-metal credentials are fixed host identities loaded
+ * Operator credentials are hidden attended input and are never persisted as a
+ * plaintext source. Physical-metal credentials are fixed host identities loaded
  * only by systemd. Enrolled platform and tenant computes read their assigned
  * project/environment Vault replica first and may use only an explicitly
  * installed, same-name systemd credential while that replica cannot answer.
@@ -34,13 +34,13 @@ export declare const CLOUDFLARE_CREDENTIAL_NAMES: {
 export declare const CLOUDFLARE_CREDENTIAL_SCHEMA: {
     readonly CF_TUNNEL_TOKEN: {
         readonly permissions: readonly ["Account:Cloudflare Tunnel Write", "Account:Cloudflare One Connector: WARP Write", "Account:Cloudflare One Networks Write", "Account:Zero Trust Write", "Zone:DNS Write"];
-        readonly platformBootstrap: "attended-file";
-        readonly platformRuntime: "vault";
+        readonly platformBootstrap: "hidden-prompt-to-systemd";
+        readonly platformRuntime: "vault-then-systemd";
         readonly tenantControl: "vault";
     };
     readonly CF_API_TOKEN: {
         readonly permissions: readonly ["Account:Workers KV Storage Write", "Account:Workers Scripts Write"];
-        readonly platformBootstrap: "attended-file";
+        readonly platformBootstrap: "hidden-prompt-to-systemd";
         readonly platformRuntime: "vault-then-systemd";
         readonly tenantControl: "vault";
     };
@@ -67,22 +67,22 @@ export declare const AGENT_CREDENTIAL_POLICY: {
     readonly operator: {
         readonly vault: false;
         readonly systemdFallback: false;
-        readonly attendedFile: true;
+        readonly hiddenInput: true;
     };
     readonly metal: {
         readonly vault: false;
         readonly systemdFallback: true;
-        readonly attendedFile: false;
+        readonly hiddenInput: false;
     };
     readonly 'platform-compute': {
         readonly vault: true;
         readonly systemdFallback: true;
-        readonly attendedFile: false;
+        readonly hiddenInput: false;
     };
     readonly 'tenant-compute': {
         readonly vault: true;
         readonly systemdFallback: true;
-        readonly attendedFile: false;
+        readonly hiddenInput: false;
     };
 };
 export interface DeploymentCredentialBinding {

package/dist/credential-schema.js

@@ -300,13 +300,13 @@ var CLOUDFLARE_CREDENTIAL_SCHEMA = {
       "Account:Zero Trust Write",
       "Zone:DNS Write"
     ],
-    platformBootstrap: "attended-file",
-    platformRuntime: "vault",
+    platformBootstrap: "hidden-prompt-to-systemd",
+    platformRuntime: "vault-then-systemd",
     tenantControl: "vault"
   },
   CF_API_TOKEN: {
     permissions: ["Account:Workers KV Storage Write", "Account:Workers Scripts Write"],
-    platformBootstrap: "attended-file",
+    platformBootstrap: "hidden-prompt-to-systemd",
     platformRuntime: "vault-then-systemd",
     tenantControl: "vault"
   },
@@ -330,10 +330,10 @@ var CLOUDFLARE_CREDENTIAL_SCHEMA = {
   }
 };
 var AGENT_CREDENTIAL_POLICY = {
-  operator: { vault: false, systemdFallback: false, attendedFile: true },
-  metal: { vault: false, systemdFallback: true, attendedFile: false },
-  "platform-compute": { vault: true, systemdFallback: true, attendedFile: false },
-  "tenant-compute": { vault: true, systemdFallback: true, attendedFile: false }
+  operator: { vault: false, systemdFallback: false, hiddenInput: true },
+  metal: { vault: false, systemdFallback: true, hiddenInput: false },
+  "platform-compute": { vault: true, systemdFallback: true, hiddenInput: false },
+  "tenant-compute": { vault: true, systemdFallback: true, hiddenInput: false }
 };
 var CREDENTIAL_NAME = /^[A-Z_][A-Z0-9_]*$/;
 var SCOPE_PART2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;