@forgezero/agent 0.1.103 → 0.1.107

package/dist/fz-agent.js

@@ -7924,12 +7924,24 @@ function parseBootstrapBundleManifest(value) {
 // src/deployment.ts
 var RELEASE_GROUP = "forgezero-deploy";
 var deploymentAttestationChallenge = (revision) => createHash5("sha256").update("forgezero/deployment-attestation/v1\x00").update(revision, "utf8").digest("hex");
+var deploymentExecution = (phases) => ({
+  steps: phases.flatMap((phase) => phase.steps.map((step2) => ({
+    phase: phase.pipeline.slice(0, 128),
+    step: step2.name.slice(0, 128),
+    outcome: step2.outcome,
+    exitCode: step2.exitCode,
+    durationMs: Math.max(0, Math.min(step2.durationMs, 86400000)),
+    ...step2.outcome === "failed" && step2.log.trim() ? { detail: step2.log.trim().slice(0, 2000) } : {}
+  }))).slice(0, 128)
+});
 
 class DeploymentError extends Error {
   code;
-  constructor(code, message) {
+  execution;
+  constructor(code, message, execution) {
     super(message);
     this.code = code;
+    this.execution = execution;
     this.name = "DeploymentError";
   }
 }
@@ -8280,7 +8292,7 @@ function createDeploymentManager(options) {
         }
         const assignedTopology = assigned.topology;
         const selectedTopology = selected.topology;
-        const topologyMatches = selectedTopology ? Boolean(assignedTopology && /^[A-Za-z0-9.-]{1,253}$/.test(assignedTopology.site) && /^[A-Za-z0-9.-]{1,253}$/.test(assignedTopology.nodeIdentity) && /^[A-Za-z0-9._:-]{1,256}$/.test(assignedTopology.localRelayReference) && /^sha256:[a-f0-9]{64}$/.test(assignedTopology.generation) && /^(?:\d{1,3}\.){3}0\/24$/.test(assignedTopology.siteCidr) && assignedTopology.localRelayAddress.length <= 64 && assignedTopology.localPeerAddresses.length <= 1023 && assignedTopology.localPeerAddresses.every((address) => typeof address === "string" && address.length <= 64) && assignedTopology.localPeerIdentities.length === assignedTopology.localPeerAddresses.length && assignedTopology.localPeerIdentities.every((identity) => /^[A-Za-z0-9.-]{1,253}$/.test(identity)) && assignedTopology.remoteRelayAddresses.length <= 1023 && assignedTopology.remoteRelayAddresses.every((address) => typeof address === "string" && address.length <= 64) && assignedTopology.remoteRelayIdentities.length === assignedTopology.remoteRelayAddresses.length && assignedTopology.remoteRelayIdentities.every((identity) => /^[A-Za-z0-9.-]{1,253}$/.test(identity)) && assignedTopology.memberIdentities.length >= 1 && assignedTopology.memberIdentities.length <= 1024 && new Set(assignedTopology.memberIdentities).size === assignedTopology.memberIdentities.length && assignedTopology.memberIdentities.includes(assignedTopology.nodeIdentity) && assignedTopology.memberIdentities.every((identity) => /^[A-Za-z0-9.-]{1,253}$/.test(identity)) && (assignedTopology.role === "member" ? assignedTopology.remoteRelayAddresses.length === 0 : assignedTopology.remoteSiteCidrs.length === assignedTopology.remoteRelayAddresses.length) && assignedTopology.remoteSiteCidrs.every((cidr) => typeof cidr === "string" && /^(?:\d{1,3}\.){3}0\/24$/.test(cidr)) && Number.isSafeInteger(assignedTopology.healthPort) && assignedTopology.healthPort >= 1 && assignedTopology.healthPort <= 65535 && assignedTopology.routedTcpPorts.length >= 1 && assignedTopology.routedTcpPorts.length <= 64 && new Set(assignedTopology.routedTcpPorts).size === assignedTopology.routedTcpPorts.length && assignedTopology.routedTcpPorts.includes(assignedTopology.healthPort) && assignedTopology.routedTcpPorts.every((port) => Number.isSafeInteger(port) && port >= 1 && port <= 65535) && (assignedTopology.role !== "member" || assignedTopology.transport === "private-lan" && assignedTopology.warpRequired === false && assignedTopology.remoteRelayAddresses.length === 0 && assignedTopology.localPeerAddresses.length === 1) && (assignedTopology.warpRequired ? assignedTopology.role !== "member" && assignedTopology.transport === "cloudflare-warp" && selectedTopology.crossMetal.mode !== "private-lan" : assignedTopology.transport === "private-lan")) : assignedTopology === undefined;
+        const topologyMatches = selectedTopology ? Boolean(assignedTopology && /^[A-Za-z0-9.-]{1,253}$/.test(assignedTopology.site) && /^[A-Za-z0-9.-]{1,253}$/.test(assignedTopology.nodeIdentity) && /^[A-Za-z0-9._:-]{1,256}$/.test(assignedTopology.localRelayReference) && /^sha256:[a-f0-9]{64}$/.test(assignedTopology.generation) && /^(?:\d{1,3}\.){3}0\/24$/.test(assignedTopology.siteCidr) && assignedTopology.localRelayAddress.length <= 64 && assignedTopology.localPeerAddresses.length <= 1023 && assignedTopology.localPeerAddresses.every((address) => typeof address === "string" && address.length <= 64) && assignedTopology.localPeerIdentities.length === assignedTopology.localPeerAddresses.length && assignedTopology.localPeerIdentities.every((identity) => /^[A-Za-z0-9.-]{1,253}$/.test(identity)) && assignedTopology.remoteRelayAddresses.length <= 1023 && assignedTopology.remoteRelayAddresses.every((address) => typeof address === "string" && address.length <= 64) && assignedTopology.remoteRelayIdentities.length === assignedTopology.remoteRelayAddresses.length && assignedTopology.remoteRelayIdentities.every((identity) => /^[A-Za-z0-9.-]{1,253}$/.test(identity)) && assignedTopology.remoteMemberAddresses.length <= 1024 && new Set(assignedTopology.remoteMemberAddresses).size === assignedTopology.remoteMemberAddresses.length && assignedTopology.remoteMemberAddresses.every((address) => typeof address === "string" && address.length <= 64) && assignedTopology.memberIdentities.length >= 1 && assignedTopology.memberIdentities.length <= 1024 && new Set(assignedTopology.memberIdentities).size === assignedTopology.memberIdentities.length && assignedTopology.memberIdentities.includes(assignedTopology.nodeIdentity) && assignedTopology.memberIdentities.every((identity) => /^[A-Za-z0-9.-]{1,253}$/.test(identity)) && (assignedTopology.role === "member" ? assignedTopology.remoteRelayAddresses.length === 0 : assignedTopology.remoteSiteCidrs.length === assignedTopology.remoteRelayAddresses.length) && assignedTopology.remoteSiteCidrs.every((cidr) => typeof cidr === "string" && /^(?:\d{1,3}\.){3}0\/24$/.test(cidr)) && Number.isSafeInteger(assignedTopology.healthPort) && assignedTopology.healthPort >= 1 && assignedTopology.healthPort <= 65535 && assignedTopology.routedTcpPorts.length >= 1 && assignedTopology.routedTcpPorts.length <= 64 && new Set(assignedTopology.routedTcpPorts).size === assignedTopology.routedTcpPorts.length && assignedTopology.routedTcpPorts.includes(assignedTopology.healthPort) && assignedTopology.routedTcpPorts.every((port) => Number.isSafeInteger(port) && port >= 1 && port <= 65535) && (assignedTopology.role !== "member" || assignedTopology.transport === "private-lan" && assignedTopology.warpRequired === false && assignedTopology.remoteRelayAddresses.length === 0 && assignedTopology.localPeerAddresses.length === 1) && (assignedTopology.warpRequired ? assignedTopology.role !== "member" && assignedTopology.transport === "cloudflare-warp" && selectedTopology.crossMetal.mode !== "private-lan" : assignedTopology.transport === "private-lan")) : assignedTopology === undefined;
         const expectedPrivate = selectedTopology ? assignedTopology?.warpRequired ? selectedTopology.crossMetal.mode === "private-lan" ? undefined : {
           mode: "cloudflare-warp",
           credential: selectedTopology.crossMetal.credential,
@@ -8318,6 +8330,7 @@ function createDeploymentManager(options) {
             FZ_TOPOLOGY_LOCAL_PEERS: assigned.topology.localPeerAddresses.join(","),
             FZ_TOPOLOGY_LOCAL_PEER_IDENTITIES: assigned.topology.localPeerIdentities.join(","),
             FZ_TOPOLOGY_REMOTE_RELAYS: assigned.topology.remoteRelayAddresses.join(","),
+            FZ_TOPOLOGY_REMOTE_MEMBERS: assigned.topology.remoteMemberAddresses.join(","),
             FZ_TOPOLOGY_REMOTE_RELAY_IDENTITIES: assigned.topology.remoteRelayIdentities.join(","),
             FZ_TOPOLOGY_REMOTE_CIDRS: assigned.topology.remoteSiteCidrs.join(","),
             FZ_TOPOLOGY_MEMBERS: assigned.topology.memberIdentities.join(","),
@@ -8338,6 +8351,18 @@ function createDeploymentManager(options) {
           throw new DeploymentError("PIPELINE_FAILED", `component limits exceed the reserved capacity of target ${targetName}`);
         }
       }
+      if (assigned?.firewallPolicy) {
+        if (!options.ensureSoftware || !options.applyConnectivity) {
+          throw new DeploymentError("PIPELINE_FAILED", "the supervised firewall helper is unavailable");
+        }
+        await options.ensureSoftware([{ id: "ufw", version: "latest" }]);
+        await options.applyConnectivity({
+          key: `${options.key}:${assigned.targetName}:${assigned.slot}`,
+          intent: {},
+          capabilities: {},
+          firewallPolicy: structuredClone(assigned.firewallPolicy)
+        });
+      }
       const inputValues = resolveDeploymentInputs(plan, options.environment ?? {});
       const projectExec2 = options.projectExec ?? spawnExact;
       const materializePlanArgv = (argv2) => argv2.map((argument) => {
@@ -8416,6 +8441,7 @@ function createDeploymentManager(options) {
               localPeerIdentities: assigned.topology.localPeerIdentities,
               remoteRelayAddresses: assigned.topology.remoteRelayAddresses,
               remoteRelayIdentities: assigned.topology.remoteRelayIdentities,
+              remoteMemberAddresses: assigned.topology.remoteMemberAddresses,
               remoteSiteCidrs: assigned.topology.remoteSiteCidrs,
               memberIdentities: assigned.topology.memberIdentities,
               healthPort: assigned.topology.healthPort,
@@ -8430,6 +8456,7 @@ function createDeploymentManager(options) {
             throw new DeploymentActionError("refused", "exec.argv requires an exact argv array");
           const environment = { ...phaseEnvironment2 };
           const bindings = resolved.credentials;
+          const credentialValues = [];
           if (bindings !== undefined) {
             if (!bindings || typeof bindings !== "object" || Array.isArray(bindings))
               throw new DeploymentActionError("refused", "exec.argv credentials must map environment names to credential declarations");
@@ -8440,11 +8467,12 @@ function createDeploymentManager(options) {
               if (!credential || !options.cache)
                 throw new DeploymentActionError("refused", `credential ${credentialName} is unavailable`);
               environment[environmentName] = await options.cache.get(credential.source.name);
+              credentialValues.push(environment[environmentName]);
             }
           }
           const result = await projectExec2({ argv: materializePlanArgv(resolved.argv), cwd: release, env: environment, timeoutMs: step2.timeoutMs });
           if (result.exitCode !== 0)
-            throw new DeploymentActionError("failed", result.output.slice(0, 2000) || `command exited ${result.exitCode}`);
+            throw new DeploymentActionError("failed", redact(result.output, credentialValues).slice(0, 2000) || `command exited ${result.exitCode}`);
           return { outputs: { exitCode: result.exitCode } };
         },
         "forgezero.health/http@1": async ({ resolved }) => {
@@ -8562,7 +8590,7 @@ function createDeploymentManager(options) {
       };
       if (!run2.ok) {
         const failed = run2.steps.find((step2) => step2.status === "failed" || step2.status === "manual-intervention");
-        throw new DeploymentError("PIPELINE_FAILED", `deployment plan failed at ${failed?.id ?? "unknown step"}: ${failed?.error?.message ?? run2.status}`);
+        throw new DeploymentError("PIPELINE_FAILED", `deployment plan failed at ${failed?.id ?? "unknown step"}: ${failed?.error?.message ?? run2.status}`, deploymentExecution([phase]));
       }
       return {
         key: options.key,
@@ -8575,6 +8603,7 @@ function createDeploymentManager(options) {
         release,
         ok: true,
         phases: [phase],
+        execution: deploymentExecution([phase]),
         resolvedTargets
       };
     }
@@ -8652,7 +8681,7 @@ function createDeploymentManager(options) {
       if (!result.ok) {
         const failedStep = result.steps.find((step2) => step2.outcome === "failed");
         const detail = failedStep?.log.trim().slice(0, 2000);
-        throw new DeploymentError("PIPELINE_FAILED", `${pipeline.name} failed at ${failedStep?.name ?? "unknown step"}` + (detail ? `: ${detail}` : ` (exit ${failedStep?.exitCode ?? "unknown"}).`));
+        throw new DeploymentError("PIPELINE_FAILED", `${pipeline.name} failed at ${failedStep?.name ?? "unknown step"}` + (detail ? `: ${detail}` : ` (exit ${failedStep?.exitCode ?? "unknown"}).`), deploymentExecution(phases));
       }
       if (pipeline.phase === "release")
         await activateSelectedService();
@@ -8694,6 +8723,7 @@ function createDeploymentManager(options) {
       release,
       ok: true,
       phases,
+      execution: deploymentExecution(phases),
       ...capacity ? { capacity } : {}
     };
   };
@@ -9000,7 +9030,8 @@ async function pullDeploymentOnce(options) {
       runKey: claim.runKey,
       claimToken: claim.claimToken,
       ok: false,
-      detail: reason
+      detail: reason,
+      ...cause instanceof DeploymentError && cause.execution ? { execution: cause.execution } : {}
     });
     if (options.telemetry) {
       await options.telemetry.observe("deployment.complete", acknowledge2, () => "success", remoteOutcome);
@@ -9017,6 +9048,7 @@ async function pullDeploymentOnce(options) {
     definitionDigest: result.definitionDigest,
     definitionVersion: result.definitionVersion,
     profile: result.profile,
+    execution: result.execution,
     ...result.resolvedTargets ? { resolvedTargets: result.resolvedTargets.map((target) => ({
       ...target,
       profiles: [...target.profiles],
@@ -9496,7 +9528,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.103";
+var VERSION2 = "0.1.107";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -13384,7 +13416,7 @@ async function activateContainer(requestValue, host = defaultHost2) {
 // src/deployment-connectivity.ts
 import { createHash as createHash11 } from "crypto";
 import { mkdirSync as mkdirSync12, renameSync as renameSync12, writeFileSync as writeFileSync13 } from "fs";
-import { createConnection as createConnection2 } from "net";
+import { createConnection as createConnection2, isIP as isIP4 } from "net";
 import { dirname as dirname11 } from "path";
 var TOKEN2 = /^[A-Za-z0-9._-]{40,16384}$/;
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/i;
@@ -13463,21 +13495,99 @@ function validate2(request) {
     }
   } else if (request.capabilities.private)
     throw new Error("unexpected private deployment capability");
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    if (!/^sha256:[a-f0-9]{64}$/.test(policy.generation) || !Array.isArray(policy.rules) || policy.rules.length > 256) {
+      throw new Error("deployment firewall policy is malformed");
+    }
+    let expanded = 0;
+    for (const rule of policy.rules) {
+      expanded += rule.sourceAddresses.length;
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(rule.ruleKey) || !["allow", "deny"].includes(rule.action) || !["tcp", "udp"].includes(rule.protocol) || rule.sourceAddresses.length < 1 || rule.sourceAddresses.length > 1024 || new Set(rule.sourceAddresses).size !== rule.sourceAddresses.length || rule.sourceAddresses.some((address) => isIP4(address) !== 4) || !Number.isSafeInteger(rule.portFrom) || rule.portFrom < 1 || rule.portFrom > 65535 || !Number.isSafeInteger(rule.portTo) || rule.portTo < rule.portFrom || rule.portTo > 65535 || !Number.isSafeInteger(rule.priority) || rule.priority < 0 || rule.priority > 1e6) {
+        throw new Error("deployment firewall policy is malformed");
+      }
+    }
+    if (expanded > 2048)
+      throw new Error("deployment firewall policy expands beyond its rule limit");
+  }
+}
+async function replaceTaggedUfwRules(host, comment) {
+  const status = await checked7(host, ["/usr/sbin/ufw", "status", "numbered"], "firewall inventory");
+  const numbers = status.split(`
+`).flatMap((line) => {
+    if (!line.includes(comment))
+      return [];
+    const match = line.match(/^\s*\[\s*(\d{1,6})\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((value) => Number.isSafeInteger(value) && value > 0).sort((left, right) => right - left);
+  for (const number2 of numbers)
+    await checked7(host, ["/usr/sbin/ufw", "--force", "delete", String(number2)], `stale firewall rule ${number2}`);
 }
 async function applyDeploymentConnectivity(request, host = defaultHost3) {
   validate2(request);
   const id2 = idFor3(request.key);
   const evidence = { key: request.key };
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    const comment = `fz-policy-${id2}`;
+    await replaceTaggedUfwRules(host, comment);
+    const ordered = [...policy.rules].sort((left, right) => left.priority - right.priority || (left.action === right.action ? left.ruleKey.localeCompare(right.ruleKey) : left.action === "deny" ? -1 : 1));
+    const commands = [];
+    for (const rule of ordered)
+      for (const source of rule.sourceAddresses)
+        commands.push([
+          "/usr/sbin/ufw",
+          "insert",
+          "1",
+          rule.action,
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          rule.portFrom === rule.portTo ? String(rule.portFrom) : `${rule.portFrom}:${rule.portTo}`,
+          "proto",
+          rule.protocol,
+          "comment",
+          comment
+        ]);
+    const ranges = new Map;
+    for (const rule of ordered)
+      ranges.set(`${rule.protocol}:${rule.portFrom}:${rule.portTo}`, rule);
+    for (const range of ranges.values())
+      commands.push([
+        "/usr/sbin/ufw",
+        "insert",
+        "1",
+        "deny",
+        "to",
+        "any",
+        "port",
+        range.portFrom === range.portTo ? String(range.portFrom) : `${range.portFrom}:${range.portTo}`,
+        "proto",
+        range.protocol,
+        "comment",
+        comment
+      ]);
+    for (const command3 of commands.toReversed())
+      await checked7(host, command3, "deployment firewall rule");
+    evidence.firewall = { generation: policy.generation, rules: commands.length, active: true };
+  }
   const topology = request.topology;
   if (topology) {
-    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const values = [
+      topology.localRelayAddress,
+      ...topology.localPeerAddresses,
+      ...topology.remoteRelayAddresses,
+      ...topology.remoteMemberAddresses
+    ];
     const identities = [
       topology.nodeIdentity,
       ...topology.localPeerIdentities,
       ...topology.remoteRelayIdentities,
       ...topology.memberIdentities
     ];
-    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => isIP4(value) !== 4) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.remoteMemberAddresses.length > 1024 || new Set(topology.remoteMemberAddresses).size !== topology.remoteMemberAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
       throw new Error("deployment topology is malformed");
     }
     if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
@@ -13604,28 +13714,46 @@ ${forwarding}${noOp}${starts}${starts ? `
 [Install]
 WantedBy=multi-user.target
 `, 420);
-    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+    const firewallComment = `fz-topology-${id2}`;
+    await replaceTaggedUfwRules(host, firewallComment);
+    for (const source of [...new Set([...topology.localPeerAddresses, ...topology.remoteMemberAddresses])]) {
       for (const port of topology.routedTcpPorts) {
-        await checked7(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+        await checked7(host, [
+          "/usr/sbin/ufw",
+          "allow",
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          String(port),
+          "proto",
+          "tcp",
+          "comment",
+          firewallComment
+        ], `private service ${source}:${port}`);
       }
     }
     if (topology.role !== "member")
-      for (const remoteCidr of topology.remoteSiteCidrs) {
-        for (const port of topology.routedTcpPorts) {
-          await checked7(host, [
-            "/usr/sbin/ufw",
-            "route",
-            "allow",
-            "proto",
-            "tcp",
-            "from",
-            topology.siteCidr,
-            "to",
-            remoteCidr,
-            "port",
-            String(port)
-          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
-        }
+      for (const remoteAddress of topology.remoteMemberAddresses) {
+        for (const source of topology.localPeerAddresses)
+          for (const port of topology.routedTcpPorts) {
+            await checked7(host, [
+              "/usr/sbin/ufw",
+              "route",
+              "allow",
+              "proto",
+              "tcp",
+              "from",
+              source,
+              "to",
+              remoteAddress,
+              "port",
+              String(port),
+              "comment",
+              firewallComment
+            ], `private routed service ${source}->${remoteAddress}:${port}`);
+          }
       }
     await checked7(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
     await checked7(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");
@@ -15172,7 +15300,7 @@ import { dirname as dirname14 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/provision.ts
-import { isIP as isIP4 } from "net";
+import { isIP as isIP5 } from "net";
 function atLeast(version, floor) {
   const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
   const got = parse(version);
@@ -15652,7 +15780,7 @@ function agentUnit(options) {
       throw new Error("compute telemetry endpoint must be an absolute collector URL");
     }
     const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
-    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP4(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP5(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
     if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
       throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
@@ -16480,6 +16608,7 @@ var BOOTSTRAP_STATE_PATH = "/var/lib/forgezero/bootstrap.json";
 var STATE_PATH = BOOTSTRAP_STATE_PATH;
 var CREDS = "/etc/forgezero/creds";
 var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ARANGO_ROOT_CREDENTIAL = `${CREDS}/arangodb-root-password.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
@@ -16641,6 +16770,11 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (nginx3.exitCode !== 0)
       problems.push("nginx configuration is invalid");
     if (state.databaseRole !== "none") {
+      for (const credential of [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL]) {
+        services[credential] = host.exists(credential);
+        if (!services[credential])
+          problems.push(`${credential} is missing`);
+      }
       const unitPath = "/etc/systemd/system/forgezero-db.service";
       const expectsNoAgency = state.databaseAgency === "none";
       const unitHasNoAgency = host.exists(unitPath) && host.read(unitPath).includes("--cluster.start-agent=false");
@@ -16864,7 +16998,7 @@ async function verifyPlatformFleetHost(expectedVersion, runtime = localRuntime()
 // src/community-rehearsal-host.ts
 import { createHash as createHash12 } from "crypto";
 import { lstatSync as lstatSync8, mkdirSync as mkdirSync17, readFileSync as readFileSync18, rmSync as rmSync13, symlinkSync as symlinkSync8, unlinkSync as unlinkSync13, writeFileSync as writeFileSync17 } from "fs";
-import { isIP as isIP5 } from "net";
+import { isIP as isIP6 } from "net";
 import { dirname as dirname15 } from "path";
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
@@ -16897,7 +17031,7 @@ var validateCommunityRehearsalTopology = (value) => {
     throw new Error("community rehearsal requires exactly four reviewed nodes");
   const rows = value.map((item, index) => {
     const row2 = exactObject(item);
-    if (Object.keys(row2).some((key) => !["name", "address", "agency", "starter", "readPreferred"].includes(key)) || typeof row2.name !== "string" || !SAFE_NAME2.test(row2.name) || typeof row2.address !== "string" || isIP5(row2.address) !== 4 || typeof row2.agency !== "boolean" || typeof row2.starter !== "boolean" || typeof row2.readPreferred !== "boolean") {
+    if (Object.keys(row2).some((key) => !["name", "address", "agency", "starter", "readPreferred"].includes(key)) || typeof row2.name !== "string" || !SAFE_NAME2.test(row2.name) || typeof row2.address !== "string" || isIP6(row2.address) !== 4 || typeof row2.agency !== "boolean" || typeof row2.starter !== "boolean" || typeof row2.readPreferred !== "boolean") {
       throw new Error(`community rehearsal topology node ${index + 1} is invalid`);
     }
     return row2;
@@ -17250,8 +17384,75 @@ async function readBoundedStdin(maxBytes) {
     throw new Error(`stdin request exceeds ${maxBytes} bytes`);
   return Buffer.from(stdout).toString("utf8");
 }
+
+// src/database-auth-verify.ts
+import { isIP as isIP7 } from "net";
+var MAX_RESPONSE_BYTES2 = 16 * 1024;
+function databaseEndpoint(raw) {
+  let endpoint;
+  try {
+    endpoint = new URL(raw);
+  } catch {
+    throw new Error("database authentication endpoint is malformed");
+  }
+  const hostname2 = endpoint.hostname.replace(/^\[|\]$/g, "");
+  const ipVersion = isIP7(hostname2);
+  const privateIp2 = ipVersion === 4 ? /^(?:10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.)/.test(hostname2) : ipVersion === 6 && /^(?:fc|fd)[0-9a-f]{2}:/i.test(hostname2);
+  if (endpoint.protocol !== "http:" || endpoint.username || endpoint.password || endpoint.port !== "8529" || endpoint.pathname !== "/" || endpoint.search || endpoint.hash || !privateIp2)
+    throw new Error("database authentication endpoint must be an exact private IP on port 8529");
+  return endpoint;
+}
+function rootCredential(readCredential) {
+  const password = readCredential();
+  if (password.length < 48 || password.length > 256 || /[\r\n\0]/.test(password)) {
+    throw new Error("ArangoDB root credential is malformed");
+  }
+  return password;
+}
+async function boundedBody(response) {
+  const body = await response.text();
+  if (Buffer.byteLength(body) > MAX_RESPONSE_BYTES2)
+    throw new Error("ArangoDB authentication proof response is too large");
+  return body;
+}
+async function refused2(fetcher, url, authorization) {
+  const response = await fetcher(url, {
+    method: "GET",
+    headers: authorization ? { authorization } : undefined,
+    redirect: "error"
+  });
+  await boundedBody(response);
+  if (response.status !== 401 && response.status !== 403) {
+    throw new Error("ArangoDB accepted an unauthenticated or empty-password request");
+  }
+}
+async function verifyDatabaseAuthentication(rawEndpoint, options) {
+  const endpoint = databaseEndpoint(rawEndpoint);
+  const password = rootCredential(options.readCredential);
+  const versionUrl = new URL("/_api/version", endpoint);
+  const fetcher = options.fetcher ?? fetch;
+  await refused2(fetcher, versionUrl);
+  await refused2(fetcher, versionUrl, `Basic ${Buffer.from("root:").toString("base64")}`);
+  const response = await fetcher(versionUrl, {
+    method: "GET",
+    headers: { authorization: `Basic ${Buffer.from(`root:${password}`).toString("base64")}` },
+    redirect: "error"
+  });
+  const body = await boundedBody(response);
+  if (!response.ok)
+    throw new Error(`ArangoDB sealed root authentication failed with status ${response.status}`);
+  let value;
+  try {
+    value = JSON.parse(body);
+  } catch {
+    throw new Error("ArangoDB authentication proof returned malformed JSON");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.version !== "3.11.14") {
+    throw new Error("ArangoDB authentication proof returned the wrong version");
+  }
+}
 // src/deployment-topology.ts
-import { isIP as isIP6 } from "net";
+import { isIP as isIP8 } from "net";
 
 class DeploymentTopologyError extends Error {
   constructor(message) {
@@ -17280,7 +17481,7 @@ function planDeploymentTopology(args) {
   const references = new Set;
   const slots = new Set;
   for (const placement of args.placements) {
-    if (!SAFE.test(placement.computeReference) || !SAFE.test(placement.nodeIdentity) || !SAFE.test(placement.metalHostname) || isIP6(placement.privateAddress) !== 4 || !PRIVATE_V4(placement.privateAddress) || !validSiteCidr(placement.siteCidr) || !placement.privateAddress.startsWith(placement.siteCidr.slice(0, -4)) || !Number.isSafeInteger(placement.slot) || placement.slot < 0 || placement.slot > 1e6 || references.has(placement.computeReference) || slots.has(placement.slot)) {
+    if (!SAFE.test(placement.computeReference) || !SAFE.test(placement.nodeIdentity) || !SAFE.test(placement.metalHostname) || isIP8(placement.privateAddress) !== 4 || !PRIVATE_V4(placement.privateAddress) || !validSiteCidr(placement.siteCidr) || !placement.privateAddress.startsWith(placement.siteCidr.slice(0, -4)) || !Number.isSafeInteger(placement.slot) || placement.slot < 0 || placement.slot > 1e6 || references.has(placement.computeReference) || slots.has(placement.slot)) {
       throw new DeploymentTopologyError("topology placement is malformed or duplicated");
     }
     references.add(placement.computeReference);
@@ -17332,6 +17533,7 @@ function planDeploymentTopology(args) {
     const relay = active.get(site);
     const remoteRelayAddresses = siteNames.filter((other) => other !== site).map((other) => active.get(other).privateAddress);
     const remoteRelayIdentities = siteNames.filter((other) => other !== site).map((other) => active.get(other).nodeIdentity);
+    const remoteMemberAddresses = siteNames.filter((other) => other !== site).flatMap((other) => sites.get(other).map(({ privateAddress }) => privateAddress));
     const remoteSiteCidrs = siteNames.filter((other) => other !== site).map((other) => siteCidrs.get(other));
     return members2.map((placement, index) => {
       const role = index === 0 ? "relay" : index === 1 && topology.relays.standbyPerMetal === 1 ? "standby" : "member";
@@ -17349,6 +17551,7 @@ function planDeploymentTopology(args) {
         localPeerIdentities,
         remoteRelayAddresses: crossSite ? remoteRelayAddresses : [],
         remoteRelayIdentities: crossSite ? remoteRelayIdentities : [],
+        remoteMemberAddresses: siteNames.length > 1 ? remoteMemberAddresses : [],
         remoteSiteCidrs: siteNames.length > 1 ? remoteSiteCidrs : [],
         healthPort: topology.relays.healthPort,
         routedTcpPorts: [...topology.relays.routedTcpPorts],
@@ -17591,6 +17794,20 @@ if (import.meta.main) {
     console.log("project release shape verified");
     process.exit(0);
   }
+  if (command3 === "database-auth-verify") {
+    const values = args.filter((arg) => arg.startsWith("--endpoint="));
+    if (values.length !== 1 || args.length !== 2) {
+      throw new Error("database-auth-verify requires exactly one --endpoint coordinate");
+    }
+    const directory = process.env.CREDENTIALS_DIRECTORY;
+    if (!directory?.startsWith("/"))
+      throw new Error("database-auth-verify requires a systemd credential");
+    await verifyDatabaseAuthentication(values[0].slice("--endpoint=".length), {
+      readCredential: () => readFileSync20(join12(directory, "arangodb-root-password"), "utf8").trim()
+    });
+    console.log("[database] anonymous and empty-root access refused; sealed root credential verified");
+    process.exit(0);
+  }
   const allowFileSeed = process.env.FZ_ALLOW_FILE_SEED === "1";
   if (command3 === "identity") {
     const seed = configuredAgentSeed({