@forgezero/agent 0.1.103 → 0.1.107

package/dist/platform-fleet-verification.js

@@ -1869,7 +1869,7 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 // src/deployment-connectivity.ts
 import { createHash as createHash3 } from "node:crypto";
 import { mkdirSync as mkdirSync4, renameSync as renameSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { createConnection } from "node:net";
+import { createConnection, isIP } from "node:net";
 import { dirname as dirname5 } from "node:path";
 
 // src/process-input.ts
@@ -1956,21 +1956,99 @@ function validate(request) {
     }
   } else if (request.capabilities.private)
     throw new Error("unexpected private deployment capability");
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    if (!/^sha256:[a-f0-9]{64}$/.test(policy.generation) || !Array.isArray(policy.rules) || policy.rules.length > 256) {
+      throw new Error("deployment firewall policy is malformed");
+    }
+    let expanded = 0;
+    for (const rule of policy.rules) {
+      expanded += rule.sourceAddresses.length;
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(rule.ruleKey) || !["allow", "deny"].includes(rule.action) || !["tcp", "udp"].includes(rule.protocol) || rule.sourceAddresses.length < 1 || rule.sourceAddresses.length > 1024 || new Set(rule.sourceAddresses).size !== rule.sourceAddresses.length || rule.sourceAddresses.some((address) => isIP(address) !== 4) || !Number.isSafeInteger(rule.portFrom) || rule.portFrom < 1 || rule.portFrom > 65535 || !Number.isSafeInteger(rule.portTo) || rule.portTo < rule.portFrom || rule.portTo > 65535 || !Number.isSafeInteger(rule.priority) || rule.priority < 0 || rule.priority > 1e6) {
+        throw new Error("deployment firewall policy is malformed");
+      }
+    }
+    if (expanded > 2048)
+      throw new Error("deployment firewall policy expands beyond its rule limit");
+  }
+}
+async function replaceTaggedUfwRules(host, comment) {
+  const status = await checked2(host, ["/usr/sbin/ufw", "status", "numbered"], "firewall inventory");
+  const numbers = status.split(`
+`).flatMap((line) => {
+    if (!line.includes(comment))
+      return [];
+    const match = line.match(/^\s*\[\s*(\d{1,6})\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((value) => Number.isSafeInteger(value) && value > 0).sort((left, right) => right - left);
+  for (const number of numbers)
+    await checked2(host, ["/usr/sbin/ufw", "--force", "delete", String(number)], `stale firewall rule ${number}`);
 }
 async function applyDeploymentConnectivity(request, host = defaultHost) {
   validate(request);
   const id = idFor(request.key);
   const evidence = { key: request.key };
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    const comment = `fz-policy-${id}`;
+    await replaceTaggedUfwRules(host, comment);
+    const ordered = [...policy.rules].sort((left, right) => left.priority - right.priority || (left.action === right.action ? left.ruleKey.localeCompare(right.ruleKey) : left.action === "deny" ? -1 : 1));
+    const commands = [];
+    for (const rule of ordered)
+      for (const source of rule.sourceAddresses)
+        commands.push([
+          "/usr/sbin/ufw",
+          "insert",
+          "1",
+          rule.action,
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          rule.portFrom === rule.portTo ? String(rule.portFrom) : `${rule.portFrom}:${rule.portTo}`,
+          "proto",
+          rule.protocol,
+          "comment",
+          comment
+        ]);
+    const ranges = new Map;
+    for (const rule of ordered)
+      ranges.set(`${rule.protocol}:${rule.portFrom}:${rule.portTo}`, rule);
+    for (const range of ranges.values())
+      commands.push([
+        "/usr/sbin/ufw",
+        "insert",
+        "1",
+        "deny",
+        "to",
+        "any",
+        "port",
+        range.portFrom === range.portTo ? String(range.portFrom) : `${range.portFrom}:${range.portTo}`,
+        "proto",
+        range.protocol,
+        "comment",
+        comment
+      ]);
+    for (const command2 of commands.toReversed())
+      await checked2(host, command2, "deployment firewall rule");
+    evidence.firewall = { generation: policy.generation, rules: commands.length, active: true };
+  }
   const topology = request.topology;
   if (topology) {
-    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const values = [
+      topology.localRelayAddress,
+      ...topology.localPeerAddresses,
+      ...topology.remoteRelayAddresses,
+      ...topology.remoteMemberAddresses
+    ];
     const identities = [
       topology.nodeIdentity,
       ...topology.localPeerIdentities,
       ...topology.remoteRelayIdentities,
       ...topology.memberIdentities
     ];
-    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => isIP(value) !== 4) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.remoteMemberAddresses.length > 1024 || new Set(topology.remoteMemberAddresses).size !== topology.remoteMemberAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
       throw new Error("deployment topology is malformed");
     }
     if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
@@ -2097,28 +2175,46 @@ ${forwarding}${noOp}${starts}${starts ? `
 [Install]
 WantedBy=multi-user.target
 `, 420);
-    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+    const firewallComment = `fz-topology-${id}`;
+    await replaceTaggedUfwRules(host, firewallComment);
+    for (const source of [...new Set([...topology.localPeerAddresses, ...topology.remoteMemberAddresses])]) {
       for (const port of topology.routedTcpPorts) {
-        await checked2(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+        await checked2(host, [
+          "/usr/sbin/ufw",
+          "allow",
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          String(port),
+          "proto",
+          "tcp",
+          "comment",
+          firewallComment
+        ], `private service ${source}:${port}`);
       }
     }
     if (topology.role !== "member")
-      for (const remoteCidr of topology.remoteSiteCidrs) {
-        for (const port of topology.routedTcpPorts) {
-          await checked2(host, [
-            "/usr/sbin/ufw",
-            "route",
-            "allow",
-            "proto",
-            "tcp",
-            "from",
-            topology.siteCidr,
-            "to",
-            remoteCidr,
-            "port",
-            String(port)
-          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
-        }
+      for (const remoteAddress of topology.remoteMemberAddresses) {
+        for (const source of topology.localPeerAddresses)
+          for (const port of topology.routedTcpPorts) {
+            await checked2(host, [
+              "/usr/sbin/ufw",
+              "route",
+              "allow",
+              "proto",
+              "tcp",
+              "from",
+              source,
+              "to",
+              remoteAddress,
+              "port",
+              String(port),
+              "comment",
+              firewallComment
+            ], `private routed service ${source}->${remoteAddress}:${port}`);
+          }
       }
     await checked2(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
     await checked2(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");
@@ -2908,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.103";
+var VERSION3 = "0.1.107";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -2971,7 +3067,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/provision.ts
-import { isIP } from "node:net";
+import { isIP as isIP2 } from "node:net";
 function atLeast(version, floor) {
   const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
   const got = parse(version);
@@ -3451,7 +3547,7 @@ function agentUnit(options) {
       throw new Error("compute telemetry endpoint must be an absolute collector URL");
     }
     const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
-    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP2(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
     if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
       throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }
@@ -4399,6 +4495,7 @@ function platformApiCredentialSpecs(options) {
   ];
   return [
     { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
+    { name: "arangodb-root-password", encryptedPath: "/etc/forgezero/creds/arangodb-root-password.cred", required: true },
     { name: "seed-sync-root", encryptedPath: "/etc/forgezero/creds/seed-sync-root.cred", required: true },
     ...optional.filter(([, present]) => present).map(([name]) => ({
       name,
@@ -5078,10 +5175,10 @@ import { constants } from "node:fs";
 import { createHmac, randomUUID as randomUUID4 } from "node:crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "node:fs/promises";
 import { dirname as dirname10, join as join6, resolve as resolve5 } from "node:path";
-import { isIP as isIP3 } from "node:net";
+import { isIP as isIP4 } from "node:net";
 
 // src/cloudflare-edge.ts
-import { isIP as isIP2 } from "node:net";
+import { isIP as isIP3 } from "node:net";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";
@@ -5146,6 +5243,7 @@ var BOOTSTRAP_STATE_PATH = "/var/lib/forgezero/bootstrap.json";
 var STATE_PATH = BOOTSTRAP_STATE_PATH;
 var CREDS = "/etc/forgezero/creds";
 var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ARANGO_ROOT_CREDENTIAL = `${CREDS}/arangodb-root-password.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
@@ -5307,6 +5405,11 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (nginx3.exitCode !== 0)
       problems.push("nginx configuration is invalid");
     if (state.databaseRole !== "none") {
+      for (const credential of [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL]) {
+        services[credential] = host.exists(credential);
+        if (!services[credential])
+          problems.push(`${credential} is missing`);
+      }
       const unitPath = "/etc/systemd/system/forgezero-db.service";
       const expectsNoAgency = state.databaseAgency === "none";
       const unitHasNoAgency = host.exists(unitPath) && host.read(unitPath).includes("--cluster.start-agent=false");

package/dist/platform-launch-env.d.ts

@@ -0,0 +1,19 @@
+import type { ForgeZeroLaunchOwnerInput } from './platform-launch-profile';
+export interface PlatformLaunchEnvironmentInput {
+    owner: ForgeZeroLaunchOwnerInput;
+    emailSecret: string;
+    cloudflareTunnelToken: string;
+    cloudflareApiToken: string;
+    githubClientSecret?: string;
+    githubPrivateKeyBase64?: string;
+    githubWebhookSecret?: string;
+}
+/**
+ * Read the development-only attended-launch adapter.
+ *
+ * The file may contain the API's ordinary non-secret environment as well; this
+ * reader selects only the fixed bootstrap coordinates below. Secret values are
+ * returned to the caller for immediate systemd-creds sealing and are never
+ * copied into the API environment rendered on a target.
+ */
+export declare function readPlatformLaunchEnvironment(path: string): PlatformLaunchEnvironmentInput;

package/dist/provision.js

@@ -1869,7 +1869,7 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 // src/deployment-connectivity.ts
 import { createHash as createHash3 } from "node:crypto";
 import { mkdirSync as mkdirSync4, renameSync as renameSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { createConnection } from "node:net";
+import { createConnection, isIP } from "node:net";
 import { dirname as dirname5 } from "node:path";
 
 // src/process-input.ts
@@ -1956,21 +1956,99 @@ function validate(request) {
     }
   } else if (request.capabilities.private)
     throw new Error("unexpected private deployment capability");
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    if (!/^sha256:[a-f0-9]{64}$/.test(policy.generation) || !Array.isArray(policy.rules) || policy.rules.length > 256) {
+      throw new Error("deployment firewall policy is malformed");
+    }
+    let expanded = 0;
+    for (const rule of policy.rules) {
+      expanded += rule.sourceAddresses.length;
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(rule.ruleKey) || !["allow", "deny"].includes(rule.action) || !["tcp", "udp"].includes(rule.protocol) || rule.sourceAddresses.length < 1 || rule.sourceAddresses.length > 1024 || new Set(rule.sourceAddresses).size !== rule.sourceAddresses.length || rule.sourceAddresses.some((address) => isIP(address) !== 4) || !Number.isSafeInteger(rule.portFrom) || rule.portFrom < 1 || rule.portFrom > 65535 || !Number.isSafeInteger(rule.portTo) || rule.portTo < rule.portFrom || rule.portTo > 65535 || !Number.isSafeInteger(rule.priority) || rule.priority < 0 || rule.priority > 1e6) {
+        throw new Error("deployment firewall policy is malformed");
+      }
+    }
+    if (expanded > 2048)
+      throw new Error("deployment firewall policy expands beyond its rule limit");
+  }
+}
+async function replaceTaggedUfwRules(host, comment) {
+  const status = await checked2(host, ["/usr/sbin/ufw", "status", "numbered"], "firewall inventory");
+  const numbers = status.split(`
+`).flatMap((line) => {
+    if (!line.includes(comment))
+      return [];
+    const match = line.match(/^\s*\[\s*(\d{1,6})\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((value) => Number.isSafeInteger(value) && value > 0).sort((left, right) => right - left);
+  for (const number of numbers)
+    await checked2(host, ["/usr/sbin/ufw", "--force", "delete", String(number)], `stale firewall rule ${number}`);
 }
 async function applyDeploymentConnectivity(request, host = defaultHost) {
   validate(request);
   const id = idFor(request.key);
   const evidence = { key: request.key };
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    const comment = `fz-policy-${id}`;
+    await replaceTaggedUfwRules(host, comment);
+    const ordered = [...policy.rules].sort((left, right) => left.priority - right.priority || (left.action === right.action ? left.ruleKey.localeCompare(right.ruleKey) : left.action === "deny" ? -1 : 1));
+    const commands = [];
+    for (const rule of ordered)
+      for (const source of rule.sourceAddresses)
+        commands.push([
+          "/usr/sbin/ufw",
+          "insert",
+          "1",
+          rule.action,
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          rule.portFrom === rule.portTo ? String(rule.portFrom) : `${rule.portFrom}:${rule.portTo}`,
+          "proto",
+          rule.protocol,
+          "comment",
+          comment
+        ]);
+    const ranges = new Map;
+    for (const rule of ordered)
+      ranges.set(`${rule.protocol}:${rule.portFrom}:${rule.portTo}`, rule);
+    for (const range of ranges.values())
+      commands.push([
+        "/usr/sbin/ufw",
+        "insert",
+        "1",
+        "deny",
+        "to",
+        "any",
+        "port",
+        range.portFrom === range.portTo ? String(range.portFrom) : `${range.portFrom}:${range.portTo}`,
+        "proto",
+        range.protocol,
+        "comment",
+        comment
+      ]);
+    for (const command2 of commands.toReversed())
+      await checked2(host, command2, "deployment firewall rule");
+    evidence.firewall = { generation: policy.generation, rules: commands.length, active: true };
+  }
   const topology = request.topology;
   if (topology) {
-    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const values = [
+      topology.localRelayAddress,
+      ...topology.localPeerAddresses,
+      ...topology.remoteRelayAddresses,
+      ...topology.remoteMemberAddresses
+    ];
     const identities = [
       topology.nodeIdentity,
       ...topology.localPeerIdentities,
       ...topology.remoteRelayIdentities,
       ...topology.memberIdentities
     ];
-    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => isIP(value) !== 4) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.remoteMemberAddresses.length > 1024 || new Set(topology.remoteMemberAddresses).size !== topology.remoteMemberAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
       throw new Error("deployment topology is malformed");
     }
     if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
@@ -2097,28 +2175,46 @@ ${forwarding}${noOp}${starts}${starts ? `
 [Install]
 WantedBy=multi-user.target
 `, 420);
-    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+    const firewallComment = `fz-topology-${id}`;
+    await replaceTaggedUfwRules(host, firewallComment);
+    for (const source of [...new Set([...topology.localPeerAddresses, ...topology.remoteMemberAddresses])]) {
       for (const port of topology.routedTcpPorts) {
-        await checked2(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+        await checked2(host, [
+          "/usr/sbin/ufw",
+          "allow",
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          String(port),
+          "proto",
+          "tcp",
+          "comment",
+          firewallComment
+        ], `private service ${source}:${port}`);
       }
     }
     if (topology.role !== "member")
-      for (const remoteCidr of topology.remoteSiteCidrs) {
-        for (const port of topology.routedTcpPorts) {
-          await checked2(host, [
-            "/usr/sbin/ufw",
-            "route",
-            "allow",
-            "proto",
-            "tcp",
-            "from",
-            topology.siteCidr,
-            "to",
-            remoteCidr,
-            "port",
-            String(port)
-          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
-        }
+      for (const remoteAddress of topology.remoteMemberAddresses) {
+        for (const source of topology.localPeerAddresses)
+          for (const port of topology.routedTcpPorts) {
+            await checked2(host, [
+              "/usr/sbin/ufw",
+              "route",
+              "allow",
+              "proto",
+              "tcp",
+              "from",
+              source,
+              "to",
+              remoteAddress,
+              "port",
+              String(port),
+              "comment",
+              firewallComment
+            ], `private routed service ${source}->${remoteAddress}:${port}`);
+          }
       }
     await checked2(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
     await checked2(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");
@@ -2908,7 +3004,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.103";
+var VERSION3 = "0.1.107";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";
@@ -2971,7 +3067,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/provision.ts
-import { isIP } from "node:net";
+import { isIP as isIP2 } from "node:net";
 function atLeast(version, floor) {
   const parse = (value) => (value.trim().replace(/^v/, "").match(/\d+/g) ?? []).slice(0, 3).map(Number);
   const got = parse(version);
@@ -3451,7 +3547,7 @@ function agentUnit(options) {
       throw new Error("compute telemetry endpoint must be an absolute collector URL");
     }
     const localCollector = endpoint.protocol === "http:" && endpoint.hostname === "127.0.0.1" && endpoint.port === "4318" && endpoint.pathname === "/";
-    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
+    const publicCollector = endpoint.protocol === "https:" && !endpoint.username && !endpoint.password && !endpoint.search && !endpoint.hash && isIP2(endpoint.hostname) === 0 && endpoint.hostname.includes(".") && endpoint.hostname !== "localhost" && !endpoint.hostname.endsWith(".local");
     if (!localCollector && !publicCollector || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
       throw new Error("compute telemetry endpoint must be the supervised loopback collector or credential-free public HTTPS");
     }

package/dist/software-helper.js

@@ -1026,7 +1026,7 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 // src/deployment-connectivity.ts
 import { createHash as createHash2 } from "node:crypto";
 import { mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { createConnection } from "node:net";
+import { createConnection, isIP } from "node:net";
 import { dirname as dirname2 } from "node:path";
 
 // src/process-input.ts
@@ -1113,21 +1113,99 @@ function validate(request) {
     }
   } else if (request.capabilities.private)
     throw new Error("unexpected private deployment capability");
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    if (!/^sha256:[a-f0-9]{64}$/.test(policy.generation) || !Array.isArray(policy.rules) || policy.rules.length > 256) {
+      throw new Error("deployment firewall policy is malformed");
+    }
+    let expanded = 0;
+    for (const rule of policy.rules) {
+      expanded += rule.sourceAddresses.length;
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(rule.ruleKey) || !["allow", "deny"].includes(rule.action) || !["tcp", "udp"].includes(rule.protocol) || rule.sourceAddresses.length < 1 || rule.sourceAddresses.length > 1024 || new Set(rule.sourceAddresses).size !== rule.sourceAddresses.length || rule.sourceAddresses.some((address) => isIP(address) !== 4) || !Number.isSafeInteger(rule.portFrom) || rule.portFrom < 1 || rule.portFrom > 65535 || !Number.isSafeInteger(rule.portTo) || rule.portTo < rule.portFrom || rule.portTo > 65535 || !Number.isSafeInteger(rule.priority) || rule.priority < 0 || rule.priority > 1e6) {
+        throw new Error("deployment firewall policy is malformed");
+      }
+    }
+    if (expanded > 2048)
+      throw new Error("deployment firewall policy expands beyond its rule limit");
+  }
+}
+async function replaceTaggedUfwRules(host, comment) {
+  const status = await checked(host, ["/usr/sbin/ufw", "status", "numbered"], "firewall inventory");
+  const numbers = status.split(`
+`).flatMap((line) => {
+    if (!line.includes(comment))
+      return [];
+    const match = line.match(/^\s*\[\s*(\d{1,6})\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((value) => Number.isSafeInteger(value) && value > 0).sort((left, right) => right - left);
+  for (const number of numbers)
+    await checked(host, ["/usr/sbin/ufw", "--force", "delete", String(number)], `stale firewall rule ${number}`);
 }
 async function applyDeploymentConnectivity(request, host = defaultHost) {
   validate(request);
   const id = idFor(request.key);
   const evidence = { key: request.key };
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    const comment = `fz-policy-${id}`;
+    await replaceTaggedUfwRules(host, comment);
+    const ordered = [...policy.rules].sort((left, right) => left.priority - right.priority || (left.action === right.action ? left.ruleKey.localeCompare(right.ruleKey) : left.action === "deny" ? -1 : 1));
+    const commands = [];
+    for (const rule of ordered)
+      for (const source of rule.sourceAddresses)
+        commands.push([
+          "/usr/sbin/ufw",
+          "insert",
+          "1",
+          rule.action,
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          rule.portFrom === rule.portTo ? String(rule.portFrom) : `${rule.portFrom}:${rule.portTo}`,
+          "proto",
+          rule.protocol,
+          "comment",
+          comment
+        ]);
+    const ranges = new Map;
+    for (const rule of ordered)
+      ranges.set(`${rule.protocol}:${rule.portFrom}:${rule.portTo}`, rule);
+    for (const range of ranges.values())
+      commands.push([
+        "/usr/sbin/ufw",
+        "insert",
+        "1",
+        "deny",
+        "to",
+        "any",
+        "port",
+        range.portFrom === range.portTo ? String(range.portFrom) : `${range.portFrom}:${range.portTo}`,
+        "proto",
+        range.protocol,
+        "comment",
+        comment
+      ]);
+    for (const command of commands.toReversed())
+      await checked(host, command, "deployment firewall rule");
+    evidence.firewall = { generation: policy.generation, rules: commands.length, active: true };
+  }
   const topology = request.topology;
   if (topology) {
-    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const values = [
+      topology.localRelayAddress,
+      ...topology.localPeerAddresses,
+      ...topology.remoteRelayAddresses,
+      ...topology.remoteMemberAddresses
+    ];
     const identities = [
       topology.nodeIdentity,
       ...topology.localPeerIdentities,
       ...topology.remoteRelayIdentities,
       ...topology.memberIdentities
     ];
-    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => isIP(value) !== 4) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.remoteMemberAddresses.length > 1024 || new Set(topology.remoteMemberAddresses).size !== topology.remoteMemberAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
       throw new Error("deployment topology is malformed");
     }
     if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
@@ -1254,28 +1332,46 @@ ${forwarding}${noOp}${starts}${starts ? `
 [Install]
 WantedBy=multi-user.target
 `, 420);
-    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+    const firewallComment = `fz-topology-${id}`;
+    await replaceTaggedUfwRules(host, firewallComment);
+    for (const source of [...new Set([...topology.localPeerAddresses, ...topology.remoteMemberAddresses])]) {
       for (const port of topology.routedTcpPorts) {
-        await checked(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+        await checked(host, [
+          "/usr/sbin/ufw",
+          "allow",
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          String(port),
+          "proto",
+          "tcp",
+          "comment",
+          firewallComment
+        ], `private service ${source}:${port}`);
       }
     }
     if (topology.role !== "member")
-      for (const remoteCidr of topology.remoteSiteCidrs) {
-        for (const port of topology.routedTcpPorts) {
-          await checked(host, [
-            "/usr/sbin/ufw",
-            "route",
-            "allow",
-            "proto",
-            "tcp",
-            "from",
-            topology.siteCidr,
-            "to",
-            remoteCidr,
-            "port",
-            String(port)
-          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
-        }
+      for (const remoteAddress of topology.remoteMemberAddresses) {
+        for (const source of topology.localPeerAddresses)
+          for (const port of topology.routedTcpPorts) {
+            await checked(host, [
+              "/usr/sbin/ufw",
+              "route",
+              "allow",
+              "proto",
+              "tcp",
+              "from",
+              source,
+              "to",
+              remoteAddress,
+              "port",
+              String(port),
+              "comment",
+              firewallComment
+            ], `private routed service ${source}->${remoteAddress}:${port}`);
+          }
       }
     await checked(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
     await checked(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");