@forgezero/agent 0.1.103 → 0.1.108

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.103";
+var VERSION3 = "0.1.108";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap-bundle.d.ts

@@ -30,3 +30,9 @@ export declare const bootstrapBundleBranch: (value: unknown) => string;
 export declare function parseBootstrapBundleManifest(value: unknown): BootstrapBundleManifest;
 export declare function readBootstrapBundle(bundlePath: string, manifestPath?: string): Promise<BootstrapBundleBuildResult>;
 export declare function buildBootstrapBundle(input: BootstrapBundleBuildInput, exec?: BootstrapBundleCommand): Promise<BootstrapBundleBuildResult>;
+/**
+ * Make the reviewed branch head the canonical launch bundle without silently
+ * reusing an older release. The previous verified pair is retained beside the
+ * new pair so an attended operator can inspect or restore it.
+ */
+export declare function refreshBootstrapBundle(input: BootstrapBundleBuildInput, exec?: BootstrapBundleCommand): Promise<BootstrapBundleBuildResult>;

package/dist/bootstrap-bundle.js

@@ -154,8 +154,49 @@ async function buildBootstrapBundle(input, exec = run) {
     throw cause;
   }
 }
+async function refreshBootstrapBundle(input, exec = run) {
+  const outputPath = resolve(input.outputPath);
+  const manifestPath = `${outputPath}.json`;
+  if (existsSync(outputPath) !== existsSync(manifestPath)) {
+    throw new Error("bootstrap bundle and manifest must either both exist or both be absent");
+  }
+  const candidatePath = `${outputPath}.candidate.${process.pid}.${randomBytes(6).toString("hex")}`;
+  const candidate = await buildBootstrapBundle({ ...input, outputPath: candidatePath }, exec);
+  try {
+    if (!existsSync(outputPath)) {
+      renameSync(candidate.bundlePath, outputPath);
+      renameSync(candidate.manifestPath, manifestPath);
+      return readBootstrapBundle(outputPath);
+    }
+    const current = await readBootstrapBundle(outputPath);
+    if (current.manifest.branch === candidate.manifest.branch && current.manifest.revision === candidate.manifest.revision) {
+      rmSync(candidate.bundlePath, { force: true });
+      rmSync(candidate.manifestPath, { force: true });
+      return current;
+    }
+    const archivePath = `${outputPath}.before-${current.manifest.revision.slice(0, 7)}-${Date.now()}`;
+    const archiveManifestPath = `${archivePath}.json`;
+    renameSync(outputPath, archivePath);
+    renameSync(manifestPath, archiveManifestPath);
+    try {
+      renameSync(candidate.bundlePath, outputPath);
+      renameSync(candidate.manifestPath, manifestPath);
+      return readBootstrapBundle(outputPath);
+    } catch (cause) {
+      rmSync(outputPath, { force: true });
+      rmSync(manifestPath, { force: true });
+      renameSync(archivePath, outputPath);
+      renameSync(archiveManifestPath, manifestPath);
+      throw cause;
+    }
+  } finally {
+    rmSync(candidate.bundlePath, { force: true });
+    rmSync(candidate.manifestPath, { force: true });
+  }
+}
 export {
   sha256File,
+  refreshBootstrapBundle,
   readBootstrapBundle,
   parseBootstrapBundleManifest,
   buildBootstrapBundle,

package/dist/bootstrap.d.ts

@@ -115,10 +115,7 @@ export interface PlatformBootstrapSecrets {
     backupS3Secret?: string;
     cloudflareTunnelToken?: string;
     cloudflareApiToken?: string;
-    githubClientSecret?: string;
-    /** One-line base64 form accepted by prompts/env; decoded before systemd sealing. */
-    githubPrivateKeyBase64?: string;
-    githubWebhookSecret?: string;
+    githubOAuthClientSecret: string;
 }
 export interface EnrolledComputeBootstrapSecrets {
     enrolmentToken: string;

package/dist/bootstrap.js

@@ -1384,9 +1384,49 @@ async function buildBootstrapBundle(input, exec = run) {
     throw cause;
   }
 }
+async function refreshBootstrapBundle(input, exec = run) {
+  const outputPath = resolve2(input.outputPath);
+  const manifestPath = `${outputPath}.json`;
+  if (existsSync(outputPath) !== existsSync(manifestPath)) {
+    throw new Error("bootstrap bundle and manifest must either both exist or both be absent");
+  }
+  const candidatePath = `${outputPath}.candidate.${process.pid}.${randomBytes(6).toString("hex")}`;
+  const candidate = await buildBootstrapBundle({ ...input, outputPath: candidatePath }, exec);
+  try {
+    if (!existsSync(outputPath)) {
+      renameSync(candidate.bundlePath, outputPath);
+      renameSync(candidate.manifestPath, manifestPath);
+      return readBootstrapBundle(outputPath);
+    }
+    const current = await readBootstrapBundle(outputPath);
+    if (current.manifest.branch === candidate.manifest.branch && current.manifest.revision === candidate.manifest.revision) {
+      rmSync(candidate.bundlePath, { force: true });
+      rmSync(candidate.manifestPath, { force: true });
+      return current;
+    }
+    const archivePath = `${outputPath}.before-${current.manifest.revision.slice(0, 7)}-${Date.now()}`;
+    const archiveManifestPath = `${archivePath}.json`;
+    renameSync(outputPath, archivePath);
+    renameSync(manifestPath, archiveManifestPath);
+    try {
+      renameSync(candidate.bundlePath, outputPath);
+      renameSync(candidate.manifestPath, manifestPath);
+      return readBootstrapBundle(outputPath);
+    } catch (cause) {
+      rmSync(outputPath, { force: true });
+      rmSync(manifestPath, { force: true });
+      renameSync(archivePath, outputPath);
+      renameSync(archiveManifestPath, manifestPath);
+      throw cause;
+    }
+  } finally {
+    rmSync(candidate.bundlePath, { force: true });
+    rmSync(candidate.manifestPath, { force: true });
+  }
+}
 
 // src/bootstrap.ts
-import { createHash as createHash2, createHmac as createHmac2, createPrivateKey, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
 import {
   chmodSync as chmodSync3,
   existsSync as existsSync5,
@@ -1420,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.103";
+var VERSION = "0.1.108";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3188,10 +3228,8 @@ function validatePlatformSharedEnvironment(input) {
   } else if (input.email !== undefined) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
-  if (input.githubApp) {
-    if (!/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubApp.clientId) || !/^[1-9][0-9]{0,19}$/.test(input.githubApp.appId) || !/^[a-z0-9][a-z0-9-]{0,99}$/.test(input.githubApp.slug)) {
-      throw new Error("GitHub App client id, app id or slug is malformed.");
-    }
+  if (!input.githubOAuth || !/^(?:Iv1\.[A-Fa-f0-9]{16}|Ov23li[A-Za-z0-9]{14,})$/.test(input.githubOAuth.clientId)) {
+    throw new Error("GitHub OAuth client id is malformed.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
   if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
@@ -3323,9 +3361,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_REALTIME_WORKER_SCRIPT: value.realtime?.workerScriptName ?? "",
     FZ_REALTIME_ENDPOINT: value.realtime?.endpoint ?? "",
     FZ_REALTIME_PRODUCER: value.realtime?.producer ?? "",
-    FZ_GITHUB_CLIENT_ID: value.githubApp?.clientId ?? "",
-    FZ_GITHUB_APP_ID: value.githubApp?.appId ?? "",
-    FZ_GITHUB_APP_SLUG: value.githubApp?.slug ?? "",
+    FZ_GITHUB_OAUTH_CLIENT_ID: value.githubOAuth.clientId,
     FZ_PLATFORM_INITIAL_INVENTORY: value.initialInventory ? JSON.stringify(value.initialInventory) : ""
   };
   return `# Generated by fz bootstrap platform. Non-secret coordinates only.
@@ -3337,9 +3373,7 @@ function platformApiCredentialSpecs(options) {
   const optional = [
     ["fz_smtp.password", options.emailProvider === "smtp"],
     ["fz_jetemail.apiKey", options.emailProvider === "jetemail"],
-    ["fz_github.clientSecret", options.githubApp],
-    ["fz_github.privateKey", options.githubApp],
-    ["fz_github.webhookSecret", options.githubApp],
+    ["fz_oauth.github.clientSecret", options.githubOAuth],
     ["CF_API_TOKEN", options.cloudflareKv],
     ["CF_TUNNEL_TOKEN", options.cloudflareKv],
     ["REALTIME_PUBLISH_SECRET", options.realtime],
@@ -3347,6 +3381,7 @@ function platformApiCredentialSpecs(options) {
   ];
   return [
     { name: "arangodb-jwt", encryptedPath: "/etc/forgezero/creds/arangodb-jwt.cred", required: true },
+    { name: "arangodb-root-password", encryptedPath: "/etc/forgezero/creds/arangodb-root-password.cred", required: true },
     { name: "seed-sync-root", encryptedPath: "/etc/forgezero/creds/seed-sync-root.cred", required: true },
     ...optional.filter(([, present]) => present).map(([name]) => ({
       name,
@@ -3742,9 +3777,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     "backupS3Secret",
     "cloudflareTunnelToken",
     "cloudflareApiToken",
-    "githubClientSecret",
-    "githubPrivateKeyBase64",
-    "githubWebhookSecret"
+    "githubOAuthClientSecret"
   ];
   const unknown = Object.keys(source).filter((key) => !allowed.includes(key));
   if (unknown.length)
@@ -3755,9 +3788,7 @@ function validatePlatformBootstrapSecrets(config, input) {
   const backupS3Secret = typeof source.backupS3Secret === "string" ? source.backupS3Secret.trim() : undefined;
   const cloudflareTunnelToken = typeof source.cloudflareTunnelToken === "string" ? source.cloudflareTunnelToken.trim() : undefined;
   const cloudflareApiToken = typeof source.cloudflareApiToken === "string" ? source.cloudflareApiToken.trim() : undefined;
-  const githubClientSecret = typeof source.githubClientSecret === "string" ? source.githubClientSecret.trim() : undefined;
-  const githubPrivateKeyBase64 = typeof source.githubPrivateKeyBase64 === "string" ? source.githubPrivateKeyBase64.trim() : undefined;
-  const githubWebhookSecret = typeof source.githubWebhookSecret === "string" ? source.githubWebhookSecret.trim() : undefined;
+  const githubOAuthClientSecret = typeof source.githubOAuthClientSecret === "string" ? source.githubOAuthClientSecret.trim() : "";
   if (!/^[a-f0-9]{64}$/i.test(clusterBootstrapCode))
     throw new Error("cluster bootstrap code must contain exactly 64 hexadecimal characters");
   if (!emailSecret || emailSecret.length > 16384 || /[\r\n\0]/.test(emailSecret))
@@ -3777,21 +3808,8 @@ function validatePlatformBootstrapSecrets(config, input) {
   }
   if (cloudflareTunnelToken)
     validateCloudflareBootstrapSecretPair({ cloudflareTunnelToken, cloudflareApiToken });
-  const githubConfigured = Boolean(config.runtime.environment.githubApp);
-  if (githubConfigured !== Boolean(githubClientSecret && githubPrivateKeyBase64 && githubWebhookSecret)) {
-    throw new Error("GitHub App coordinates require client secret, private key and webhook secret together");
-  }
-  if (githubConfigured) {
-    if (githubClientSecret.length < 20 || githubClientSecret.length > 512 || /[\r\n\0]/.test(githubClientSecret) || githubWebhookSecret.length < 32 || githubWebhookSecret.length > 512 || /[\r\n\0]/.test(githubWebhookSecret)) {
-      throw new Error("GitHub App client or webhook secret is malformed");
-    }
-    try {
-      const pem = Buffer.from(githubPrivateKeyBase64, "base64").toString("utf8");
-      if (createPrivateKey(pem).asymmetricKeyType !== "rsa")
-        throw new Error("not RSA");
-    } catch {
-      throw new Error("GitHub App private key must be a base64-encoded RSA private key");
-    }
+  if (githubOAuthClientSecret.length < 20 || githubOAuthClientSecret.length > 512 || /[\r\n\0]/.test(githubOAuthClientSecret)) {
+    throw new Error("GitHub OAuth client secret is malformed");
   }
   return {
     clusterBootstrapCode,
@@ -3799,7 +3817,7 @@ function validatePlatformBootstrapSecrets(config, input) {
     ...enrolmentToken ? { enrolmentToken } : {},
     ...backupS3Secret ? { backupS3Secret } : {},
     ...cloudflareTunnelToken ? { cloudflareTunnelToken, cloudflareApiToken } : {},
-    ...githubConfigured ? { githubClientSecret, githubPrivateKeyBase64, githubWebhookSecret } : {}
+    githubOAuthClientSecret
   };
 }
 var platformBootstrapRunner = (config) => config.kind === "platform" && config.database.role === "master";
@@ -3814,6 +3832,7 @@ var STATE_PATH = BOOTSTRAP_STATE_PATH;
 var INTENT_PATH = "/var/lib/forgezero/bootstrap.intent.json";
 var CREDS = "/etc/forgezero/creds";
 var JWT_CREDENTIAL = `${CREDS}/arangodb-jwt.cred`;
+var ARANGO_ROOT_CREDENTIAL = `${CREDS}/arangodb-root-password.cred`;
 var ENROL_CREDENTIAL = `${CREDS}/enrol-token.cred`;
 var TUNNEL_CREDENTIAL = `${CREDS}/CF_TUNNEL_CONNECTOR_TOKEN.cred`;
 var CF_API_CREDENTIAL = `${CREDS}/CF_API_TOKEN.cred`;
@@ -4099,7 +4118,7 @@ WantedBy=multi-user.target
 function databaseVerifyUnit(config) {
   const { address } = config.database;
   return `[Unit]
-Description=Verify ForgeZero ArangoDB Community 3.11.14 writable Coordinator
+Description=Secure and verify ForgeZero ArangoDB Community 3.11.14 writable Coordinator
 Requires=forgezero-db.service
 After=forgezero-db.service
 PartOf=forgezero-db.service
@@ -4109,7 +4128,9 @@ Type=oneshot
 User=arangodb
 Group=arangodb
 LoadCredentialEncrypted=arangodb-jwt:${JWT_CREDENTIAL}
-ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));'
+LoadCredentialEncrypted=arangodb-root-password:${ARANGO_ROOT_CREDENTIAL}
+ExecStart=/usr/bin/arangosh --server.endpoint tcp://${unitEscape(address)}:8529 --server.jwt-secret-keyfile %d/arangodb-jwt --javascript.execute-string 'const c=require("@arangodb").db._connection;let last;let ok=false;for(let i=0;i<90;i++){try{const v=c.GET("/_api/version?details=true");const s=c.GET("/_admin/status");const m=c.GET("/_admin/server/mode");if(!v.error&&v.version==="3.11.14"&&v.details&&v.details.license==="community"&&!s.error&&s.serverInfo&&s.serverInfo.role==="COORDINATOR"&&!m.error&&m.mode==="default"){ok=true;break;}last={v,s,m};}catch(e){last=String(e);}require("internal").wait(2);}if(!ok)throw new Error("writable Community Coordinator verification failed: "+JSON.stringify(last));const password=require("fs").read("%d/arangodb-root-password").trim();if(password.length<48)throw new Error("ArangoDB root credential is malformed");require("@arangodb/users").update("root",password,true);'
+ExecStart=/usr/local/bin/fz-agent database-auth-verify --endpoint=http://${unitEscape(address)}:8529
 RemainAfterExit=yes
 TimeoutStartSec=200
 NoNewPrivileges=true
@@ -4576,6 +4597,11 @@ async function bootstrapStatus(host = localBootstrapHost()) {
     if (nginx.exitCode !== 0)
       problems.push("nginx configuration is invalid");
     if (state.databaseRole !== "none") {
+      for (const credential of [JWT_CREDENTIAL, ARANGO_ROOT_CREDENTIAL]) {
+        services[credential] = host.exists(credential);
+        if (!services[credential])
+          problems.push(`${credential} is missing`);
+      }
       const unitPath = "/etc/systemd/system/forgezero-db.service";
       const expectsNoAgency = state.databaseAgency === "none";
       const unitHasNoAgency = host.exists(unitPath) && host.read(unitPath).includes("--cluster.start-agent=false");
@@ -4715,9 +4741,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       backup: checked4.backupS3Secret,
       cloudflareTunnelToken: checked4.cloudflareTunnelToken,
       cloudflareApiToken: checked4.cloudflareApiToken,
-      githubClientSecret: checked4.githubClientSecret,
-      githubPrivateKey: checked4.githubPrivateKeyBase64 ? Buffer.from(checked4.githubPrivateKeyBase64, "base64").toString("utf8") : undefined,
-      githubWebhookSecret: checked4.githubWebhookSecret
+      githubOAuthClientSecret: checked4.githubOAuthClientSecret
     };
   })() : undefined;
   const enrolledPrivate = config.kind === "enrolled-compute" ? validateEnrolledComputeBootstrapSecrets(config, secrets) : undefined;
@@ -4810,14 +4834,15 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     if (!host.exists(JWT_CREDENTIAL)) {
       await seal(host, "arangodb-jwt", JWT_CREDENTIAL, derive(root, "forgezero/cluster/arangodb-jwt/v1"));
     }
+    if (!host.exists(ARANGO_ROOT_CREDENTIAL)) {
+      await seal(host, "arangodb-root-password", ARANGO_ROOT_CREDENTIAL, `fzr_${derive(root, "forgezero/cluster/arangodb-root-password/v1")}`);
+    }
     await seal(host, "seed-sync-root", SEED_CREDENTIAL, derive(root, "forgezero/cluster/seed-mesh/v1"));
     await seal(host, "backup-recovery-root", BACKUP_RECOVERY_CREDENTIAL, derive(root, "forgezero/backup/recovery-root/v1"));
     const emailCredentialName = config.runtime.environment.email?.provider === "smtp" ? "fz_smtp.password" : config.runtime.environment.email?.provider === "jetemail" ? "fz_jetemail.apiKey" : undefined;
     for (const [name, source] of Object.entries({
       ...emailCredentialName ? { [emailCredentialName]: platformPrivate.email } : {},
-      "fz_github.clientSecret": platformPrivate.githubClientSecret,
-      "fz_github.privateKey": platformPrivate.githubPrivateKey,
-      "fz_github.webhookSecret": platformPrivate.githubWebhookSecret,
+      "fz_oauth.github.clientSecret": platformPrivate.githubOAuthClientSecret,
       "backup.s3.secretAccessKey": platformPrivate.backup
     })) {
       if (source) {
@@ -4834,7 +4859,7 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
     const credentials = platformApiCredentialSpecs({
       emailProvider: runtime.environment.email?.provider,
       cloudflareKv: cloudflareConfigured,
-      githubApp: Boolean(runtime.environment.githubApp),
+      githubOAuth: true,
       realtime: Boolean(runtime.environment.realtime)
     });
     const units = renderPlatformApiUnits({
@@ -5082,6 +5107,7 @@ function strictBootstrapDocument(value) {
       "agentOtlpEndpoint",
       "custodianEmail",
       "email",
+      "githubOAuth",
       "deployProfile",
       "otlpFlushIntervalMs",
       "otlpTraceSampleRatio",
@@ -5092,8 +5118,13 @@ function strictBootstrapDocument(value) {
       "databaseReadPreferredCoordinators"
     ], "runtime environment");
     const environment = runtime.environment;
+    exactKeys(environment.githubOAuth, ["clientId"], "GitHub OAuth config");
     if (environment.initialInventory !== undefined) {
-      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "region", "computes", "attestation", "deployment"], "initial inventory");
+      const inventory = exactKeys(environment.initialInventory, ["metalHostname", "metalIdentity", "region", "computes", "attestation", "deployment"], "initial inventory");
+      if (inventory.metalIdentity !== undefined) {
+        const identity = exactKeys(inventory.metalIdentity, ["nodeKey", "publicKeys"], "initial Metal identity");
+        exactKeys(identity.publicKeys, ["ed25519", "mlDsa"], "initial Metal public keys");
+      }
       exactKeys(inventory.region, ["key", "label", "country", "city", "confidentialCapable"], "initial inventory region");
       if (inventory.attestation !== undefined) {
         const attestation = exactKeys(inventory.attestation, ["measurement", "tcbFloor"], "initial attestation evidence");

package/dist/database-auth-verify.d.ts

@@ -0,0 +1,6 @@
+export interface DatabaseAuthVerifyOptions {
+    readCredential(): string;
+    fetcher?: typeof fetch;
+}
+/** Proves root is not empty and the sealed break-glass credential is active. */
+export declare function verifyDatabaseAuthentication(rawEndpoint: string, options: DatabaseAuthVerifyOptions): Promise<void>;

package/dist/deployment-connectivity.d.ts

@@ -42,17 +42,33 @@ export interface DeploymentConnectivityTopology {
     localPeerIdentities: readonly string[];
     remoteRelayAddresses: readonly string[];
     remoteRelayIdentities: readonly string[];
+    remoteMemberAddresses: readonly string[];
     remoteSiteCidrs: readonly string[];
     memberIdentities: readonly string[];
     healthPort: number;
     routedTcpPorts: readonly number[];
     generation: string;
 }
+export interface DeploymentFirewallRule {
+    ruleKey: string;
+    action: 'allow' | 'deny';
+    protocol: 'tcp' | 'udp';
+    sourceAddresses: readonly string[];
+    portFrom: number;
+    portTo: number;
+    priority: number;
+}
+/** API-compiled, exact-address policy. Names and selectors never reach the host. */
+export interface DeploymentFirewallPolicy {
+    generation: `sha256:${string}`;
+    rules: readonly DeploymentFirewallRule[];
+}
 export interface DeploymentConnectivityRequest {
     key: string;
     intent: DeploymentConnectivityIntent;
     capabilities: DeploymentConnectivityCapabilities;
     topology?: DeploymentConnectivityTopology;
+    firewallPolicy?: DeploymentFirewallPolicy;
 }
 export interface DeploymentConnectivityEvidence {
     key: string;
@@ -74,6 +90,11 @@ export interface DeploymentConnectivityEvidence {
         role: DeploymentConnectivityTopology['role'];
         probed: string[];
     };
+    firewall?: {
+        generation: string;
+        rules: number;
+        active: true;
+    };
 }
 export interface DeploymentConnectivityHost {
     seal(name: string, path: string, value: string): Promise<void>;

package/dist/deployment-connectivity.js

@@ -1,7 +1,7 @@
 // src/deployment-connectivity.ts
 import { createHash } from "node:crypto";
 import { mkdirSync, renameSync, writeFileSync } from "node:fs";
-import { createConnection } from "node:net";
+import { createConnection, isIP } from "node:net";
 import { dirname } from "node:path";
 
 // src/process-input.ts
@@ -88,21 +88,99 @@ function validate(request) {
     }
   } else if (request.capabilities.private)
     throw new Error("unexpected private deployment capability");
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    if (!/^sha256:[a-f0-9]{64}$/.test(policy.generation) || !Array.isArray(policy.rules) || policy.rules.length > 256) {
+      throw new Error("deployment firewall policy is malformed");
+    }
+    let expanded = 0;
+    for (const rule of policy.rules) {
+      expanded += rule.sourceAddresses.length;
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(rule.ruleKey) || !["allow", "deny"].includes(rule.action) || !["tcp", "udp"].includes(rule.protocol) || rule.sourceAddresses.length < 1 || rule.sourceAddresses.length > 1024 || new Set(rule.sourceAddresses).size !== rule.sourceAddresses.length || rule.sourceAddresses.some((address) => isIP(address) !== 4) || !Number.isSafeInteger(rule.portFrom) || rule.portFrom < 1 || rule.portFrom > 65535 || !Number.isSafeInteger(rule.portTo) || rule.portTo < rule.portFrom || rule.portTo > 65535 || !Number.isSafeInteger(rule.priority) || rule.priority < 0 || rule.priority > 1e6) {
+        throw new Error("deployment firewall policy is malformed");
+      }
+    }
+    if (expanded > 2048)
+      throw new Error("deployment firewall policy expands beyond its rule limit");
+  }
+}
+async function replaceTaggedUfwRules(host, comment) {
+  const status = await checked(host, ["/usr/sbin/ufw", "status", "numbered"], "firewall inventory");
+  const numbers = status.split(`
+`).flatMap((line) => {
+    if (!line.includes(comment))
+      return [];
+    const match = line.match(/^\s*\[\s*(\d{1,6})\]/);
+    return match ? [Number(match[1])] : [];
+  }).filter((value) => Number.isSafeInteger(value) && value > 0).sort((left, right) => right - left);
+  for (const number of numbers)
+    await checked(host, ["/usr/sbin/ufw", "--force", "delete", String(number)], `stale firewall rule ${number}`);
 }
 async function applyDeploymentConnectivity(request, host = defaultHost) {
   validate(request);
   const id = idFor(request.key);
   const evidence = { key: request.key };
+  if (request.firewallPolicy) {
+    const policy = request.firewallPolicy;
+    const comment = `fz-policy-${id}`;
+    await replaceTaggedUfwRules(host, comment);
+    const ordered = [...policy.rules].sort((left, right) => left.priority - right.priority || (left.action === right.action ? left.ruleKey.localeCompare(right.ruleKey) : left.action === "deny" ? -1 : 1));
+    const commands = [];
+    for (const rule of ordered)
+      for (const source of rule.sourceAddresses)
+        commands.push([
+          "/usr/sbin/ufw",
+          "insert",
+          "1",
+          rule.action,
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          rule.portFrom === rule.portTo ? String(rule.portFrom) : `${rule.portFrom}:${rule.portTo}`,
+          "proto",
+          rule.protocol,
+          "comment",
+          comment
+        ]);
+    const ranges = new Map;
+    for (const rule of ordered)
+      ranges.set(`${rule.protocol}:${rule.portFrom}:${rule.portTo}`, rule);
+    for (const range of ranges.values())
+      commands.push([
+        "/usr/sbin/ufw",
+        "insert",
+        "1",
+        "deny",
+        "to",
+        "any",
+        "port",
+        range.portFrom === range.portTo ? String(range.portFrom) : `${range.portFrom}:${range.portTo}`,
+        "proto",
+        range.protocol,
+        "comment",
+        comment
+      ]);
+    for (const command of commands.toReversed())
+      await checked(host, command, "deployment firewall rule");
+    evidence.firewall = { generation: policy.generation, rules: commands.length, active: true };
+  }
   const topology = request.topology;
   if (topology) {
-    const values = [topology.localRelayAddress, ...topology.localPeerAddresses, ...topology.remoteRelayAddresses];
+    const values = [
+      topology.localRelayAddress,
+      ...topology.localPeerAddresses,
+      ...topology.remoteRelayAddresses,
+      ...topology.remoteMemberAddresses
+    ];
     const identities = [
       topology.nodeIdentity,
       ...topology.localPeerIdentities,
       ...topology.remoteRelayIdentities,
       ...topology.memberIdentities
     ];
-    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => !/^(?:\d{1,3}\.){3}\d{1,3}$/.test(value)) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
+    if (!/^[A-Za-z0-9.-]{1,253}$/.test(topology.site) || !/^(?:\d{1,3}\.){3}0\/24$/.test(topology.siteCidr) || values.some((value) => isIP(value) !== 4) || identities.some((value) => !/^[A-Za-z0-9.-]{1,253}$/.test(value)) || topology.localPeerIdentities.length !== topology.localPeerAddresses.length || topology.remoteRelayIdentities.length !== topology.remoteRelayAddresses.length || topology.remoteMemberAddresses.length > 1024 || new Set(topology.remoteMemberAddresses).size !== topology.remoteMemberAddresses.length || topology.memberIdentities.length < 1 || topology.memberIdentities.length > 1024 || new Set(topology.memberIdentities).size !== topology.memberIdentities.length || !topology.memberIdentities.includes(topology.nodeIdentity) || !/^sha256:[a-f0-9]{64}$/.test(topology.generation) || (topology.role === "member" ? topology.remoteRelayAddresses.length !== 0 : topology.remoteSiteCidrs.length !== topology.remoteRelayAddresses.length) || topology.remoteSiteCidrs.some((value) => !/^(?:\d{1,3}\.){3}0\/24$/.test(value)) || new Set(topology.remoteSiteCidrs).size !== topology.remoteSiteCidrs.length || !Number.isSafeInteger(topology.healthPort) || topology.healthPort < 1 || topology.healthPort > 65535 || topology.routedTcpPorts.length < 1 || topology.routedTcpPorts.length > 64 || new Set(topology.routedTcpPorts).size !== topology.routedTcpPorts.length || !topology.routedTcpPorts.includes(topology.healthPort) || topology.routedTcpPorts.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65535) || topology.role === "member" && topology.transport !== "private-lan") {
       throw new Error("deployment topology is malformed");
     }
     if (request.intent.private?.mode === "cloudflare-warp" !== (topology.transport === "cloudflare-warp")) {
@@ -229,28 +307,46 @@ ${forwarding}${noOp}${starts}${starts ? `
 [Install]
 WantedBy=multi-user.target
 `, 420);
-    for (const source of [...new Set([topology.siteCidr, ...topology.remoteSiteCidrs])]) {
+    const firewallComment = `fz-topology-${id}`;
+    await replaceTaggedUfwRules(host, firewallComment);
+    for (const source of [...new Set([...topology.localPeerAddresses, ...topology.remoteMemberAddresses])]) {
       for (const port of topology.routedTcpPorts) {
-        await checked(host, ["/usr/sbin/ufw", "allow", "from", source, "to", "any", "port", String(port), "proto", "tcp"], `private service ${source}:${port}`);
+        await checked(host, [
+          "/usr/sbin/ufw",
+          "allow",
+          "from",
+          source,
+          "to",
+          "any",
+          "port",
+          String(port),
+          "proto",
+          "tcp",
+          "comment",
+          firewallComment
+        ], `private service ${source}:${port}`);
       }
     }
     if (topology.role !== "member")
-      for (const remoteCidr of topology.remoteSiteCidrs) {
-        for (const port of topology.routedTcpPorts) {
-          await checked(host, [
-            "/usr/sbin/ufw",
-            "route",
-            "allow",
-            "proto",
-            "tcp",
-            "from",
-            topology.siteCidr,
-            "to",
-            remoteCidr,
-            "port",
-            String(port)
-          ], `private routed service ${topology.siteCidr}->${remoteCidr}:${port}`);
-        }
+      for (const remoteAddress of topology.remoteMemberAddresses) {
+        for (const source of topology.localPeerAddresses)
+          for (const port of topology.routedTcpPorts) {
+            await checked(host, [
+              "/usr/sbin/ufw",
+              "route",
+              "allow",
+              "proto",
+              "tcp",
+              "from",
+              source,
+              "to",
+              remoteAddress,
+              "port",
+              String(port),
+              "comment",
+              firewallComment
+            ], `private routed service ${source}->${remoteAddress}:${port}`);
+          }
       }
     await checked(host, ["/usr/bin/systemctl", "daemon-reload"], "topology daemon reload");
     await checked(host, ["/usr/bin/systemctl", "enable", "--now", routeUnit], "topology routes");

package/dist/deployment-pull.d.ts

@@ -1,5 +1,5 @@
 import type { NodeKeyPair } from '@forgezero/runtime/identity';
-import type { DeploymentManager, DeploymentResult, GitSourceAuth } from './deployment';
+import { type DeploymentManager, type DeploymentResult, type GitSourceAuth } from './deployment';
 import type { AgentOperationTelemetry } from './telemetry-runtime';
 export interface RemoteDeploymentClaim {
     runKey: string;

package/dist/deployment-topology.d.ts

@@ -21,6 +21,8 @@ export interface DeploymentTopologyAssignment extends DeploymentTopologyPlacemen
     localPeerIdentities: readonly string[];
     remoteRelayAddresses: readonly string[];
     remoteRelayIdentities: readonly string[];
+    /** Exact deployment members at other Metal sites; used for host firewall authority. */
+    remoteMemberAddresses: readonly string[];
     remoteSiteCidrs: readonly string[];
     memberIdentities: readonly string[];
     healthPort: number;

package/dist/deployment-topology.js

@@ -80,6 +80,7 @@ function planDeploymentTopology(args) {
     const relay = active.get(site);
     const remoteRelayAddresses = siteNames.filter((other) => other !== site).map((other) => active.get(other).privateAddress);
     const remoteRelayIdentities = siteNames.filter((other) => other !== site).map((other) => active.get(other).nodeIdentity);
+    const remoteMemberAddresses = siteNames.filter((other) => other !== site).flatMap((other) => sites.get(other).map(({ privateAddress }) => privateAddress));
     const remoteSiteCidrs = siteNames.filter((other) => other !== site).map((other) => siteCidrs.get(other));
     return members.map((placement, index) => {
       const role = index === 0 ? "relay" : index === 1 && topology.relays.standbyPerMetal === 1 ? "standby" : "member";
@@ -97,6 +98,7 @@ function planDeploymentTopology(args) {
         localPeerIdentities,
         remoteRelayAddresses: crossSite ? remoteRelayAddresses : [],
         remoteRelayIdentities: crossSite ? remoteRelayIdentities : [],
+        remoteMemberAddresses: siteNames.length > 1 ? remoteMemberAddresses : [],
         remoteSiteCidrs: siteNames.length > 1 ? remoteSiteCidrs : [],
         healthPort: topology.relays.healthPort,
         routedTcpPorts: [...topology.relays.routedTcpPorts],