@serve.zone/cli 33.9.0 → 33.10.0

package/dist_ts_cliclient/classes.cliclient.d.ts

@@ -9,5 +9,10 @@ export declare class CliClient {
      * the caller's to wipe; the API client seals its own copy and never logs or keeps it.
      */
     bootstrapGateway(targetArg: plugins.servezoneApi.IExternalGatewayBootstrapTarget, bootstrapTokenArg: Uint8Array): Promise<void>;
+    /**
+     * Writes one cluster relay's bearer to a new 0600 file and prints what describes the file:
+     * the cluster, the generation, the size, the SHA-256 and the audit receipt, never the bearer.
+     */
+    exportRelayAuthorization(requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest, outputPathArg: string): Promise<void>;
     getGatewayStatus(): Promise<void>;
 }

package/dist_ts_cliclient/classes.cliclient.js

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import { CloudlyApiClient } from '@serve.zone/api';
+import { exportRelayAuthorizationToFile } from './relayauthorization.js';
 export class CliClient {
     constructor(cloudlyApiClientArg) {
         this.cloudlyApiClient = cloudlyApiClientArg;
@@ -19,9 +20,17 @@ export class CliClient {
         });
         console.log(JSON.stringify(state, null, 2));
     }
+    /**
+     * Writes one cluster relay's bearer to a new 0600 file and prints what describes the file:
+     * the cluster, the generation, the size, the SHA-256 and the audit receipt, never the bearer.
+     */
+    async exportRelayAuthorization(requestArg, outputPathArg) {
+        const output = await exportRelayAuthorizationToFile(this.cloudlyApiClient, requestArg, outputPathArg);
+        console.log(JSON.stringify({ ok: true, command: 'relay export-authorization', ...output }));
+    }
     async getGatewayStatus() {
         const { state } = await this.cloudlyApiClient.settings.getExternalGatewayEnrollmentState();
         console.log(JSON.stringify(state, null, 2));
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jbGljbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY2xhc3Nlcy5jbGljbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFFbkQsTUFBTSxPQUFPLFNBQVM7SUFHcEIsWUFBWSxtQkFBcUM7UUFDL0MsSUFBSSxDQUFDLGdCQUFnQixHQUFHLG1CQUFtQixDQUFDO0lBQzlDLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLGdCQUFnQixDQUMzQixTQUErRCxFQUMvRCxpQkFBNkI7UUFFN0IsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxrQ0FBa0MsQ0FBQztZQUN4RixNQUFNLEVBQUUsU0FBUztZQUNqQixjQUFjLEVBQUUsaUJBQWlCO1NBQ2xDLENBQUMsQ0FBQztRQUNILE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQkFBZ0I7UUFDM0IsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxpQ0FBaUMsRUFBRSxDQUFDO1FBQzNGLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUMsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jbGljbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY2xhc3Nlcy5jbGljbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDbkQsT0FBTyxFQUFFLDhCQUE4QixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFFekUsTUFBTSxPQUFPLFNBQVM7SUFHcEIsWUFBWSxtQkFBcUM7UUFDL0MsSUFBSSxDQUFDLGdCQUFnQixHQUFHLG1CQUFtQixDQUFDO0lBQzlDLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLGdCQUFnQixDQUMzQixTQUErRCxFQUMvRCxpQkFBNkI7UUFFN0IsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxrQ0FBa0MsQ0FBQztZQUN4RixNQUFNLEVBQUUsU0FBUztZQUNqQixjQUFjLEVBQUUsaUJBQWlCO1NBQ2xDLENBQUMsQ0FBQztRQUNILE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyx3QkFBd0IsQ0FDbkMsVUFBb0YsRUFDcEYsYUFBcUI7UUFFckIsTUFBTSxNQUFNLEdBQUcsTUFBTSw4QkFBOEIsQ0FDakQsSUFBSSxDQUFDLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUNwRCxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSw0QkFBNEIsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUM5RixDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQjtRQUMzQixNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLGlDQUFpQyxFQUFFLENBQUM7UUFDM0YsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5QyxDQUFDO0NBQ0YifQ==

package/dist_ts_cliclient/commands.d.ts

@@ -1,4 +1,4 @@
-import type * as plugins from './plugins.js';
+import * as plugins from './plugins.js';
 /** What one invocation of the CLI asks for, parsed before anything is read or connected. */
 export type TCliCommand = 
 /** No arguments: the default action, listing the clusters. */
@@ -9,6 +9,11 @@ export type TCliCommand =
 } | {
     kind: 'gateway-bootstrap';
     target: plugins.servezoneApi.IExternalGatewayBootstrapTarget;
+} | {
+    kind: 'relay-export-authorization';
+    request: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest;
+    /** A normalized absolute path in a private directory; the file must not exist yet. */
+    outputPath: string;
 };
 export declare const cliUsage: string;
 /**

package/dist_ts_cliclient/commands.js

@@ -1,9 +1,12 @@
+import * as plugins from './plugins.js';
 export const cliUsage = [
     'Usage:',
     '  servezone',
     '  servezone gateway status',
     '  servezone gateway bootstrap --gateway-url <https url> --client-id <id>',
     '    The dcrouter admin token is read from stdin, never from arguments or the environment.',
+    '  servezone relay export-authorization --cluster-id <id> --expected-generation <n> --output <absolute path>',
+    '    Writes the relay bearer to a new 0600 file in a directory only you can write; never to stdout.',
 ].join('\n');
 /**
  * An invocation the CLI does not run. It never quotes what it was given, because an argument may
@@ -37,6 +40,8 @@ export const parseCliCommand = (argsArg) => {
     if (argsArg.length === 0)
         return { kind: 'clusters' };
     const [group, action, ...rest] = argsArg;
+    if (group === 'relay')
+        return parseRelayCommand(action, rest);
     requireUsage(group === 'gateway');
     if (action === 'status') {
         requireUsage(rest.length === 0);
@@ -49,4 +54,19 @@ export const parseCliCommand = (argsArg) => {
         target: { gatewayUrl: options['--gateway-url'], gatewayClientId: options['--client-id'] },
     };
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbWFuZHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY29tbWFuZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBU0EsTUFBTSxDQUFDLE1BQU0sUUFBUSxHQUFHO0lBQ3RCLFFBQVE7SUFDUixhQUFhO0lBQ2IsNEJBQTRCO0lBQzVCLDBFQUEwRTtJQUMxRSwyRkFBMkY7Q0FDNUYsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFFYjs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLEtBQUs7SUFDdEM7UUFDRSxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEIsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7SUFDOUIsQ0FBQztDQUNGO0FBRUQsU0FBUyxZQUFZLENBQUMsWUFBcUI7SUFDekMsSUFBSSxDQUFDLFlBQVk7UUFBRSxNQUFNLElBQUksYUFBYSxFQUFFLENBQUM7QUFDL0MsQ0FBQztBQUVELG1GQUFtRjtBQUNuRixNQUFNLFlBQVksR0FBRyxDQUNuQixPQUEwQixFQUMxQixRQUEwQixFQUNILEVBQUU7SUFDekIsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFDMUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNyRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sRUFBRSxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDakMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNqRixZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDMUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQTBCLENBQUM7QUFDOUQsQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLE9BQTBCLEVBQWUsRUFBRTtJQUN6RSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDdEQsTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUM7SUFDekMsWUFBWSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNsQyxJQUFJLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN4QixZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNoQyxPQUFPLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUNELFlBQVksQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDckMsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLElBQUksRUFBRSxDQUFDLGVBQWUsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLE9BQU87UUFDTCxJQUFJLEVBQUUsbUJBQW1CO1FBQ3pCLE1BQU0sRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsZUFBZSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsRUFBRTtLQUMxRixDQUFDO0FBQ0osQ0FBQyxDQUFDIn0=
+/** `relay export-authorization`: the cluster, the exact generation and a normalized absolute output. */
+const parseRelayCommand = (actionArg, restArg) => {
+    requireUsage(actionArg === 'export-authorization');
+    const options = parseOptions(restArg, ['--cluster-id', '--expected-generation', '--output']);
+    const generation = options['--expected-generation'];
+    requireUsage(/^[1-9][0-9]{0,15}$/.test(generation) && Number.isSafeInteger(Number(generation)));
+    const outputPath = options['--output'];
+    requireUsage(plugins.path.isAbsolute(outputPath) && plugins.path.normalize(outputPath) === outputPath
+        && !outputPath.endsWith(plugins.path.sep));
+    return {
+        kind: 'relay-export-authorization',
+        request: { clusterId: options['--cluster-id'], expectedGeneration: Number(generation) },
+        outputPath,
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbWFuZHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY29tbWFuZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFleEMsTUFBTSxDQUFDLE1BQU0sUUFBUSxHQUFHO0lBQ3RCLFFBQVE7SUFDUixhQUFhO0lBQ2IsNEJBQTRCO0lBQzVCLDBFQUEwRTtJQUMxRSwyRkFBMkY7SUFDM0YsNkdBQTZHO0lBQzdHLG9HQUFvRztDQUNyRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUViOzs7R0FHRztBQUNILE1BQU0sT0FBTyxhQUFjLFNBQVEsS0FBSztJQUN0QztRQUNFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNoQixJQUFJLENBQUMsSUFBSSxHQUFHLGVBQWUsQ0FBQztJQUM5QixDQUFDO0NBQ0Y7QUFFRCxTQUFTLFlBQVksQ0FBQyxZQUFxQjtJQUN6QyxJQUFJLENBQUMsWUFBWTtRQUFFLE1BQU0sSUFBSSxhQUFhLEVBQUUsQ0FBQztBQUMvQyxDQUFDO0FBRUQsbUZBQW1GO0FBQ25GLE1BQU0sWUFBWSxHQUFHLENBQ25CLE9BQTBCLEVBQzFCLFFBQTBCLEVBQ0gsRUFBRTtJQUN6QixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztJQUMxQyxZQUFZLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3JELEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxPQUFPLENBQUMsTUFBTSxFQUFFLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUN2RCxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNqQyxZQUFZLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUMxRCxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztJQUMzQixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBMEIsQ0FBQztBQUM5RCxDQUFDLENBQUM7QUFFRixrRkFBa0Y7QUFDbEYsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsT0FBMEIsRUFBZSxFQUFFO0lBQ3pFLElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsQ0FBQztJQUN0RCxNQUFNLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLE9BQU8sQ0FBQztJQUN6QyxJQUFJLEtBQUssS0FBSyxPQUFPO1FBQUUsT0FBTyxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUQsWUFBWSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNsQyxJQUFJLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN4QixZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNoQyxPQUFPLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUNELFlBQVksQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDckMsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLElBQUksRUFBRSxDQUFDLGVBQWUsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLE9BQU87UUFDTCxJQUFJLEVBQUUsbUJBQW1CO1FBQ3pCLE1BQU0sRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsZUFBZSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsRUFBRTtLQUMxRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsd0dBQXdHO0FBQ3hHLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxTQUE2QixFQUFFLE9BQTBCLEVBQWUsRUFBRTtJQUNuRyxZQUFZLENBQUMsU0FBUyxLQUFLLHNCQUFzQixDQUFDLENBQUM7SUFDbkQsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSx1QkFBdUIsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO0lBQ3BELFlBQVksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hHLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2QyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLEtBQUssVUFBVTtXQUNoRyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdDLE9BQU87UUFDTCxJQUFJLEVBQUUsNEJBQTRCO1FBQ2xDLE9BQU8sRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFO1FBQ3ZGLFVBQVU7S0FDWCxDQUFDO0FBQ0osQ0FBQyxDQUFDIn0=

package/dist_ts_cliclient/index.d.ts

@@ -1,3 +1,4 @@
 export { CliUsageError, parseCliCommand, type TCliCommand } from './commands.js';
+export { RelayAuthorizationOutputError, exportRelayAuthorizationToFile, requirePrivateOutputDirectory, writeRelayAuthorization, type IRelayAuthorizationOutput, type TRelayAuthorizationOutputRefusal, } from './relayauthorization.js';
 export { BootstrapTokenInputError, readBootstrapTokenInput, type TBootstrapTokenInputRefusal, } from './tokeninput.js';
 export declare const runCli: () => Promise<void>;

package/dist_ts_cliclient/index.js

@@ -2,7 +2,9 @@ import * as plugins from './plugins.js';
 import { CliClient } from './classes.cliclient.js';
 import { parseCliCommand } from './commands.js';
 import { readBootstrapTokenInput } from './tokeninput.js';
+import { requirePrivateOutputDirectory } from './relayauthorization.js';
 export { CliUsageError, parseCliCommand } from './commands.js';
+export { RelayAuthorizationOutputError, exportRelayAuthorizationToFile, requirePrivateOutputDirectory, writeRelayAuthorization, } from './relayauthorization.js';
 export { BootstrapTokenInputError, readBootstrapTokenInput, } from './tokeninput.js';
 export const runCli = async () => {
     // The command and the token are settled before anything connects, so a wrong invocation or a
@@ -13,6 +15,10 @@ export const runCli = async () => {
         command = parsed.kind === 'gateway-bootstrap'
             ? { ...parsed, bootstrapToken: await readBootstrapTokenInput(process.stdin) }
             : parsed;
+        // An output the bearer could not be written to fetches no bearer and records no export.
+        if (command.kind === 'relay-export-authorization') {
+            await requirePrivateOutputDirectory(command.outputPath);
+        }
     }
     catch (error) {
         console.error(error.message);
@@ -31,12 +37,15 @@ export const runCli = async () => {
             if (command.kind === 'gateway-bootstrap') {
                 await cliClient.bootstrapGateway(command.target, command.bootstrapToken);
             }
+            else if (command.kind === 'relay-export-authorization') {
+                await cliClient.exportRelayAuthorization(command.request, command.outputPath);
+            }
             else {
                 await cliClient.getGatewayStatus();
             }
         }
         catch (error) {
-            // Cloudly answers a refusal by name; it never carries the token.
+            // Cloudly answers a refusal by name; it never carries a token or a bearer.
             console.error(error.message);
             process.exitCode = 1;
         }
@@ -82,4 +91,4 @@ const connect = async () => {
     }
     return apiClient;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sRUFBRSxlQUFlLEVBQW9CLE1BQU0sZUFBZSxDQUFDO0FBQ2xFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRTFELE9BQU8sRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFvQixNQUFNLGVBQWUsQ0FBQztBQUNqRixPQUFPLEVBQ0wsd0JBQXdCLEVBQ3hCLHVCQUF1QixHQUV4QixNQUFNLGlCQUFpQixDQUFDO0FBT3pCLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxLQUFLLElBQUksRUFBRTtJQUMvQiw2RkFBNkY7SUFDN0YsZ0VBQWdFO0lBQ2hFLElBQUksT0FBdUIsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RCxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksS0FBSyxtQkFBbUI7WUFDM0MsQ0FBQyxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsY0FBYyxFQUFFLE1BQU0sdUJBQXVCLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFO1lBQzdFLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDYixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUUsS0FBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLEVBQUUsQ0FBQztRQUNsQyxNQUFNLFNBQVMsR0FBRyxJQUFJLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDaEMseUVBQXlFO1lBQ3pFLE1BQU0sU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3pDLE1BQU0sU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzNFLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3JDLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLGlFQUFpRTtZQUNqRSxPQUFPLENBQUMsS0FBSyxDQUFFLEtBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN4QyxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztRQUN2QixDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixDQUFDO0lBQ0gsQ0FBQztZQUFTLENBQUM7UUFDVCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssbUJBQW1CO1lBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLE9BQU8sR0FBRyxLQUFLLElBQW9ELEVBQUU7SUFDekUsNkZBQTZGO0lBQzdGLDhGQUE4RjtJQUM5RixnR0FBZ0c7SUFDaEcsMEZBQTBGO0lBQzFGLE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUN2RSxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNsRSxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQztJQUN4QyxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO0lBQzlDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUM7SUFFOUMsTUFBTSxTQUFTLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGdCQUFnQixDQUFDO1FBQzFELFVBQVUsRUFBRSxLQUFLO1FBQ2pCLFVBQVU7S0FDWCxDQUFDLENBQUM7SUFDSCxNQUFNLFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUV4QixJQUFJLENBQUM7UUFDSCxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxTQUFTLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLENBQUM7YUFBTSxJQUFJLFFBQVEsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFNBQVMsQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbkUsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLENBQUMsR0FBRyxDQUFDLGtGQUFrRixDQUFDLENBQUM7UUFDbEcsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDdkIsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sRUFBRSxlQUFlLEVBQW9CLE1BQU0sZUFBZSxDQUFDO0FBQ2xFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzFELE9BQU8sRUFBRSw2QkFBNkIsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXhFLE9BQU8sRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFvQixNQUFNLGVBQWUsQ0FBQztBQUNqRixPQUFPLEVBQ0wsNkJBQTZCLEVBQzdCLDhCQUE4QixFQUM5Qiw2QkFBNkIsRUFDN0IsdUJBQXVCLEdBR3hCLE1BQU0seUJBQXlCLENBQUM7QUFDakMsT0FBTyxFQUNMLHdCQUF3QixFQUN4Qix1QkFBdUIsR0FFeEIsTUFBTSxpQkFBaUIsQ0FBQztBQU96QixNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUcsS0FBSyxJQUFJLEVBQUU7SUFDL0IsNkZBQTZGO0lBQzdGLGdFQUFnRTtJQUNoRSxJQUFJLE9BQXVCLENBQUM7SUFDNUIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsZUFBZSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdEQsT0FBTyxHQUFHLE1BQU0sQ0FBQyxJQUFJLEtBQUssbUJBQW1CO1lBQzNDLENBQUMsQ0FBQyxFQUFFLEdBQUcsTUFBTSxFQUFFLGNBQWMsRUFBRSxNQUFNLHVCQUF1QixDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRTtZQUM3RSxDQUFDLENBQUMsTUFBTSxDQUFDO1FBQ1gsd0ZBQXdGO1FBQ3hGLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyw0QkFBNEIsRUFBRSxDQUFDO1lBQ2xELE1BQU0sNkJBQTZCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzFELENBQUM7SUFDSCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUUsS0FBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLEVBQUUsQ0FBQztRQUNsQyxNQUFNLFNBQVMsR0FBRyxJQUFJLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDaEMseUVBQXlFO1lBQ3pFLE1BQU0sU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3pDLE1BQU0sU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzNFLENBQUM7aUJBQU0sSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLDRCQUE0QixFQUFFLENBQUM7Z0JBQ3pELE1BQU0sU0FBUyxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2hGLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3JDLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLDJFQUEyRTtZQUMzRSxPQUFPLENBQUMsS0FBSyxDQUFFLEtBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN4QyxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztRQUN2QixDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixDQUFDO0lBQ0gsQ0FBQztZQUFTLENBQUM7UUFDVCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssbUJBQW1CO1lBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLE9BQU8sR0FBRyxLQUFLLElBQW9ELEVBQUU7SUFDekUsNkZBQTZGO0lBQzdGLDhGQUE4RjtJQUM5RixnR0FBZ0c7SUFDaEcsMEZBQTBGO0lBQzFGLE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUN2RSxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNsRSxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQztJQUN4QyxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO0lBQzlDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUM7SUFFOUMsTUFBTSxTQUFTLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGdCQUFnQixDQUFDO1FBQzFELFVBQVUsRUFBRSxLQUFLO1FBQ2pCLFVBQVU7S0FDWCxDQUFDLENBQUM7SUFDSCxNQUFNLFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUV4QixJQUFJLENBQUM7UUFDSCxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxTQUFTLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLENBQUM7YUFBTSxJQUFJLFFBQVEsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFNBQVMsQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbkUsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLENBQUMsR0FBRyxDQUFDLGtGQUFrRixDQUFDLENBQUM7UUFDbEcsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDdkIsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyxDQUFDIn0=

package/dist_ts_cliclient/plugins.d.ts

@@ -1,6 +1,11 @@
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+export { crypto, fs, path, };
 import * as servezoneApi from '@serve.zone/api';
 import * as servezoneInterfaces from '@serve.zone/interfaces';
 export { servezoneApi, servezoneInterfaces };
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
-export { projectinfo, qenv, };
+import * as smartfs from '@push.rocks/smartfs';
+export { projectinfo, qenv, smartfs, };

package/dist_ts_cliclient/plugins.js

@@ -1,3 +1,8 @@
+// node native scope
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+export { crypto, fs, path, };
 // @serve.zone scope
 import * as servezoneApi from '@serve.zone/api';
 import * as servezoneInterfaces from '@serve.zone/interfaces';
@@ -5,5 +10,6 @@ export { servezoneApi, servezoneInterfaces };
 // @push.rocks scope
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
-export { projectinfo, qenv, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2NsaWNsaWVudC9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLGlCQUFpQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUU5RCxPQUFPLEVBQ0wsWUFBWSxFQUNaLG1CQUFtQixFQUNwQixDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLElBQUksTUFBTSxrQkFBa0IsQ0FBQztBQUV6QyxPQUFPLEVBQ0wsV0FBVyxFQUNYLElBQUksR0FDTCxDQUFBIn0=
+import * as smartfs from '@push.rocks/smartfs';
+export { projectinfo, qenv, smartfs, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2NsaWNsaWVudC9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUN0QyxPQUFPLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBRWxDLE9BQU8sRUFDTCxNQUFNLEVBQ04sRUFBRSxFQUNGLElBQUksR0FDTCxDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0saUJBQWlCLENBQUM7QUFDaEQsT0FBTyxLQUFLLG1CQUFtQixNQUFNLHdCQUF3QixDQUFDO0FBRTlELE9BQU8sRUFDTCxZQUFZLEVBQ1osbUJBQW1CLEVBQ3BCLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLGtCQUFrQixDQUFDO0FBQ3pDLE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFFL0MsT0FBTyxFQUNMLFdBQVcsRUFDWCxJQUFJLEVBQ0osT0FBTyxHQUNSLENBQUEifQ==

package/dist_ts_cliclient/relayauthorization.d.ts

@@ -0,0 +1,48 @@
+import * as plugins from './plugins.js';
+/** Why the relay bearer was not written, named without quoting the bearer. */
+export type TRelayAuthorizationOutputRefusal = 
+/** The output's directory does not exist, or a component of its path is not a directory. */
+'output-directory-missing'
+/**
+ * The output's directory is not a private directory of the caller: it is reached through a
+ * symbolic link, owned by another user, or writable by its group or by other users.
+ */
+ | 'output-directory-not-private'
+/** Something already exists at the output path; it is left untouched. */
+ | 'output-exists';
+export declare class RelayAuthorizationOutputError extends Error {
+    readonly refusal: TRelayAuthorizationOutputRefusal;
+    constructor(refusal: TRelayAuthorizationOutputRefusal);
+}
+/** What the CLI prints about the file it wrote: metadata only, never a byte of the bearer. */
+export interface IRelayAuthorizationOutput {
+    clusterId: string;
+    generation: number;
+    outputPath: string;
+    byteLength: number;
+    /** Hex SHA-256 of the file's bytes, as `sha256sum` prints it for the same file. */
+    sha256: string;
+    /** The audit receipt Cloudly recorded for this export. */
+    receiptId: string;
+}
+/**
+ * Refuses an output whose directory is not a private directory of the caller, or that exists.
+ *
+ * Exclusive creation guards only the file's own name, so the directory is checked here: its path
+ * resolves to itself (no symbolic link anywhere on it), it is a directory owned by the caller,
+ * and neither its group nor other users can write it. Checked before Cloudly is asked, so a bad
+ * output fetches no bearer and writes no audit receipt.
+ */
+export declare const requirePrivateOutputDirectory: (outputPathArg: string) => Promise<void>;
+/**
+ * Writes the bearer as a new file, mode 0600 whatever the umask, whole or not at all.
+ *
+ * The write is exclusive and atomic: an existing entry at the path is never replaced or
+ * followed, and the bytes go to a private temporary file that is linked into place.
+ */
+export declare const writeRelayAuthorization: (outputPathArg: string, bearerArg: Uint8Array) => Promise<void>;
+/**
+ * Fetches one cluster relay's bearer through the API client and writes it to the operator's
+ * file, answering only what describes the file.
+ */
+export declare const exportRelayAuthorizationToFile: (apiClientArg: plugins.servezoneApi.CloudlyApiClient, requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest, outputPathArg: string) => Promise<IRelayAuthorizationOutput>;

package/dist_ts_cliclient/relayauthorization.js

@@ -0,0 +1,95 @@
+import * as plugins from './plugins.js';
+export class RelayAuthorizationOutputError extends Error {
+    constructor(refusal) {
+        super(`The relay bearer was not written: ${refusal}.`);
+        this.refusal = refusal;
+        this.name = 'RelayAuthorizationOutputError';
+    }
+}
+const errorCodeOf = (errorArg) => errorArg instanceof Error && 'code' in errorArg && typeof errorArg.code === 'string'
+    ? errorArg.code : undefined;
+/** A directory that is not there, or not reachable as one, is the operator's to create. */
+const refuseMissingDirectory = (errorArg) => {
+    const code = errorCodeOf(errorArg);
+    if (code === 'ENOENT' || code === 'ENOTDIR') {
+        throw new RelayAuthorizationOutputError('output-directory-missing');
+    }
+    throw errorArg;
+};
+/**
+ * Refuses an output whose directory is not a private directory of the caller, or that exists.
+ *
+ * Exclusive creation guards only the file's own name, so the directory is checked here: its path
+ * resolves to itself (no symbolic link anywhere on it), it is a directory owned by the caller,
+ * and neither its group nor other users can write it. Checked before Cloudly is asked, so a bad
+ * output fetches no bearer and writes no audit receipt.
+ */
+export const requirePrivateOutputDirectory = async (outputPathArg) => {
+    const directory = plugins.path.dirname(outputPathArg);
+    const stats = await plugins.fs.lstat(directory).catch(refuseMissingDirectory);
+    const resolved = await plugins.fs.realpath(directory).catch(refuseMissingDirectory);
+    // A symbolic link anywhere on the path is a directory someone else could redirect.
+    if (resolved !== directory)
+        throw new RelayAuthorizationOutputError('output-directory-not-private');
+    if (!stats.isDirectory())
+        throw new RelayAuthorizationOutputError('output-directory-missing');
+    if (stats.uid !== process.getuid?.() || (stats.mode & 0o022) !== 0) {
+        throw new RelayAuthorizationOutputError('output-directory-not-private');
+    }
+    try {
+        await plugins.fs.lstat(outputPathArg);
+    }
+    catch (error) {
+        if (errorCodeOf(error) === 'ENOENT')
+            return;
+        throw error;
+    }
+    throw new RelayAuthorizationOutputError('output-exists');
+};
+/**
+ * Writes the bearer as a new file, mode 0600 whatever the umask, whole or not at all.
+ *
+ * The write is exclusive and atomic: an existing entry at the path is never replaced or
+ * followed, and the bytes go to a private temporary file that is linked into place.
+ */
+export const writeRelayAuthorization = async (outputPathArg, bearerArg) => {
+    await requirePrivateOutputDirectory(outputPathArg);
+    const smartFs = new plugins.smartfs.SmartFs(new plugins.smartfs.SmartFsProviderNode());
+    const bytes = Buffer.from(bearerArg);
+    try {
+        await smartFs.file(outputPathArg).mode(0o600).exclusive().atomic().write(bytes);
+    }
+    catch (error) {
+        if (error instanceof plugins.smartfs.SmartFsExclusiveWriteError) {
+            throw new RelayAuthorizationOutputError(error.code === 'EEXIST' ? 'output-exists' : 'output-directory-missing');
+        }
+        throw error;
+    }
+    finally {
+        bytes.fill(0);
+    }
+};
+/**
+ * Fetches one cluster relay's bearer through the API client and writes it to the operator's
+ * file, answering only what describes the file.
+ */
+export const exportRelayAuthorizationToFile = async (apiClientArg, requestArg, outputPathArg) => {
+    await requirePrivateOutputDirectory(outputPathArg);
+    const exported = await apiClientArg.cluster.exportClusterRelayAuthorization(requestArg);
+    const bearer = new TextEncoder().encode(exported.authorization);
+    try {
+        await writeRelayAuthorization(outputPathArg, bearer);
+        return {
+            clusterId: exported.credential.clusterId,
+            generation: exported.credential.generation,
+            outputPath: outputPathArg,
+            byteLength: bearer.byteLength,
+            sha256: plugins.crypto.createHash('sha256').update(bearer).digest('hex'),
+            receiptId: exported.receipt.id,
+        };
+    }
+    finally {
+        bearer.fill(0);
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVsYXlhdXRob3JpemF0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfY2xpY2xpZW50L3JlbGF5YXV0aG9yaXphdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQWN4QyxNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQUN0RCxZQUE0QixPQUF5QztRQUNuRSxLQUFLLENBQUMscUNBQXFDLE9BQU8sR0FBRyxDQUFDLENBQUM7UUFEN0IsWUFBTyxHQUFQLE9BQU8sQ0FBa0M7UUFFbkUsSUFBSSxDQUFDLElBQUksR0FBRywrQkFBK0IsQ0FBQztJQUM5QyxDQUFDO0NBQ0Y7QUFjRCxNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDNUQsUUFBUSxZQUFZLEtBQUssSUFBSSxNQUFNLElBQUksUUFBUSxJQUFJLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRO0lBQ2xGLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFaEMsMkZBQTJGO0FBQzNGLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUFTLEVBQUU7SUFDMUQsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLElBQUksSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDNUMsTUFBTSxJQUFJLDZCQUE2QixDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE1BQU0sUUFBUSxDQUFDO0FBQ2pCLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxLQUFLLEVBQUUsYUFBcUIsRUFBaUIsRUFBRTtJQUMxRixNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUN0RCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUM7SUFDcEYsbUZBQW1GO0lBQ25GLElBQUksUUFBUSxLQUFLLFNBQVM7UUFBRSxNQUFNLElBQUksNkJBQTZCLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUNwRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRTtRQUFFLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO0lBQzlGLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDbkUsTUFBTSxJQUFJLDZCQUE2QixDQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLFdBQVcsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRO1lBQUUsT0FBTztRQUM1QyxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7SUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsZUFBZSxDQUFDLENBQUM7QUFDM0QsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxLQUFLLEVBQzFDLGFBQXFCLEVBQ3JCLFNBQXFCLEVBQ04sRUFBRTtJQUNqQixNQUFNLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQixFQUFFLENBQUMsQ0FBQztJQUN2RixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sSUFBSSw2QkFBNkIsQ0FDckMsS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUM1RSxDQUFDO1FBQ0QsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO1lBQVMsQ0FBQztRQUNULEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsWUFBbUQsRUFDbkQsVUFBb0YsRUFDcEYsYUFBcUIsRUFDZSxFQUFFO0lBQ3RDLE1BQU0sNkJBQTZCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDbkQsTUFBTSxRQUFRLEdBQUcsTUFBTSxZQUFZLENBQUMsT0FBTyxDQUFDLCtCQUErQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNoRSxJQUFJLENBQUM7UUFDSCxNQUFNLHVCQUF1QixDQUFDLGFBQWEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNyRCxPQUFPO1lBQ0wsU0FBUyxFQUFFLFFBQVEsQ0FBQyxVQUFVLENBQUMsU0FBUztZQUN4QyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxVQUFVO1lBQzFDLFVBQVUsRUFBRSxhQUFhO1lBQ3pCLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtZQUM3QixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7WUFDeEUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtTQUMvQixDQUFDO0lBQ0osQ0FBQztZQUFTLENBQUM7UUFDVCxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pCLENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/package.json

@@ -38,7 +38,7 @@
     "security"
   ],
   "name": "@serve.zone/cli",
-  "version": "33.9.0",
+  "version": "33.10.0",
   "type": "module",
   "description": "A comprehensive tool for managing containerized applications across multiple cloud providers using Docker Swarmkit, featuring web, CLI, and API interfaces.",
   "main": "./dist_ts_cliclient/index.js",
@@ -50,10 +50,11 @@
     }
   },
   "dependencies": {
-    "@serve.zone/api": "32.1.0",
-    "@serve.zone/interfaces": "32.40.0",
+    "@serve.zone/api": "32.4.0",
+    "@serve.zone/interfaces": "32.41.0",
     "@push.rocks/projectinfo": "^5.1.0",
     "@push.rocks/qenv": "^8.1.0",
+    "@push.rocks/smartfs": "^1.8.0",
     "@push.rocks/smartcli": "^4.3.0"
   },
   "bin": {

package/readme.md

@@ -16,6 +16,7 @@ This submodule is intentionally small in the current codebase:
 - Creates a `CliClient` wrapper around the API client.
 - Without arguments, calls `CliClient.getClusters()` and prints the result.
 - Runs `servezone gateway bootstrap` and `servezone gateway status` for Cloudly's dcrouter gateway enrollment.
+- Runs `servezone relay export-authorization` to write a cluster relay's bearer to a private file.
 
 It is not currently a full command tree for services, secrets, deployments, logs, profiles, or shell completion. Those flows should be implemented against `@serve.zone/api` before documenting them as CLI commands.
 
@@ -73,6 +74,23 @@ servezone gateway status
 
 Revoke the admin token at dcrouter once `gateway status` reads `ready`.
 
+## Relay Bearer Export
+
+`relay export-authorization` hands a cluster relay's bearer to the operator who deploys that relay, without any access to Cloudly's process. It needs an administrator who signed in within the last five minutes.
+
+```sh
+install -d -m 0700 /root/relay-export
+CLOUDLY_URL=https://cloudly.example.com \
+CLOUDLY_USERNAME=admin CLOUDLY_PASSWORD=change-me \
+servezone relay export-authorization --cluster-id <clusterId> --expected-generation <n> \
+  --output /root/relay-export/relay-authorization
+```
+
+- `--expected-generation` is the exact generation `getClusterRelayCredential` answered (a positive integer without leading zeros); Cloudly refuses any other one by name (`relay-credential-generation-mismatch`), so a rotation that committed in between is never exported by accident.
+- `--output` must be a normalized absolute path. Its directory must exist, resolve to itself (no symbolic link on its path), be owned by you and be writable by neither its group nor other users, and nothing may exist at the path yet. Otherwise the command refuses (`output-directory-missing`, `output-directory-not-private`, `output-exists`) before it asks Cloudly, so no bearer is fetched and no audit receipt is written.
+- The bearer is fetched with `@serve.zone/api` (`cluster.exportClusterRelayAuthorization`, which checks the answer against the request) and written with `@push.rocks/smartfs` as a new file, mode `0600` whatever the umask, exclusive and atomic: the whole bearer or no file, never over an existing entry and never through a symbolic link at the path.
+- It is never written to stdout. stdout carries one JSON line of metadata: `clusterId`, `generation`, `outputPath`, `byteLength`, `sha256` (what `sha256sum` prints for the file) and `receiptId`, the audit receipt Cloudly recorded. A refusal is printed to stderr with exit code 1 and never carries the bearer.
+
 ## Programmatic Use
 
 The published submodule exports the `runCli()` entry point. For automation, most callers should use `@serve.zone/api` directly; the internal `CliClient` currently wraps `CloudlyApiClient` only to run the default cluster-list action:
@@ -98,9 +116,10 @@ await cli.getClusters();
 | Path | Purpose |
 | --- | --- |
 | `index.ts` | Runtime entry point for the published CLI. |
-| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()` and `getGatewayStatus()`. |
+| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()`, `getGatewayStatus()` and `exportRelayAuthorization()`. |
 | `commands.ts` | Parses the argument vector into one command, refusing anything else as usage. |
 | `tokeninput.ts` | Reads the dcrouter admin token from stdin. |
+| `relayauthorization.ts` | Checks the private output directory and writes a cluster relay's bearer as a new 0600 file. |
 | `plugins.ts` | Centralized imports for the submodule. |
 | `tspublish.json` | Published package name, dependencies, `servezone` bin metadata, and `useBase`, which takes the registries from the release's npm target. |
 

package/ts_cliclient/classes.cliclient.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import { CloudlyApiClient } from '@serve.zone/api';
+import { exportRelayAuthorizationToFile } from './relayauthorization.js';
 
 export class CliClient {
   public cloudlyApiClient: CloudlyApiClient;
@@ -28,6 +29,19 @@ export class CliClient {
     console.log(JSON.stringify(state, null, 2));
   }
 
+  /**
+   * Writes one cluster relay's bearer to a new 0600 file and prints what describes the file:
+   * the cluster, the generation, the size, the SHA-256 and the audit receipt, never the bearer.
+   */
+  public async exportRelayAuthorization(
+    requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest,
+    outputPathArg: string,
+  ) {
+    const output = await exportRelayAuthorizationToFile(
+      this.cloudlyApiClient, requestArg, outputPathArg);
+    console.log(JSON.stringify({ ok: true, command: 'relay export-authorization', ...output }));
+  }
+
   public async getGatewayStatus() {
     const { state } = await this.cloudlyApiClient.settings.getExternalGatewayEnrollmentState();
     console.log(JSON.stringify(state, null, 2));

package/ts_cliclient/commands.ts

@@ -1,11 +1,17 @@
-import type * as plugins from './plugins.js';
+import * as plugins from './plugins.js';
 
 /** What one invocation of the CLI asks for, parsed before anything is read or connected. */
 export type TCliCommand =
   /** No arguments: the default action, listing the clusters. */
   | { kind: 'clusters' }
   | { kind: 'gateway-status' }
-  | { kind: 'gateway-bootstrap'; target: plugins.servezoneApi.IExternalGatewayBootstrapTarget };
+  | { kind: 'gateway-bootstrap'; target: plugins.servezoneApi.IExternalGatewayBootstrapTarget }
+  | {
+    kind: 'relay-export-authorization';
+    request: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest;
+    /** A normalized absolute path in a private directory; the file must not exist yet. */
+    outputPath: string;
+  };
 
 export const cliUsage = [
   'Usage:',
@@ -13,6 +19,8 @@ export const cliUsage = [
   '  servezone gateway status',
   '  servezone gateway bootstrap --gateway-url <https url> --client-id <id>',
   '    The dcrouter admin token is read from stdin, never from arguments or the environment.',
+  '  servezone relay export-authorization --cluster-id <id> --expected-generation <n> --output <absolute path>',
+  '    Writes the relay bearer to a new 0600 file in a directory only you can write; never to stdout.',
 ].join('\n');
 
 /**
@@ -51,6 +59,7 @@ const parseOptions = <TName extends string>(
 export const parseCliCommand = (argsArg: readonly string[]): TCliCommand => {
   if (argsArg.length === 0) return { kind: 'clusters' };
   const [group, action, ...rest] = argsArg;
+  if (group === 'relay') return parseRelayCommand(action, rest);
   requireUsage(group === 'gateway');
   if (action === 'status') {
     requireUsage(rest.length === 0);
@@ -63,3 +72,19 @@ export const parseCliCommand = (argsArg: readonly string[]): TCliCommand => {
     target: { gatewayUrl: options['--gateway-url'], gatewayClientId: options['--client-id'] },
   };
 };
+
+/** `relay export-authorization`: the cluster, the exact generation and a normalized absolute output. */
+const parseRelayCommand = (actionArg: string | undefined, restArg: readonly string[]): TCliCommand => {
+  requireUsage(actionArg === 'export-authorization');
+  const options = parseOptions(restArg, ['--cluster-id', '--expected-generation', '--output']);
+  const generation = options['--expected-generation'];
+  requireUsage(/^[1-9][0-9]{0,15}$/.test(generation) && Number.isSafeInteger(Number(generation)));
+  const outputPath = options['--output'];
+  requireUsage(plugins.path.isAbsolute(outputPath) && plugins.path.normalize(outputPath) === outputPath
+    && !outputPath.endsWith(plugins.path.sep));
+  return {
+    kind: 'relay-export-authorization',
+    request: { clusterId: options['--cluster-id'], expectedGeneration: Number(generation) },
+    outputPath,
+  };
+};

package/ts_cliclient/index.ts

@@ -2,8 +2,17 @@ import * as plugins from './plugins.js';
 import { CliClient } from './classes.cliclient.js';
 import { parseCliCommand, type TCliCommand } from './commands.js';
 import { readBootstrapTokenInput } from './tokeninput.js';
+import { requirePrivateOutputDirectory } from './relayauthorization.js';
 
 export { CliUsageError, parseCliCommand, type TCliCommand } from './commands.js';
+export {
+  RelayAuthorizationOutputError,
+  exportRelayAuthorizationToFile,
+  requirePrivateOutputDirectory,
+  writeRelayAuthorization,
+  type IRelayAuthorizationOutput,
+  type TRelayAuthorizationOutputRefusal,
+} from './relayauthorization.js';
 export {
   BootstrapTokenInputError,
   readBootstrapTokenInput,
@@ -24,6 +33,10 @@ export const runCli = async () => {
     command = parsed.kind === 'gateway-bootstrap'
       ? { ...parsed, bootstrapToken: await readBootstrapTokenInput(process.stdin) }
       : parsed;
+    // An output the bearer could not be written to fetches no bearer and records no export.
+    if (command.kind === 'relay-export-authorization') {
+      await requirePrivateOutputDirectory(command.outputPath);
+    }
   } catch (error) {
     console.error((error as Error).message);
     process.exitCode = 1;
@@ -41,11 +54,13 @@ export const runCli = async () => {
     try {
       if (command.kind === 'gateway-bootstrap') {
         await cliClient.bootstrapGateway(command.target, command.bootstrapToken);
+      } else if (command.kind === 'relay-export-authorization') {
+        await cliClient.exportRelayAuthorization(command.request, command.outputPath);
       } else {
         await cliClient.getGatewayStatus();
       }
     } catch (error) {
-      // Cloudly answers a refusal by name; it never carries the token.
+      // Cloudly answers a refusal by name; it never carries a token or a bearer.
       console.error((error as Error).message);
       process.exitCode = 1;
     } finally {

package/ts_cliclient/plugins.ts

@@ -1,3 +1,14 @@
+// node native scope
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+
+export {
+  crypto,
+  fs,
+  path,
+}
+
 // @serve.zone scope
 import * as servezoneApi from '@serve.zone/api';  
 import * as servezoneInterfaces from '@serve.zone/interfaces';
@@ -10,8 +21,10 @@ export {
 // @push.rocks scope
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
+import * as smartfs from '@push.rocks/smartfs';
 
 export {
   projectinfo,
   qenv,
+  smartfs,
 }

package/ts_cliclient/readme.md

@@ -16,6 +16,7 @@ This submodule is intentionally small in the current codebase:
 - Creates a `CliClient` wrapper around the API client.
 - Without arguments, calls `CliClient.getClusters()` and prints the result.
 - Runs `servezone gateway bootstrap` and `servezone gateway status` for Cloudly's dcrouter gateway enrollment.
+- Runs `servezone relay export-authorization` to write a cluster relay's bearer to a private file.
 
 It is not currently a full command tree for services, secrets, deployments, logs, profiles, or shell completion. Those flows should be implemented against `@serve.zone/api` before documenting them as CLI commands.
 
@@ -73,6 +74,23 @@ servezone gateway status
 
 Revoke the admin token at dcrouter once `gateway status` reads `ready`.
 
+## Relay Bearer Export
+
+`relay export-authorization` hands a cluster relay's bearer to the operator who deploys that relay, without any access to Cloudly's process. It needs an administrator who signed in within the last five minutes.
+
+```sh
+install -d -m 0700 /root/relay-export
+CLOUDLY_URL=https://cloudly.example.com \
+CLOUDLY_USERNAME=admin CLOUDLY_PASSWORD=change-me \
+servezone relay export-authorization --cluster-id <clusterId> --expected-generation <n> \
+  --output /root/relay-export/relay-authorization
+```
+
+- `--expected-generation` is the exact generation `getClusterRelayCredential` answered (a positive integer without leading zeros); Cloudly refuses any other one by name (`relay-credential-generation-mismatch`), so a rotation that committed in between is never exported by accident.
+- `--output` must be a normalized absolute path. Its directory must exist, resolve to itself (no symbolic link on its path), be owned by you and be writable by neither its group nor other users, and nothing may exist at the path yet. Otherwise the command refuses (`output-directory-missing`, `output-directory-not-private`, `output-exists`) before it asks Cloudly, so no bearer is fetched and no audit receipt is written.
+- The bearer is fetched with `@serve.zone/api` (`cluster.exportClusterRelayAuthorization`, which checks the answer against the request) and written with `@push.rocks/smartfs` as a new file, mode `0600` whatever the umask, exclusive and atomic: the whole bearer or no file, never over an existing entry and never through a symbolic link at the path.
+- It is never written to stdout. stdout carries one JSON line of metadata: `clusterId`, `generation`, `outputPath`, `byteLength`, `sha256` (what `sha256sum` prints for the file) and `receiptId`, the audit receipt Cloudly recorded. A refusal is printed to stderr with exit code 1 and never carries the bearer.
+
 ## Programmatic Use
 
 The published submodule exports the `runCli()` entry point. For automation, most callers should use `@serve.zone/api` directly; the internal `CliClient` currently wraps `CloudlyApiClient` only to run the default cluster-list action:
@@ -98,9 +116,10 @@ await cli.getClusters();
 | Path | Purpose |
 | --- | --- |
 | `index.ts` | Runtime entry point for the published CLI. |
-| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()` and `getGatewayStatus()`. |
+| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()`, `getGatewayStatus()` and `exportRelayAuthorization()`. |
 | `commands.ts` | Parses the argument vector into one command, refusing anything else as usage. |
 | `tokeninput.ts` | Reads the dcrouter admin token from stdin. |
+| `relayauthorization.ts` | Checks the private output directory and writes a cluster relay's bearer as a new 0600 file. |
 | `plugins.ts` | Centralized imports for the submodule. |
 | `tspublish.json` | Published package name, dependencies, `servezone` bin metadata, and `useBase`, which takes the registries from the release's npm target. |
 

package/ts_cliclient/relayauthorization.ts

@@ -0,0 +1,125 @@
+import * as plugins from './plugins.js';
+
+/** Why the relay bearer was not written, named without quoting the bearer. */
+export type TRelayAuthorizationOutputRefusal =
+  /** The output's directory does not exist, or a component of its path is not a directory. */
+  | 'output-directory-missing'
+  /**
+   * The output's directory is not a private directory of the caller: it is reached through a
+   * symbolic link, owned by another user, or writable by its group or by other users.
+   */
+  | 'output-directory-not-private'
+  /** Something already exists at the output path; it is left untouched. */
+  | 'output-exists';
+
+export class RelayAuthorizationOutputError extends Error {
+  constructor(public readonly refusal: TRelayAuthorizationOutputRefusal) {
+    super(`The relay bearer was not written: ${refusal}.`);
+    this.name = 'RelayAuthorizationOutputError';
+  }
+}
+
+/** What the CLI prints about the file it wrote: metadata only, never a byte of the bearer. */
+export interface IRelayAuthorizationOutput {
+  clusterId: string;
+  generation: number;
+  outputPath: string;
+  byteLength: number;
+  /** Hex SHA-256 of the file's bytes, as `sha256sum` prints it for the same file. */
+  sha256: string;
+  /** The audit receipt Cloudly recorded for this export. */
+  receiptId: string;
+}
+
+const errorCodeOf = (errorArg: unknown): string | undefined =>
+  errorArg instanceof Error && 'code' in errorArg && typeof errorArg.code === 'string'
+    ? errorArg.code : undefined;
+
+/** A directory that is not there, or not reachable as one, is the operator's to create. */
+const refuseMissingDirectory = (errorArg: unknown): never => {
+  const code = errorCodeOf(errorArg);
+  if (code === 'ENOENT' || code === 'ENOTDIR') {
+    throw new RelayAuthorizationOutputError('output-directory-missing');
+  }
+  throw errorArg;
+};
+
+/**
+ * Refuses an output whose directory is not a private directory of the caller, or that exists.
+ *
+ * Exclusive creation guards only the file's own name, so the directory is checked here: its path
+ * resolves to itself (no symbolic link anywhere on it), it is a directory owned by the caller,
+ * and neither its group nor other users can write it. Checked before Cloudly is asked, so a bad
+ * output fetches no bearer and writes no audit receipt.
+ */
+export const requirePrivateOutputDirectory = async (outputPathArg: string): Promise<void> => {
+  const directory = plugins.path.dirname(outputPathArg);
+  const stats = await plugins.fs.lstat(directory).catch(refuseMissingDirectory);
+  const resolved = await plugins.fs.realpath(directory).catch(refuseMissingDirectory);
+  // A symbolic link anywhere on the path is a directory someone else could redirect.
+  if (resolved !== directory) throw new RelayAuthorizationOutputError('output-directory-not-private');
+  if (!stats.isDirectory()) throw new RelayAuthorizationOutputError('output-directory-missing');
+  if (stats.uid !== process.getuid?.() || (stats.mode & 0o022) !== 0) {
+    throw new RelayAuthorizationOutputError('output-directory-not-private');
+  }
+  try {
+    await plugins.fs.lstat(outputPathArg);
+  } catch (error) {
+    if (errorCodeOf(error) === 'ENOENT') return;
+    throw error;
+  }
+  throw new RelayAuthorizationOutputError('output-exists');
+};
+
+/**
+ * Writes the bearer as a new file, mode 0600 whatever the umask, whole or not at all.
+ *
+ * The write is exclusive and atomic: an existing entry at the path is never replaced or
+ * followed, and the bytes go to a private temporary file that is linked into place.
+ */
+export const writeRelayAuthorization = async (
+  outputPathArg: string,
+  bearerArg: Uint8Array,
+): Promise<void> => {
+  await requirePrivateOutputDirectory(outputPathArg);
+  const smartFs = new plugins.smartfs.SmartFs(new plugins.smartfs.SmartFsProviderNode());
+  const bytes = Buffer.from(bearerArg);
+  try {
+    await smartFs.file(outputPathArg).mode(0o600).exclusive().atomic().write(bytes);
+  } catch (error) {
+    if (error instanceof plugins.smartfs.SmartFsExclusiveWriteError) {
+      throw new RelayAuthorizationOutputError(
+        error.code === 'EEXIST' ? 'output-exists' : 'output-directory-missing');
+    }
+    throw error;
+  } finally {
+    bytes.fill(0);
+  }
+};
+
+/**
+ * Fetches one cluster relay's bearer through the API client and writes it to the operator's
+ * file, answering only what describes the file.
+ */
+export const exportRelayAuthorizationToFile = async (
+  apiClientArg: plugins.servezoneApi.CloudlyApiClient,
+  requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest,
+  outputPathArg: string,
+): Promise<IRelayAuthorizationOutput> => {
+  await requirePrivateOutputDirectory(outputPathArg);
+  const exported = await apiClientArg.cluster.exportClusterRelayAuthorization(requestArg);
+  const bearer = new TextEncoder().encode(exported.authorization);
+  try {
+    await writeRelayAuthorization(outputPathArg, bearer);
+    return {
+      clusterId: exported.credential.clusterId,
+      generation: exported.credential.generation,
+      outputPath: outputPathArg,
+      byteLength: bearer.byteLength,
+      sha256: plugins.crypto.createHash('sha256').update(bearer).digest('hex'),
+      receiptId: exported.receipt.id,
+    };
+  } finally {
+    bearer.fill(0);
+  }
+};