@forgezero/agent 0.1.124 → 0.1.128

package/dist/fz-agent.js

@@ -4049,7 +4049,7 @@ function combineKEMS(realSeedLen, realMsgLen, expandSeed, combiner, ...kems) {
 var x25519kem = /* @__PURE__ */ ecdhKem(x25519);
 var ml_kem768_x25519 = /* @__PURE__ */ (() => combineKEMS(32, 32, expandSeedXof(shake256), (pk, ct, ss) => sha3_256(concatBytes2(ss[0], ss[1], ct[1], pk[1], asciiToBytes("\\.//^\\"))), ml_kem768, x25519kem))();
 
-// ../../node_modules/.bun/@forgezero+runtime@0.1.17+cd212ec15d36da0a/node_modules/@forgezero/runtime/dist/identity.js
+// ../runtime/dist/identity.js
 var ENCODER = new TextEncoder;
 var b64 = toBase64Url;
 var un64 = fromBase64Url;
@@ -4196,7 +4196,7 @@ function signRequest(keys, nodeKey, args) {
   };
 }
 
-// ../../node_modules/.bun/@forgezero+vault@0.1.22+3f759277d50bc01a/node_modules/@forgezero/vault/dist/index.js
+// ../vault/dist/index.js
 var DEFAULT_SOCKET = "/run/forgezero/vault.sock";
 
 // src/socket.ts
@@ -4692,7 +4692,7 @@ import { chmodSync as chmodSync4, existsSync as existsSync4, lstatSync as lstatS
 import { createHash as createHash5, randomUUID } from "crypto";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join2 } from "path";
 
-// ../../node_modules/.bun/@forgezero+runtime@0.1.17+cd212ec15d36da0a/node_modules/@forgezero/runtime/dist/queue.js
+// ../runtime/dist/queue.js
 class QueueStoppedError extends Error {
   constructor() {
     super("queue: stopped before this task could run");
@@ -9640,7 +9640,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.124";
+var VERSION2 = "0.1.128";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -9655,7 +9655,7 @@ var defaultExec = async (argv2, options = {}) => {
     stdin: options.stdin === undefined ? "ignore" : "pipe",
     stdout: "pipe",
     stderr: "pipe",
-    env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
+    env: { PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", LANG: "C", LC_ALL: "C", ...options.env }
   });
   if (options.stdin !== undefined && child.stdin && typeof child.stdin !== "number") {
     await writeAndCloseProcessInput(child.stdin, options.stdin);
@@ -9682,7 +9682,7 @@ var validateClaim = (claim) => {
   }
   if (operatingSystem?.id !== "ubuntu" || !["24.04", "26.04"].includes(operatingSystem.version) || operatingSystem.architecture !== "x64")
     throw new SshBootstrapError("CLAIM_INVALID");
-  if (!claim.target.credential || claim.target.credential.source !== "runner" && claim.target.credential.source !== "vault" || claim.target.credential.source === "vault" && (typeof claim.target.credential.privateKey !== "string" || claim.target.credential.privateKey.length > 32768 || !claim.target.credential.privateKey.startsWith("-----BEGIN OPENSSH PRIVATE KEY-----") || !claim.target.credential.privateKey.trimEnd().endsWith("-----END OPENSSH PRIVATE KEY-----"))) {
+  if (!/^ssh-(?:ed25519|rsa|ecdsa-[^\s]+) [A-Za-z0-9+/]+={0,3}(?:\s+.*)?$/.test(claim.runnerSshPublicKey) || !claim.target.credential || claim.target.credential.source !== "runner" && claim.target.credential.source !== "vault" || claim.target.credential.source === "vault" && (claim.target.credential.kind === "private-key" && (typeof claim.target.credential.privateKey !== "string" || claim.target.credential.privateKey.length > 32768 || !claim.target.credential.privateKey.startsWith("-----BEGIN OPENSSH PRIVATE KEY-----") || !claim.target.credential.privateKey.trimEnd().endsWith("-----END OPENSSH PRIVATE KEY-----")) || claim.target.credential.kind === "password" && (typeof claim.target.credential.password !== "string" || claim.target.credential.password.length < 1 || claim.target.credential.password.length > 4096))) {
     throw new SshBootstrapError("CLAIM_INVALID");
   }
 };
@@ -9693,14 +9693,7 @@ var target = (claim, pinned) => {
 var sshOptions = (claim, pinned, knownHosts, keyPath) => [
   "-F",
   "/dev/null",
-  "-o",
-  "BatchMode=yes",
-  "-o",
-  "IdentitiesOnly=yes",
-  "-o",
-  `IdentityFile=${keyPath}`,
-  "-o",
-  "IdentityAgent=none",
+  ...claim.target.credential.source === "vault" && claim.target.credential.kind === "password" ? ["-o", "BatchMode=no", "-o", "IdentitiesOnly=yes", "-o", "PubkeyAuthentication=no", "-o", "PreferredAuthentications=password,keyboard-interactive", "-o", "NumberOfPasswordPrompts=1"] : ["-o", "BatchMode=yes", "-o", "IdentitiesOnly=yes", "-o", `IdentityFile=${keyPath}`, "-o", "IdentityAgent=none"],
   "-o",
   `UserKnownHostsFile=${knownHosts}`,
   "-o",
@@ -9787,18 +9780,30 @@ async function executeSshBootstrap(claim, options) {
   const api = new URL(options.platformApiUrl);
   if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash)
     throw new SshBootstrapError("TARGET_API_INVALID");
-  const exec = options.exec ?? defaultExec;
+  const baseExec = options.exec ?? defaultExec;
   const directory = mkdtempSync2(join3(tmpdir2(), "forgezero-ssh-bootstrap-"));
   chmodSync7(directory, 448);
+  let exec = baseExec;
   let sshKeyPath = options.sshKeyPath;
   let remoteDirectory = "";
   let pinned;
   try {
-    if (claim.target.credential.source === "vault") {
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "private-key") {
       sshKeyPath = join3(directory, "identity");
       writeFileSync5(sshKeyPath, `${claim.target.credential.privateKey.trim()}
 `, { mode: 384, flag: "wx" });
     }
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "password") {
+      const askpass = join3(directory, "askpass");
+      writeFileSync5(askpass, `#!/usr/bin/env bun
+process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
+`, { mode: 448, flag: "wx" });
+      const password = claim.target.credential.password;
+      exec = (argv2, command = {}) => baseExec(argv2, {
+        ...command,
+        env: { ...command.env, DISPLAY: "forgezero:0", SSH_ASKPASS: askpass, SSH_ASKPASS_REQUIRE: "force", FZ_SSH_PASSWORD: password }
+      });
+    }
     const sourceHost = claim.target.host.includes(":") ? `[${claim.target.host}]` : claim.target.host;
     const resolved = await resolvePinnedGitTarget(`ssh://${claim.target.user}@${sourceHost}:${claim.target.port}/`, options.resolveHost);
     if (!resolved || resolved.protocol !== "ssh")
@@ -9809,6 +9814,21 @@ async function executeSshBootstrap(claim, options) {
     remoteDirectory = await checked(exec, ["ssh", ...ssh, target(claim, pinned), "--", "mktemp", "-d", "/tmp/forgezero-bootstrap.XXXXXXXX"], "SSH_UNREACHABLE");
     if (!/^\/tmp\/forgezero-bootstrap\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
+    const destination = target(claim, pinned);
+    const passwd = await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/getent", "passwd", claim.target.user]);
+    const home = passwd.split(":")[5] ?? "";
+    if (!home.startsWith("/") || /[\r\n]/.test(home))
+      throw new SshBootstrapError("SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-d", "-m", "0700", `${home}/.ssh`]);
+    const existing = await remote(exec, ssh, destination, "SSH_IDENTITY_READ_FAILED", ["/usr/bin/cat", `${home}/.ssh/authorized_keys`]).catch(() => "");
+    const authorized = [...new Set([...existing.split(`
+`).map((line) => line.trim()).filter(Boolean), claim.runnerSshPublicKey])].join(`
+`) + `
+`;
+    const authorizedPath = join3(directory, "authorized_keys");
+    writeFileSync5(authorizedPath, authorized, { mode: 384, flag: "wx" });
+    await checked(exec, ["scp", ...scpOptions(claim, pinned, knownHosts, sshKeyPath), authorizedPath, `${destination}:${remoteDirectory}/authorized_keys`], "SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-m", "0600", `${remoteDirectory}/authorized_keys`, `${home}/.ssh/authorized_keys`]);
     const config = {
       kind: "enrolled-compute",
       operatingSystem: claim.target.operatingSystem,
@@ -9844,7 +9864,6 @@ async function executeSshBootstrap(claim, options) {
         join3(directory, name),
         `${target(claim, pinned)}:${remoteDirectory}/${name}`
       ], "SCP_FAILED", { secret: name === "enrol.token" });
-    const destination = target(claim, pinned);
     const version = await remote(exec, ssh, destination, "REMOTE_BUN_CHECK_FAILED", ["/usr/local/bin/bun", "--version"]).catch(() => "");
     if (version !== PINNED_BUN_VERSION) {
       await remote(exec, ssh, destination, "REMOTE_PREREQUISITES_FAILED", [
@@ -10093,6 +10112,7 @@ var validateMetalClaim = (claim) => {
     realm: claim.tenantKey,
     projectKey: claim.projectKey,
     environmentKey: claim.environmentKey,
+    runnerSshPublicKey: claim.runnerSshPublicKey,
     target: claim.target,
     enrolmentToken: `fze_${"A".repeat(43)}`
   });
@@ -10104,18 +10124,30 @@ async function executeMetalAdmission(claim, options) {
   if (api.protocol !== "https:" || api.username || api.password || api.search || api.hash || telemetry.protocol !== "https:" || telemetry.username || telemetry.password || telemetry.search || telemetry.hash) {
     throw new SshBootstrapError("TARGET_COORDINATE_INVALID");
   }
-  const exec = options.exec ?? defaultExec;
+  const baseExec = options.exec ?? defaultExec;
   const directory = mkdtempSync2(join3(tmpdir2(), "forgezero-metal-admission-"));
   chmodSync7(directory, 448);
+  let exec = baseExec;
   let sshKeyPath = options.sshKeyPath;
   let remoteDirectory = "";
   let pinned;
   try {
-    if (claim.target.credential.source === "vault") {
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "private-key") {
       sshKeyPath = join3(directory, "identity");
       writeFileSync5(sshKeyPath, `${claim.target.credential.privateKey.trim()}
 `, { mode: 384, flag: "wx" });
     }
+    if (claim.target.credential.source === "vault" && claim.target.credential.kind === "password") {
+      const askpass = join3(directory, "askpass");
+      writeFileSync5(askpass, `#!/usr/bin/env bun
+process.stdout.write(process.env.FZ_SSH_PASSWORD ?? "")
+`, { mode: 448, flag: "wx" });
+      const password = claim.target.credential.password;
+      exec = (argv2, command = {}) => baseExec(argv2, {
+        ...command,
+        env: { ...command.env, DISPLAY: "forgezero:0", SSH_ASKPASS: askpass, SSH_ASKPASS_REQUIRE: "force", FZ_SSH_PASSWORD: password }
+      });
+    }
     const sourceHost = claim.target.host.includes(":") ? `[${claim.target.host}]` : claim.target.host;
     const resolved = await resolvePinnedGitTarget(`ssh://${claim.target.user}@${sourceHost}:${claim.target.port}/`, options.resolveHost);
     if (!resolved || resolved.protocol !== "ssh")
@@ -10127,6 +10159,20 @@ async function executeMetalAdmission(claim, options) {
     remoteDirectory = await checked(exec, ["ssh", ...ssh, destination, "--", "mktemp", "-d", "/tmp/forgezero-metal-admission.XXXXXXXX"], "SSH_UNREACHABLE");
     if (!/^\/tmp\/forgezero-metal-admission\.[A-Za-z0-9]{8}$/.test(remoteDirectory))
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
+    const passwd = await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/getent", "passwd", claim.target.user]);
+    const home = passwd.split(":")[5] ?? "";
+    if (!home.startsWith("/") || /[\r\n]/.test(home))
+      throw new SshBootstrapError("SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-d", "-m", "0700", `${home}/.ssh`]);
+    const existing = await remote(exec, ssh, destination, "SSH_IDENTITY_READ_FAILED", ["/usr/bin/cat", `${home}/.ssh/authorized_keys`]).catch(() => "");
+    const authorized = [...new Set([...existing.split(`
+`).map((line) => line.trim()).filter(Boolean), claim.runnerSshPublicKey])].join(`
+`) + `
+`;
+    const authorizedPath = join3(directory, "authorized_keys");
+    writeFileSync5(authorizedPath, authorized, { mode: 384, flag: "wx" });
+    await checked(exec, ["scp", ...scpOptions(claim, pinned, knownHosts, sshKeyPath), authorizedPath, `${destination}:${remoteDirectory}/authorized_keys`], "SSH_IDENTITY_INSTALL_FAILED");
+    await remote(exec, ssh, destination, "SSH_IDENTITY_INSTALL_FAILED", ["/usr/bin/install", "-m", "0600", `${remoteDirectory}/authorized_keys`, `${home}/.ssh/authorized_keys`]);
     const fzCliPath = options.fzCliPath ?? fileURLToPath(new URL("./fz.js", import.meta.url));
     const fzAgentPath = options.fzAgentPath ?? fileURLToPath(new URL("./fz-agent.js", import.meta.url));
     for (const [source, name] of [[fzCliPath, "fz.js"], [fzAgentPath, "fz-agent.js"]]) {
@@ -11363,7 +11409,7 @@ function requestDeploymentCommand(input, socketPath = DEFAULT_DEPLOYMENT_RUNNER_
 // src/snp-attestation.ts
 import { existsSync as existsSync10 } from "fs";
 
-// ../../node_modules/.bun/@forgezero+runtime@0.1.17+cd212ec15d36da0a/node_modules/@forgezero/runtime/dist/snp.js
+// ../runtime/dist/snp.js
 var REPORT_BYTES = 1184;
 
 // src/snp-attestation.ts
@@ -15302,6 +15348,26 @@ var nonEmpty = (path2) => {
   if (!existsSync20(path2) || !statSync5(path2).isFile() || statSync5(path2).size < 1)
     throw new Error(`required file missing: ${path2}`);
 };
+function validateRecoveryBootstrapState(value, expected) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("bootstrap state is malformed");
+  const state = value;
+  if (state.format !== 2 || state.kind !== "platform" || state.environment !== expected.profile || state.databaseRole !== expected.role || state.profile !== expected.software || state.apiUrl !== expected.apiOrigin || state.nodeHostname !== expected.edgeHostname || expected.databaseAddress !== undefined && state.databaseAddress !== expected.databaseAddress)
+    throw new Error("bootstrap state does not match reviewed recovery coordinates");
+}
+var exactBootstrapState = (expected) => {
+  const path2 = "/var/lib/forgezero/bootstrap.json";
+  nonEmpty(path2);
+  if (statSync5(path2).size > 64 * 1024)
+    throw new Error("bootstrap state is oversized");
+  let value;
+  try {
+    value = JSON.parse(readFileSync15(path2, "utf8"));
+  } catch {
+    throw new Error("bootstrap state is malformed");
+  }
+  validateRecoveryBootstrapState(value, expected);
+};
 var option = (args, name) => {
   const value = args.find((arg) => arg.startsWith(`--${name}=`))?.slice(name.length + 3);
   if (!value || /[\0\r\n]/.test(value))
@@ -15325,15 +15391,11 @@ async function runRecoveryHost(args, run2 = execute2) {
     const apiOrigin = option(args, "api-origin");
     const edgeHostname = option(args, "edge-hostname");
     const databaseAddress = args.find((arg) => arg.startsWith("--db-address="))?.slice(13);
-    exactState("/opt/forgezero/.forge-state", `profile=${profile}`);
-    exactState("/opt/forgezero/.forge-state", `db_role=${role}`);
-    exactState("/opt/forgezero/.forge-state", `software_profile=${software}`);
-    if (databaseAddress)
-      exactState("/opt/forgezero/.forge-state", `db_address=${databaseAddress}`);
-    exactState("/opt/forgezero/shared/.env", "ARANGO_DB=fz");
-    exactState("/opt/forgezero/shared/.env", "FZ_DATABASE_MODE=platform");
-    exactState("/opt/forgezero/shared/.env", `API_ORIGIN=${apiOrigin}`);
-    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME=${edgeHostname}`);
+    exactBootstrapState({ profile, role, software, apiOrigin, edgeHostname, ...databaseAddress ? { databaseAddress } : {} });
+    exactState("/opt/forgezero/shared/.env", 'ARANGO_DB="fz"');
+    exactState("/opt/forgezero/shared/.env", 'FZ_DATABASE_MODE="platform"');
+    exactState("/opt/forgezero/shared/.env", `API_ORIGIN="${apiOrigin}"`);
+    exactState("/opt/forgezero/shared/.env", `FZ_NODE_HOSTNAME="${edgeHostname}"`);
     nonEmpty("/etc/forgezero/creds/arangodb-jwt.cred");
     const hasDatabase = role !== "none";
     if (hasDatabase) {
@@ -15377,7 +15439,7 @@ async function runRecoveryHost(args, run2 = execute2) {
       throw new Error("maintenance accepts only fz db argv");
     const slot = activeSlot();
     const properties = [
-      "--property=User=forgezero",
+      "--property=User=forgezero-api",
       `--property=WorkingDirectory=/opt/forgezero/slots/${slot}`,
       "--property=Environment=NODE_ENV=production",
       "--property=EnvironmentFile=/opt/forgezero/shared/.env",
@@ -17125,6 +17187,8 @@ var COMMUNITY_REHEARSAL_COORDINATOR_PORT = 18529;
 var COMMUNITY_REHEARSAL_DATABASE_PORT_RANGE = "18528:18539";
 var COMMUNITY_REHEARSAL_API_PORT = 18787;
 var COMMUNITY_REHEARSAL_FIREWALL_COMMENT = "fz-community-rehearsal";
+var COMMUNITY_REHEARSAL_EGRESS_TABLE = "forgezero_agent_egress";
+var COMMUNITY_REHEARSAL_EGRESS_CHAIN = "output";
 var RELEASE = /^[a-f0-9]{64}$/;
 var SAFE_NAME2 = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute3 = executeSoftwareOperation) {
@@ -17288,6 +17352,7 @@ function planCommunityRehearsalPrepare(request) {
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-community-api.service"], accepted: [0, 5] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "stop", "forgezero-rehearsal-db.service"], accepted: [0, 5] },
     { kind: "clear-firewall" },
+    { kind: "prepare-egress", addresses: topology.map(({ address }) => address) },
     ...topology.map(({ address }) => ({
       kind: "exec",
       argv: [
@@ -17350,6 +17415,7 @@ function planCommunityRehearsalCleanup() {
     { kind: "remove-tree", path: COMMUNITY_DATABASE_ROOT },
     { kind: "remove-tree", path: COMMUNITY_REHEARSAL_ROOT },
     { kind: "remove-tree", path: COMMUNITY_CREDENTIAL_PARENT },
+    { kind: "clear-egress" },
     { kind: "clear-firewall" },
     { kind: "exec", argv: ["/usr/bin/systemctl", "daemon-reload"] },
     { kind: "exec", argv: ["/usr/bin/systemctl", "reset-failed", "forgezero-community-api.service", "forgezero-rehearsal-db.service"], accepted: [0, 1, 5] }
@@ -17372,6 +17438,10 @@ async function applyOperations(operations) {
       rmSync13(operation.path, { recursive: true, force: true });
     else if (operation.kind === "clear-firewall")
       await clearCommunityRehearsalFirewall();
+    else if (operation.kind === "prepare-egress")
+      await prepareCommunityRehearsalEgress(operation.addresses);
+    else if (operation.kind === "clear-egress")
+      await clearCommunityRehearsalEgress();
     else if (operation.kind === "write") {
       mkdirSync17(dirname15(operation.path), { recursive: true });
       writeFileSync17(operation.path, operation.content, { mode: operation.mode });
@@ -17402,6 +17472,49 @@ function communityRehearsalFirewallRuleNumbers(status) {
     return match ? [Number(match[1])] : [];
   }).filter((number2) => Number.isSafeInteger(number2) && number2 > 0).sort((left, right) => right - left);
 }
+function communityRehearsalEgressRuleHandles(ruleset) {
+  return ruleset.split(/\r?\n/).flatMap((line) => {
+    if (!line.includes(`comment "${COMMUNITY_REHEARSAL_FIREWALL_COMMENT}"`))
+      return [];
+    const match = line.match(/# handle (\d+)\s*$/);
+    return match ? [Number(match[1])] : [];
+  }).filter((number2) => Number.isSafeInteger(number2) && number2 > 0).sort((left, right) => right - left);
+}
+function communityRehearsalEgressRuleArguments(uid, addresses) {
+  if (!/^\d+$/.test(uid) || addresses.some((address) => isIP6(address) !== 4) || new Set(addresses).size !== addresses.length) {
+    throw new Error("rehearsal egress arguments require one uid and unique IPv4 addresses");
+  }
+  return addresses.flatMap((address) => [
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ct",
+      "state",
+      "established,related",
+      "ip",
+      "daddr",
+      address,
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ],
+    [
+      "meta",
+      "skuid",
+      uid,
+      "ip",
+      "daddr",
+      address,
+      "tcp",
+      "dport",
+      String(COMMUNITY_REHEARSAL_COORDINATOR_PORT),
+      "accept",
+      "comment",
+      COMMUNITY_REHEARSAL_FIREWALL_COMMENT
+    ]
+  ]);
+}
 async function clearCommunityRehearsalFirewall() {
   const status = await exec(["/usr/sbin/ufw", "status", "numbered"]);
   if (status.exitCode !== 0)
@@ -17413,6 +17526,71 @@ async function clearCommunityRehearsalFirewall() {
     }
   }
 }
+var rehearsalEgressRules = async () => {
+  const result = await exec([
+    "/usr/sbin/nft",
+    "-a",
+    "list",
+    "chain",
+    "inet",
+    COMMUNITY_REHEARSAL_EGRESS_TABLE,
+    COMMUNITY_REHEARSAL_EGRESS_CHAIN
+  ]);
+  if (result.exitCode === 0)
+    return { exists: true, output: result.output };
+  if (/No such file or directory|does not exist/i.test(result.output))
+    return { exists: false, output: result.output };
+  throw new Error(`unable to inspect rehearsal egress rules: ${result.output.trim()}`);
+};
+async function clearCommunityRehearsalEgress() {
+  const listed = await rehearsalEgressRules();
+  if (!listed.exists)
+    return;
+  for (const handle of communityRehearsalEgressRuleHandles(listed.output)) {
+    const removed = await exec([
+      "/usr/sbin/nft",
+      "delete",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      "handle",
+      String(handle)
+    ]);
+    if (removed.exitCode !== 0) {
+      throw new Error(`unable to remove rehearsal egress rule ${handle}: ${removed.output.trim()}`);
+    }
+  }
+}
+async function prepareCommunityRehearsalEgress(addresses) {
+  await clearCommunityRehearsalEgress();
+  if (!(await rehearsalEgressRules()).exists)
+    return;
+  const identity = await exec(["/usr/bin/id", "-u", "forgezero"]);
+  const uid = identity.output.trim();
+  if (identity.exitCode !== 0 || !/^\d+$/.test(uid))
+    throw new Error("unable to resolve the forgezero service uid");
+  for (const rule of communityRehearsalEgressRuleArguments(uid, addresses)) {
+    const inserted = await exec([
+      "/usr/sbin/nft",
+      "insert",
+      "rule",
+      "inet",
+      COMMUNITY_REHEARSAL_EGRESS_TABLE,
+      COMMUNITY_REHEARSAL_EGRESS_CHAIN,
+      ...rule
+    ]);
+    if (inserted.exitCode !== 0) {
+      await clearCommunityRehearsalEgress();
+      throw new Error(`unable to install a rehearsal egress rule: ${inserted.output.trim()}`);
+    }
+  }
+  const installed = communityRehearsalEgressRuleHandles((await rehearsalEgressRules()).output);
+  if (installed.length !== addresses.length * 2) {
+    await clearCommunityRehearsalEgress();
+    throw new Error("rehearsal egress rule verification failed");
+  }
+}
 var responseFor = async (request) => {
   const node = request.topology.find((entry) => entry.name === request.node);
   const base = `http://${node.address}:${COMMUNITY_REHEARSAL_API_PORT}`;