@serve.zone/cli 33.9.0 → 33.11.0

package/dist_ts_cliclient/tokeninput.js

@@ -1,26 +1,37 @@
 import * as plugins from './plugins.js';
-export class BootstrapTokenInputError extends Error {
-    constructor(refusal) {
-        super(`The dcrouter admin token on stdin was refused: ${refusal}.`);
+/** A refused token input: which token, and why, never a byte of what was read. */
+export class TokenInputError extends Error {
+    constructor(refusal, subjectArg) {
+        super(`${subjectArg} on stdin was refused: ${refusal}.`);
         this.refusal = refusal;
+        this.name = 'TokenInputError';
+    }
+}
+export class BootstrapTokenInputError extends TokenInputError {
+    constructor(refusalArg) {
+        super(refusalArg, 'The dcrouter admin token');
         this.name = 'BootstrapTokenInputError';
     }
 }
-function refuseUnless(conditionArg, refusalArg) {
-    if (!conditionArg)
-        throw new BootstrapTokenInputError(refusalArg);
+export class CorestoreControlTokenInputError extends TokenInputError {
+    constructor(refusalArg) {
+        super(refusalArg, 'The Corestore control token');
+        this.name = 'CorestoreControlTokenInputError';
+    }
 }
 /**
- * The dcrouter admin token piped into `gateway bootstrap`, as bytes the caller wipes.
+ * A token piped into a command, as bytes the caller wipes.
  *
  * stdin is the only source: an argument would sit in the process list and the shell history, and
  * the environment leaks into child processes. One trailing line break, `\n` or `\r\n`, is what
- * `echo` or a file adds and is not part of the token; everything else must pass the contract's
- * token rule. Every byte read is wiped before this answers, whatever it answers.
+ * `echo` or a file adds and is not part of the token; everything else must pass the token's rule.
+ * Reading stops as soon as stdin carries more than the rule's bound and one line break. Every byte
+ * read is wiped before this answers, whatever it answers.
  */
-export const readBootstrapTokenInput = async (inputArg) => {
-    refuseUnless(inputArg.isTTY !== true, 'token-input-terminal');
-    const maximumBytes = plugins.servezoneInterfaces.data.externalGatewayBootstrapContract.maximumTokenBytes + 2;
+const readTokenInput = async (inputArg, ruleArg) => {
+    if (inputArg.isTTY === true)
+        throw ruleArg.refuse('token-input-terminal');
+    const maximumBytes = ruleArg.maximumTokenBytes + 2;
     const chunks = [];
     let input;
     try {
@@ -28,7 +39,8 @@ export const readBootstrapTokenInput = async (inputArg) => {
         for await (const chunk of inputArg) {
             chunks.push(chunk);
             byteLength += chunk.byteLength;
-            refuseUnless(byteLength <= maximumBytes, 'token-input-oversized');
+            if (byteLength > maximumBytes)
+                throw ruleArg.refuse('token-input-oversized');
         }
         input = Buffer.concat(chunks, byteLength);
         let end = input.byteLength;
@@ -38,7 +50,8 @@ export const readBootstrapTokenInput = async (inputArg) => {
                 end -= 1;
         }
         const token = input.subarray(0, end);
-        refuseUnless(plugins.servezoneInterfaces.data.isExternalGatewayBootstrapToken(token), 'token-input-invalid');
+        if (!ruleArg.isToken(token))
+            throw ruleArg.refuse('token-input-invalid');
         // A copy, because the input and every view of it are wiped below.
         return new Uint8Array(token);
     }
@@ -48,4 +61,37 @@ export const readBootstrapTokenInput = async (inputArg) => {
             chunk.fill(0);
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW5pbnB1dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2NsaWNsaWVudC90b2tlbmlucHV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBV3hDLE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxLQUFLO0lBQ2pELFlBQTRCLE9BQW9DO1FBQzlELEtBQUssQ0FBQyxrREFBa0QsT0FBTyxHQUFHLENBQUMsQ0FBQztRQUQxQyxZQUFPLEdBQVAsT0FBTyxDQUE2QjtRQUU5RCxJQUFJLENBQUMsSUFBSSxHQUFHLDBCQUEwQixDQUFDO0lBQ3pDLENBQUM7Q0FDRjtBQUVELFNBQVMsWUFBWSxDQUFDLFlBQXFCLEVBQUUsVUFBdUM7SUFDbEYsSUFBSSxDQUFDLFlBQVk7UUFBRSxNQUFNLElBQUksd0JBQXdCLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDcEUsQ0FBQztBQUtEOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxLQUFLLEVBQUUsUUFBOEIsRUFBdUIsRUFBRTtJQUNuRyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxJQUFJLEVBQUUsc0JBQXNCLENBQUMsQ0FBQztJQUM5RCxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxDQUFDLGlCQUFpQixHQUFHLENBQUMsQ0FBQztJQUM3RyxNQUFNLE1BQU0sR0FBaUIsRUFBRSxDQUFDO0lBQ2hDLElBQUksS0FBNkIsQ0FBQztJQUNsQyxJQUFJLENBQUM7UUFDSCxJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7UUFDbkIsSUFBSSxLQUFLLEVBQUUsTUFBTSxLQUFLLElBQUksUUFBUSxFQUFFLENBQUM7WUFDbkMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuQixVQUFVLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQztZQUMvQixZQUFZLENBQUMsVUFBVSxJQUFJLFlBQVksRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxLQUFLLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDMUMsSUFBSSxHQUFHLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUMzQixJQUFJLEdBQUcsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUN2QyxHQUFHLElBQUksQ0FBQyxDQUFDO1lBQ1QsSUFBSSxHQUFHLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLEtBQUssSUFBSTtnQkFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNyQyxZQUFZLENBQUMsT0FBTyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxLQUFLLENBQUMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1FBQzdHLGtFQUFrRTtRQUNsRSxPQUFPLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9CLENBQUM7WUFBUyxDQUFDO1FBQ1QsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNmLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTTtZQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztBQUNILENBQUMsQ0FBQyJ9
+/**
+ * The dcrouter admin token piped into `gateway bootstrap`: at most the bootstrap contract's
+ * `maximumTokenBytes` of visible ASCII.
+ */
+export const readBootstrapTokenInput = async (inputArg) => await readTokenInput(inputArg, {
+    maximumTokenBytes: plugins.servezoneInterfaces.data.externalGatewayBootstrapContract.maximumTokenBytes,
+    isToken: (tokenArg) => plugins.servezoneInterfaces.data.isExternalGatewayBootstrapToken(tokenArg),
+    refuse: (refusalArg) => new BootstrapTokenInputError(refusalArg),
+});
+/**
+ * The token as text, exactly as its bytes say: invalid UTF-8 throws, and a leading byte order mark
+ * is kept, so the contract judges and Cloudly receives every character that was piped in.
+ */
+export const decodeCorestoreControlToken = (tokenArg) => new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(tokenArg);
+/**
+ * The Corestore control token piped into `corestore set-control-token`: what the contract's
+ * `isCorestoreControlToken` accepts, so at most `corestoreCredentialRuntimeLimits
+ * .maximumControlTokenBytes` of UTF-8 without whitespace.
+ */
+export const readCorestoreControlTokenInput = async (inputArg) => await readTokenInput(inputArg, {
+    maximumTokenBytes: plugins.servezoneInterfacesRuntime.corestoreCredentialRuntimeLimits.maximumControlTokenBytes,
+    isToken: (tokenArg) => {
+        let token;
+        try {
+            token = decodeCorestoreControlToken(tokenArg);
+        }
+        catch {
+            return false;
+        }
+        return plugins.servezoneInterfacesRuntime.isCorestoreControlToken(token);
+    },
+    refuse: (refusalArg) => new CorestoreControlTokenInputError(refusalArg),
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidG9rZW5pbnB1dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2NsaWNsaWVudC90b2tlbmlucHV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBY3hDLGtGQUFrRjtBQUNsRixNQUFNLE9BQU8sZUFBZ0IsU0FBUSxLQUFLO0lBQ3hDLFlBQTRCLE9BQTJCLEVBQUUsVUFBa0I7UUFDekUsS0FBSyxDQUFDLEdBQUcsVUFBVSwwQkFBMEIsT0FBTyxHQUFHLENBQUMsQ0FBQztRQUQvQixZQUFPLEdBQVAsT0FBTyxDQUFvQjtRQUVyRCxJQUFJLENBQUMsSUFBSSxHQUFHLGlCQUFpQixDQUFDO0lBQ2hDLENBQUM7Q0FDRjtBQUVELE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxlQUFlO0lBQzNELFlBQVksVUFBOEI7UUFDeEMsS0FBSyxDQUFDLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxJQUFJLEdBQUcsMEJBQTBCLENBQUM7SUFDekMsQ0FBQztDQUNGO0FBRUQsTUFBTSxPQUFPLCtCQUFnQyxTQUFRLGVBQWU7SUFDbEUsWUFBWSxVQUE4QjtRQUN4QyxLQUFLLENBQUMsVUFBVSxFQUFFLDZCQUE2QixDQUFDLENBQUM7UUFDakQsSUFBSSxDQUFDLElBQUksR0FBRyxpQ0FBaUMsQ0FBQztJQUNoRCxDQUFDO0NBQ0Y7QUFlRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sY0FBYyxHQUFHLEtBQUssRUFBRSxRQUFxQixFQUFFLE9BQXdCLEVBQXVCLEVBQUU7SUFDcEcsSUFBSSxRQUFRLENBQUMsS0FBSyxLQUFLLElBQUk7UUFBRSxNQUFNLE9BQU8sQ0FBQyxNQUFNLENBQUMsc0JBQXNCLENBQUMsQ0FBQztJQUMxRSxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsaUJBQWlCLEdBQUcsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sTUFBTSxHQUFpQixFQUFFLENBQUM7SUFDaEMsSUFBSSxLQUE2QixDQUFDO0lBQ2xDLElBQUksQ0FBQztRQUNILElBQUksVUFBVSxHQUFHLENBQUMsQ0FBQztRQUNuQixJQUFJLEtBQUssRUFBRSxNQUFNLEtBQUssSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNuQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ25CLFVBQVUsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQy9CLElBQUksVUFBVSxHQUFHLFlBQVk7Z0JBQUUsTUFBTSxPQUFPLENBQUMsTUFBTSxDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMxQyxJQUFJLEdBQUcsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQzNCLElBQUksR0FBRyxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3ZDLEdBQUcsSUFBSSxDQUFDLENBQUM7WUFDVCxJQUFJLEdBQUcsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsS0FBSyxJQUFJO2dCQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3JDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztZQUFFLE1BQU0sT0FBTyxDQUFDLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ3pFLGtFQUFrRTtRQUNsRSxPQUFPLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9CLENBQUM7WUFBUyxDQUFDO1FBQ1QsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNmLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTTtZQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxRQUFxQixFQUF1QixFQUFFLENBQzFGLE1BQU0sY0FBYyxDQUFDLFFBQVEsRUFBRTtJQUM3QixpQkFBaUIsRUFBRSxPQUFPLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxDQUFDLGlCQUFpQjtJQUN0RyxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsK0JBQStCLENBQUMsUUFBUSxDQUFDO0lBQ2pHLE1BQU0sRUFBRSxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSx3QkFBd0IsQ0FBQyxVQUFVLENBQUM7Q0FDakUsQ0FBQyxDQUFDO0FBRUw7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxRQUFvQixFQUFVLEVBQUUsQ0FDMUUsSUFBSSxXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFOUU7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFBRSxRQUFxQixFQUF1QixFQUFFLENBQ2pHLE1BQU0sY0FBYyxDQUFDLFFBQVEsRUFBRTtJQUM3QixpQkFBaUIsRUFBRSxPQUFPLENBQUMsMEJBQTBCLENBQUMsZ0NBQWdDLENBQUMsd0JBQXdCO0lBQy9HLE9BQU8sRUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFO1FBQ3BCLElBQUksS0FBYSxDQUFDO1FBQ2xCLElBQUksQ0FBQztZQUNILEtBQUssR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNoRCxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUMsMEJBQTBCLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELE1BQU0sRUFBRSxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsSUFBSSwrQkFBK0IsQ0FBQyxVQUFVLENBQUM7Q0FDeEUsQ0FBQyxDQUFDIn0=

package/package.json

@@ -38,7 +38,7 @@
     "security"
   ],
   "name": "@serve.zone/cli",
-  "version": "33.9.0",
+  "version": "33.11.0",
   "type": "module",
   "description": "A comprehensive tool for managing containerized applications across multiple cloud providers using Docker Swarmkit, featuring web, CLI, and API interfaces.",
   "main": "./dist_ts_cliclient/index.js",
@@ -50,10 +50,11 @@
     }
   },
   "dependencies": {
-    "@serve.zone/api": "32.1.0",
-    "@serve.zone/interfaces": "32.40.0",
+    "@serve.zone/api": "32.5.0",
+    "@serve.zone/interfaces": "32.42.0",
     "@push.rocks/projectinfo": "^5.1.0",
     "@push.rocks/qenv": "^8.1.0",
+    "@push.rocks/smartfs": "^1.8.0",
     "@push.rocks/smartcli": "^4.3.0"
   },
   "bin": {

package/readme.md

@@ -16,6 +16,8 @@ This submodule is intentionally small in the current codebase:
 - Creates a `CliClient` wrapper around the API client.
 - Without arguments, calls `CliClient.getClusters()` and prints the result.
 - Runs `servezone gateway bootstrap` and `servezone gateway status` for Cloudly's dcrouter gateway enrollment.
+- Runs `servezone relay export-authorization` to write a cluster relay's bearer to a private file.
+- Runs `servezone corestore set-control-token` and `servezone corestore control-token-state` for the Corestore control token the cluster relays use.
 
 It is not currently a full command tree for services, secrets, deployments, logs, profiles, or shell completion. Those flows should be implemented against `@serve.zone/api` before documenting them as CLI commands.
 
@@ -73,6 +75,43 @@ servezone gateway status
 
 Revoke the admin token at dcrouter once `gateway status` reads `ready`.
 
+## Relay Bearer Export
+
+`relay export-authorization` hands a cluster relay's bearer to the operator who deploys that relay, without any access to Cloudly's process. It needs an administrator who signed in within the last five minutes.
+
+```sh
+install -d -m 0700 /root/relay-export
+CLOUDLY_URL=https://cloudly.example.com \
+CLOUDLY_USERNAME=admin CLOUDLY_PASSWORD=change-me \
+servezone relay export-authorization --cluster-id <clusterId> --expected-generation <n> \
+  --output /root/relay-export/relay-authorization
+```
+
+- `--expected-generation` is the exact generation `getClusterRelayCredential` answered (a positive integer without leading zeros); Cloudly refuses any other one by name (`relay-credential-generation-mismatch`), so a rotation that committed in between is never exported by accident.
+- `--output` must be a normalized absolute path. Its directory must exist, resolve to itself (no symbolic link on its path), be owned by you and be writable by neither its group nor other users, and nothing may exist at the path yet. Otherwise the command refuses (`output-directory-missing`, `output-directory-not-private`, `output-exists`) before it asks Cloudly, so no bearer is fetched and no audit receipt is written.
+- The bearer is fetched with `@serve.zone/api` (`cluster.exportClusterRelayAuthorization`, which checks the answer against the request) and written with `@push.rocks/smartfs` as a new file, mode `0600` whatever the umask, exclusive and atomic: the whole bearer or no file, never over an existing entry and never through a symbolic link at the path.
+- It is never written to stdout. stdout carries one JSON line of metadata: `clusterId`, `generation`, `outputPath`, `byteLength`, `sha256` (what `sha256sum` prints for the file) and `receiptId`, the audit receipt Cloudly recorded. A refusal is printed to stderr with exit code 1 and never carries the bearer.
+
+## Corestore Control Token
+
+Every cluster relay calls its nodes' Corestore control API with one control token, which Cloudly stores for both Corestore provider configs. These commands set and read it over the API, without any access to Cloudly's process. Both sign in exactly as the default action does; the set needs an administrator who signed in within the last five minutes.
+
+```sh
+CLOUDLY_URL=https://cloudly.example.com \
+CLOUDLY_USERNAME=admin CLOUDLY_PASSWORD=change-me \
+servezone corestore control-token-state
+
+# Pipe the token in, naming the state the read answered:
+servezone corestore set-control-token --stdin --expect absent < control-token.txt
+servezone corestore set-control-token --stdin --expect 3 < control-token.txt
+```
+
+- `control-token-state` prints one JSON line: `{"ok":true,"command":"corestore control-token-state","state":…,"receipts":[…]}`. `state` is `{"state":"absent"}` or `{"state":"present","revision":<n>}`; `receipts` are the value-free audit receipts (`id`, `revision`, `via`, `actorId`, `setAt`), oldest first.
+- `set-control-token --stdin --expect absent|<revision>` stores the token only while it is still exactly at the state `--expect` names: `absent`, or the revision `control-token-state` answered (a positive integer without leading zeros). It is never a minimum, so a set that committed in between is refused rather than overwritten.
+- The token is read from stdin and from nowhere else: `--stdin` names that, and an argument, `--token`, or any other extra argument is refused as usage without echoing it; the environment is never read for it. stdin must not be a terminal. One trailing line break (`\n` or `\r\n`) is stripped; what remains must pass the contract's `isCorestoreControlToken` (32 to 4096 bytes of UTF-8 without whitespace). A refused stdin is named (`token-input-terminal`, `token-input-oversized`, `token-input-invalid`) before anything connects, and every byte read is wiped.
+- The token is sent once with `@serve.zone/api` (`platform.setCorestoreControlToken`, past every TypedRequest hook), and the answer is checked against the request. stdout carries one JSON line with the state the set produced and its receipt, never the token: `{"ok":true,"command":"corestore set-control-token","state":{"state":"present","revision":<n>},"receipt":{…}}`.
+- A refusal is printed to stderr with exit code 1 as `The Corestore control token was not stored: <refusal>.`, naming one of the contract's `corestoreControlTokenSetRefusals`: `token-present` (`--expect absent`, and a token is stored), `token-absent` (a revision was expected, and none is stored), `token-revision-mismatch` (the stored token is at another revision), `token-invalid` or `provider-unavailable` (a Corestore provider config is missing or disabled). Every other failure, an unauthorized or stale administrator included, is Cloudly's one denial text, `Corestore control token request denied.`, with exit code 1.
+
 ## Programmatic Use
 
 The published submodule exports the `runCli()` entry point. For automation, most callers should use `@serve.zone/api` directly; the internal `CliClient` currently wraps `CloudlyApiClient` only to run the default cluster-list action:
@@ -98,9 +137,11 @@ await cli.getClusters();
 | Path | Purpose |
 | --- | --- |
 | `index.ts` | Runtime entry point for the published CLI. |
-| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()` and `getGatewayStatus()`. |
+| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()`, `getGatewayStatus()`, `exportRelayAuthorization()`, `setCorestoreControlToken()` and `getCorestoreControlTokenState()`. |
 | `commands.ts` | Parses the argument vector into one command, refusing anything else as usage. |
-| `tokeninput.ts` | Reads the dcrouter admin token from stdin. |
+| `tokeninput.ts` | Reads the dcrouter admin token and the Corestore control token from stdin, each bounded and checked by its contract. |
+| `corestorecontroltoken.ts` | Sets and reads the Corestore control token through the API client and names the contract's refusals. |
+| `relayauthorization.ts` | Checks the private output directory and writes a cluster relay's bearer as a new 0600 file. |
 | `plugins.ts` | Centralized imports for the submodule. |
 | `tspublish.json` | Published package name, dependencies, `servezone` bin metadata, and `useBase`, which takes the registries from the release's npm target. |
 

package/ts_cliclient/classes.cliclient.ts

@@ -1,5 +1,7 @@
 import * as plugins from './plugins.js';
 import { CloudlyApiClient } from '@serve.zone/api';
+import { exportRelayAuthorizationToFile } from './relayauthorization.js';
+import { getCorestoreControlTokenState, setCorestoreControlToken } from './corestorecontroltoken.js';
 
 export class CliClient {
   public cloudlyApiClient: CloudlyApiClient;
@@ -28,6 +30,36 @@ export class CliClient {
     console.log(JSON.stringify(state, null, 2));
   }
 
+  /**
+   * Writes one cluster relay's bearer to a new 0600 file and prints what describes the file:
+   * the cluster, the generation, the size, the SHA-256 and the audit receipt, never the bearer.
+   */
+  public async exportRelayAuthorization(
+    requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest,
+    outputPathArg: string,
+  ) {
+    const output = await exportRelayAuthorizationToFile(
+      this.cloudlyApiClient, requestArg, outputPathArg);
+    console.log(JSON.stringify({ ok: true, command: 'relay export-authorization', ...output }));
+  }
+
+  /**
+   * Stores the Corestore control token while it is still exactly at `expectedArg` and prints the
+   * state and the receipt the set produced, never the token. The token is the caller's to wipe.
+   */
+  public async setCorestoreControlToken(
+    expectedArg: plugins.servezoneInterfaces.data.TCorestoreControlTokenState,
+    tokenArg: Uint8Array,
+  ) {
+    const output = await setCorestoreControlToken(this.cloudlyApiClient, expectedArg, tokenArg);
+    console.log(JSON.stringify(output));
+  }
+
+  /** Prints whether Cloudly holds the Corestore control token, its revision and its receipts. */
+  public async getCorestoreControlTokenState() {
+    console.log(JSON.stringify(await getCorestoreControlTokenState(this.cloudlyApiClient)));
+  }
+
   public async getGatewayStatus() {
     const { state } = await this.cloudlyApiClient.settings.getExternalGatewayEnrollmentState();
     console.log(JSON.stringify(state, null, 2));

package/ts_cliclient/commands.ts

@@ -1,11 +1,23 @@
-import type * as plugins from './plugins.js';
+import * as plugins from './plugins.js';
 
 /** What one invocation of the CLI asks for, parsed before anything is read or connected. */
 export type TCliCommand =
   /** No arguments: the default action, listing the clusters. */
   | { kind: 'clusters' }
   | { kind: 'gateway-status' }
-  | { kind: 'gateway-bootstrap'; target: plugins.servezoneApi.IExternalGatewayBootstrapTarget };
+  | { kind: 'gateway-bootstrap'; target: plugins.servezoneApi.IExternalGatewayBootstrapTarget }
+  | {
+    kind: 'relay-export-authorization';
+    request: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest;
+    /** A normalized absolute path in a private directory; the file must not exist yet. */
+    outputPath: string;
+  }
+  | {
+    kind: 'corestore-set-control-token';
+    /** Exactly the state the administrator last read; never a minimum. */
+    expected: plugins.servezoneInterfaces.data.TCorestoreControlTokenState;
+  }
+  | { kind: 'corestore-control-token-state' };
 
 export const cliUsage = [
   'Usage:',
@@ -13,6 +25,11 @@ export const cliUsage = [
   '  servezone gateway status',
   '  servezone gateway bootstrap --gateway-url <https url> --client-id <id>',
   '    The dcrouter admin token is read from stdin, never from arguments or the environment.',
+  '  servezone relay export-authorization --cluster-id <id> --expected-generation <n> --output <absolute path>',
+  '    Writes the relay bearer to a new 0600 file in a directory only you can write; never to stdout.',
+  '  servezone corestore set-control-token --stdin --expect absent|<revision>',
+  '    The Corestore control token is read from stdin, never from arguments or the environment.',
+  '  servezone corestore control-token-state',
 ].join('\n');
 
 /**
@@ -51,6 +68,8 @@ const parseOptions = <TName extends string>(
 export const parseCliCommand = (argsArg: readonly string[]): TCliCommand => {
   if (argsArg.length === 0) return { kind: 'clusters' };
   const [group, action, ...rest] = argsArg;
+  if (group === 'relay') return parseRelayCommand(action, rest);
+  if (group === 'corestore') return parseCorestoreCommand(action, rest);
   requireUsage(group === 'gateway');
   if (action === 'status') {
     requireUsage(rest.length === 0);
@@ -63,3 +82,51 @@ export const parseCliCommand = (argsArg: readonly string[]): TCliCommand => {
     target: { gatewayUrl: options['--gateway-url'], gatewayClientId: options['--client-id'] },
   };
 };
+
+/** A positive integer without leading zeros, as a generation or a revision is named. */
+const parseCounter = (valueArg: string): number => {
+  requireUsage(/^[1-9][0-9]{0,15}$/.test(valueArg) && Number.isSafeInteger(Number(valueArg)));
+  return Number(valueArg);
+};
+
+/** `relay export-authorization`: the cluster, the exact generation and a normalized absolute output. */
+const parseRelayCommand = (actionArg: string | undefined, restArg: readonly string[]): TCliCommand => {
+  requireUsage(actionArg === 'export-authorization');
+  const options = parseOptions(restArg, ['--cluster-id', '--expected-generation', '--output']);
+  const generation = parseCounter(options['--expected-generation']);
+  const outputPath = options['--output'];
+  requireUsage(plugins.path.isAbsolute(outputPath) && plugins.path.normalize(outputPath) === outputPath
+    && !outputPath.endsWith(plugins.path.sep));
+  return {
+    kind: 'relay-export-authorization',
+    request: { clusterId: options['--cluster-id'], expectedGeneration: generation },
+    outputPath,
+  };
+};
+
+/**
+ * `corestore set-control-token --stdin --expect absent|<revision>` and
+ * `corestore control-token-state`.
+ *
+ * `--stdin` names where the token comes from, so no invocation reads it from anywhere else, and
+ * `--expect` is the state `control-token-state` answered: `absent`, or the stored revision.
+ */
+const parseCorestoreCommand = (actionArg: string | undefined, restArg: readonly string[]): TCliCommand => {
+  if (actionArg === 'control-token-state') {
+    requireUsage(restArg.length === 0);
+    return { kind: 'corestore-control-token-state' };
+  }
+  requireUsage(actionArg === 'set-control-token');
+  // `--stdin` is a flag in an option's place, either before or after `--expect <value>`.
+  requireUsage(restArg.length === 3);
+  const stdinIndex = restArg[0] === '--stdin' ? 0 : 2;
+  requireUsage(restArg[stdinIndex] === '--stdin');
+  const options = parseOptions(restArg.filter((_argArg, indexArg) => indexArg !== stdinIndex), ['--expect']);
+  const expected = options['--expect'];
+  return {
+    kind: 'corestore-set-control-token',
+    expected: expected === 'absent'
+      ? { state: 'absent' }
+      : { state: 'present', revision: parseCounter(expected) },
+  };
+};

package/ts_cliclient/corestorecontroltoken.ts

@@ -0,0 +1,71 @@
+import * as plugins from './plugins.js';
+import { decodeCorestoreControlToken } from './tokeninput.js';
+
+type TCorestoreControlTokenSetRefusal = plugins.servezoneInterfaces.data.TCorestoreControlTokenSetRefusal;
+
+/** Cloudly did not store the token, for one of the contract's refusals, which it names. */
+export class CorestoreControlTokenSetRefusedError extends Error {
+  constructor(public readonly refusal: TCorestoreControlTokenSetRefusal) {
+    super(`The Corestore control token was not stored: ${refusal}.`);
+    this.name = 'CorestoreControlTokenSetRefusedError';
+  }
+}
+
+/**
+ * The contract refusal an error is, or `undefined` for every other error.
+ *
+ * Cloudly answers a refusal by its name and nothing else, so the name is the whole of the error's
+ * message; any other message, Cloudly's one denial text included, is not a refusal.
+ */
+export const nameCorestoreControlTokenSetRefusal = (
+  errorArg: unknown,
+): TCorestoreControlTokenSetRefusal | undefined => {
+  if (!(errorArg instanceof Error)) return undefined;
+  return plugins.servezoneInterfaces.data.corestoreControlTokenSetRefusals
+    .find((refusalArg) => refusalArg === errorArg.message);
+};
+
+/** What the CLI prints about a stored token: the state it produced and its receipt, never the token. */
+export interface ICorestoreControlTokenSetOutput
+  extends plugins.servezoneInterfaces.data.ICorestoreControlTokenSetResult {
+  ok: true;
+  command: 'corestore set-control-token';
+}
+
+/** What the CLI prints about the token's state: the state and its value-free receipts. */
+export interface ICorestoreControlTokenStateOutput
+  extends plugins.servezoneInterfaces.data.ICorestoreControlTokenStateRead {
+  ok: true;
+  command: 'corestore control-token-state';
+}
+
+/**
+ * Stores the token through the API client while it is still exactly at `expected`, answering only
+ * the state and the receipt. The token bytes are the caller's to wipe; the text the request needs
+ * is decoded from them here and never printed, logged or put into an error.
+ */
+export const setCorestoreControlToken = async (
+  apiClientArg: plugins.servezoneApi.CloudlyApiClient,
+  expectedArg: plugins.servezoneInterfaces.data.TCorestoreControlTokenState,
+  tokenArg: Uint8Array,
+): Promise<ICorestoreControlTokenSetOutput> => {
+  try {
+    const { state, receipt } = await apiClientArg.platform.setCorestoreControlToken({
+      token: decodeCorestoreControlToken(tokenArg),
+      expected: expectedArg,
+    });
+    return { ok: true, command: 'corestore set-control-token', state, receipt };
+  } catch (error) {
+    const refusal = nameCorestoreControlTokenSetRefusal(error);
+    if (refusal !== undefined) throw new CorestoreControlTokenSetRefusedError(refusal);
+    throw error;
+  }
+};
+
+/** Whether Cloudly holds the token, at which revision, and its receipts, oldest first. */
+export const getCorestoreControlTokenState = async (
+  apiClientArg: plugins.servezoneApi.CloudlyApiClient,
+): Promise<ICorestoreControlTokenStateOutput> => {
+  const { state, receipts } = await apiClientArg.platform.getCorestoreControlTokenState();
+  return { ok: true, command: 'corestore control-token-state', state, receipts };
+};

package/ts_cliclient/index.ts

@@ -1,29 +1,66 @@
 import * as plugins from './plugins.js';
 import { CliClient } from './classes.cliclient.js';
 import { parseCliCommand, type TCliCommand } from './commands.js';
-import { readBootstrapTokenInput } from './tokeninput.js';
+import { readBootstrapTokenInput, readCorestoreControlTokenInput } from './tokeninput.js';
+import { requirePrivateOutputDirectory } from './relayauthorization.js';
 
 export { CliUsageError, parseCliCommand, type TCliCommand } from './commands.js';
+export {
+  RelayAuthorizationOutputError,
+  exportRelayAuthorizationToFile,
+  requirePrivateOutputDirectory,
+  writeRelayAuthorization,
+  type IRelayAuthorizationOutput,
+  type TRelayAuthorizationOutputRefusal,
+} from './relayauthorization.js';
 export {
   BootstrapTokenInputError,
+  CorestoreControlTokenInputError,
+  TokenInputError,
   readBootstrapTokenInput,
+  readCorestoreControlTokenInput,
   type TBootstrapTokenInputRefusal,
+  type TTokenInputRefusal,
 } from './tokeninput.js';
+export {
+  CorestoreControlTokenSetRefusedError,
+  getCorestoreControlTokenState,
+  nameCorestoreControlTokenSetRefusal,
+  setCorestoreControlToken,
+  type ICorestoreControlTokenSetOutput,
+  type ICorestoreControlTokenStateOutput,
+} from './corestorecontroltoken.js';
 
-/** A parsed command with everything it reads locally; a bootstrap carries the token from stdin. */
+/**
+ * A parsed command with everything it reads locally: a bootstrap carries the admin token from
+ * stdin, a control token set the Corestore control token.
+ */
 type TCliInvocation =
-  | Exclude<TCliCommand, { kind: 'gateway-bootstrap' }>
-  | (Extract<TCliCommand, { kind: 'gateway-bootstrap' }> & { bootstrapToken: Uint8Array });
+  | Exclude<TCliCommand, { kind: 'gateway-bootstrap' | 'corestore-set-control-token' }>
+  | (Extract<TCliCommand, { kind: 'gateway-bootstrap' }> & { bootstrapToken: Uint8Array })
+  | (Extract<TCliCommand, { kind: 'corestore-set-control-token' }> & { controlToken: Uint8Array });
+
+/** Reads the token the command needs from stdin, before anything connects. */
+const readInvocation = async (commandArg: TCliCommand): Promise<TCliInvocation> => {
+  if (commandArg.kind === 'gateway-bootstrap') {
+    return { ...commandArg, bootstrapToken: await readBootstrapTokenInput(process.stdin) };
+  }
+  if (commandArg.kind === 'corestore-set-control-token') {
+    return { ...commandArg, controlToken: await readCorestoreControlTokenInput(process.stdin) };
+  }
+  return commandArg;
+};
 
 export const runCli = async () => {
   // The command and the token are settled before anything connects, so a wrong invocation or a
   // token that could never be one fails without reaching Cloudly.
   let command: TCliInvocation;
   try {
-    const parsed = parseCliCommand(process.argv.slice(2));
-    command = parsed.kind === 'gateway-bootstrap'
-      ? { ...parsed, bootstrapToken: await readBootstrapTokenInput(process.stdin) }
-      : parsed;
+    command = await readInvocation(parseCliCommand(process.argv.slice(2)));
+    // An output the bearer could not be written to fetches no bearer and records no export.
+    if (command.kind === 'relay-export-authorization') {
+      await requirePrivateOutputDirectory(command.outputPath);
+    }
   } catch (error) {
     console.error((error as Error).message);
     process.exitCode = 1;
@@ -41,11 +78,17 @@ export const runCli = async () => {
     try {
       if (command.kind === 'gateway-bootstrap') {
         await cliClient.bootstrapGateway(command.target, command.bootstrapToken);
+      } else if (command.kind === 'relay-export-authorization') {
+        await cliClient.exportRelayAuthorization(command.request, command.outputPath);
+      } else if (command.kind === 'corestore-set-control-token') {
+        await cliClient.setCorestoreControlToken(command.expected, command.controlToken);
+      } else if (command.kind === 'corestore-control-token-state') {
+        await cliClient.getCorestoreControlTokenState();
       } else {
         await cliClient.getGatewayStatus();
       }
     } catch (error) {
-      // Cloudly answers a refusal by name; it never carries the token.
+      // Cloudly answers a refusal by name; it never carries a token or a bearer.
       console.error((error as Error).message);
       process.exitCode = 1;
     } finally {
@@ -53,6 +96,7 @@ export const runCli = async () => {
     }
   } finally {
     if (command.kind === 'gateway-bootstrap') command.bootstrapToken.fill(0);
+    if (command.kind === 'corestore-set-control-token') command.controlToken.fill(0);
   }
 };
 

package/ts_cliclient/plugins.ts

@@ -1,17 +1,32 @@
+// node native scope
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+
+export {
+  crypto,
+  fs,
+  path,
+}
+
 // @serve.zone scope
 import * as servezoneApi from '@serve.zone/api';  
 import * as servezoneInterfaces from '@serve.zone/interfaces';
+import * as servezoneInterfacesRuntime from '@serve.zone/interfaces/runtime';
 
 export {
   servezoneApi,
-  servezoneInterfaces
+  servezoneInterfaces,
+  servezoneInterfacesRuntime,
 }
 
 // @push.rocks scope
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
+import * as smartfs from '@push.rocks/smartfs';
 
 export {
   projectinfo,
   qenv,
+  smartfs,
 }

package/ts_cliclient/readme.md

@@ -16,6 +16,8 @@ This submodule is intentionally small in the current codebase:
 - Creates a `CliClient` wrapper around the API client.
 - Without arguments, calls `CliClient.getClusters()` and prints the result.
 - Runs `servezone gateway bootstrap` and `servezone gateway status` for Cloudly's dcrouter gateway enrollment.
+- Runs `servezone relay export-authorization` to write a cluster relay's bearer to a private file.
+- Runs `servezone corestore set-control-token` and `servezone corestore control-token-state` for the Corestore control token the cluster relays use.
 
 It is not currently a full command tree for services, secrets, deployments, logs, profiles, or shell completion. Those flows should be implemented against `@serve.zone/api` before documenting them as CLI commands.
 
@@ -73,6 +75,43 @@ servezone gateway status
 
 Revoke the admin token at dcrouter once `gateway status` reads `ready`.
 
+## Relay Bearer Export
+
+`relay export-authorization` hands a cluster relay's bearer to the operator who deploys that relay, without any access to Cloudly's process. It needs an administrator who signed in within the last five minutes.
+
+```sh
+install -d -m 0700 /root/relay-export
+CLOUDLY_URL=https://cloudly.example.com \
+CLOUDLY_USERNAME=admin CLOUDLY_PASSWORD=change-me \
+servezone relay export-authorization --cluster-id <clusterId> --expected-generation <n> \
+  --output /root/relay-export/relay-authorization
+```
+
+- `--expected-generation` is the exact generation `getClusterRelayCredential` answered (a positive integer without leading zeros); Cloudly refuses any other one by name (`relay-credential-generation-mismatch`), so a rotation that committed in between is never exported by accident.
+- `--output` must be a normalized absolute path. Its directory must exist, resolve to itself (no symbolic link on its path), be owned by you and be writable by neither its group nor other users, and nothing may exist at the path yet. Otherwise the command refuses (`output-directory-missing`, `output-directory-not-private`, `output-exists`) before it asks Cloudly, so no bearer is fetched and no audit receipt is written.
+- The bearer is fetched with `@serve.zone/api` (`cluster.exportClusterRelayAuthorization`, which checks the answer against the request) and written with `@push.rocks/smartfs` as a new file, mode `0600` whatever the umask, exclusive and atomic: the whole bearer or no file, never over an existing entry and never through a symbolic link at the path.
+- It is never written to stdout. stdout carries one JSON line of metadata: `clusterId`, `generation`, `outputPath`, `byteLength`, `sha256` (what `sha256sum` prints for the file) and `receiptId`, the audit receipt Cloudly recorded. A refusal is printed to stderr with exit code 1 and never carries the bearer.
+
+## Corestore Control Token
+
+Every cluster relay calls its nodes' Corestore control API with one control token, which Cloudly stores for both Corestore provider configs. These commands set and read it over the API, without any access to Cloudly's process. Both sign in exactly as the default action does; the set needs an administrator who signed in within the last five minutes.
+
+```sh
+CLOUDLY_URL=https://cloudly.example.com \
+CLOUDLY_USERNAME=admin CLOUDLY_PASSWORD=change-me \
+servezone corestore control-token-state
+
+# Pipe the token in, naming the state the read answered:
+servezone corestore set-control-token --stdin --expect absent < control-token.txt
+servezone corestore set-control-token --stdin --expect 3 < control-token.txt
+```
+
+- `control-token-state` prints one JSON line: `{"ok":true,"command":"corestore control-token-state","state":…,"receipts":[…]}`. `state` is `{"state":"absent"}` or `{"state":"present","revision":<n>}`; `receipts` are the value-free audit receipts (`id`, `revision`, `via`, `actorId`, `setAt`), oldest first.
+- `set-control-token --stdin --expect absent|<revision>` stores the token only while it is still exactly at the state `--expect` names: `absent`, or the revision `control-token-state` answered (a positive integer without leading zeros). It is never a minimum, so a set that committed in between is refused rather than overwritten.
+- The token is read from stdin and from nowhere else: `--stdin` names that, and an argument, `--token`, or any other extra argument is refused as usage without echoing it; the environment is never read for it. stdin must not be a terminal. One trailing line break (`\n` or `\r\n`) is stripped; what remains must pass the contract's `isCorestoreControlToken` (32 to 4096 bytes of UTF-8 without whitespace). A refused stdin is named (`token-input-terminal`, `token-input-oversized`, `token-input-invalid`) before anything connects, and every byte read is wiped.
+- The token is sent once with `@serve.zone/api` (`platform.setCorestoreControlToken`, past every TypedRequest hook), and the answer is checked against the request. stdout carries one JSON line with the state the set produced and its receipt, never the token: `{"ok":true,"command":"corestore set-control-token","state":{"state":"present","revision":<n>},"receipt":{…}}`.
+- A refusal is printed to stderr with exit code 1 as `The Corestore control token was not stored: <refusal>.`, naming one of the contract's `corestoreControlTokenSetRefusals`: `token-present` (`--expect absent`, and a token is stored), `token-absent` (a revision was expected, and none is stored), `token-revision-mismatch` (the stored token is at another revision), `token-invalid` or `provider-unavailable` (a Corestore provider config is missing or disabled). Every other failure, an unauthorized or stale administrator included, is Cloudly's one denial text, `Corestore control token request denied.`, with exit code 1.
+
 ## Programmatic Use
 
 The published submodule exports the `runCli()` entry point. For automation, most callers should use `@serve.zone/api` directly; the internal `CliClient` currently wraps `CloudlyApiClient` only to run the default cluster-list action:
@@ -98,9 +137,11 @@ await cli.getClusters();
 | Path | Purpose |
 | --- | --- |
 | `index.ts` | Runtime entry point for the published CLI. |
-| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()` and `getGatewayStatus()`. |
+| `classes.cliclient.ts` | Minimal client wrapper: `getClusters()`, `bootstrapGateway()`, `getGatewayStatus()`, `exportRelayAuthorization()`, `setCorestoreControlToken()` and `getCorestoreControlTokenState()`. |
 | `commands.ts` | Parses the argument vector into one command, refusing anything else as usage. |
-| `tokeninput.ts` | Reads the dcrouter admin token from stdin. |
+| `tokeninput.ts` | Reads the dcrouter admin token and the Corestore control token from stdin, each bounded and checked by its contract. |
+| `corestorecontroltoken.ts` | Sets and reads the Corestore control token through the API client and names the contract's refusals. |
+| `relayauthorization.ts` | Checks the private output directory and writes a cluster relay's bearer as a new 0600 file. |
 | `plugins.ts` | Centralized imports for the submodule. |
 | `tspublish.json` | Published package name, dependencies, `servezone` bin metadata, and `useBase`, which takes the registries from the release's npm target. |