@forgezero/agent 0.1.65 → 0.1.67

package/dist/fz-agent.js

@@ -4970,7 +4970,30 @@ var BUN_RELEASE_SHA256 = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cb
 var ARANGO_SHA256 = "b5a9197b4343f2ed554e1ebc1ef8e6529c7c39cde0035cdc311a4747a3355066";
 var CLOUDFLARED_SHA256 = "9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17";
 var OS_CATALOG = [
-  { id: "ubuntu", version: "26.04", architecture: "x64", status: "active" }
+  {
+    id: "ubuntu",
+    version: "26.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-resolute-20260731",
+    imageLabel: "Ubuntu 26.04 LTS Resolute",
+    imageVersion: "2026-07-31",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
+    imageSha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05",
+    confidentialModes: ["sev-snp"]
+  },
+  {
+    id: "ubuntu",
+    version: "24.04",
+    architecture: "x64",
+    status: "active",
+    imageKey: "ubuntu-noble-20260705",
+    imageLabel: "Ubuntu 24.04 LTS Noble",
+    imageVersion: "2026-07-05",
+    imageUrl: "https://cloud-images.ubuntu.com/releases/noble/release-20260705/ubuntu-24.04-server-cloudimg-amd64.img",
+    imageSha256: "ffe6203da54deeb6db5d2a98a83f9ec8e55f149d3f7ba622e1abe5fa966ee3d6",
+    confidentialModes: []
+  }
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -4981,7 +5004,12 @@ var SOFTWARE_CATALOG = [
   { id: "cloudflare-warp", version: "2026.6.822.0-min", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "ufw", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "openssh-client", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
-  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
+  { id: "git", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "nginx", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "ufw", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "openssh-client", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "git", version: "ubuntu-24.04", status: "active", os: "ubuntu", osVersion: "24.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" }
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
@@ -4994,6 +5022,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } },
   { requirement: { id: "git", version: "ubuntu-26.04" } }
 ];
+var UBUNTU_2404_X64 = [
+  { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-24.04" } },
+  { requirement: { id: "nginx", version: "ubuntu-24.04" } },
+  { requirement: { id: "ufw", version: "ubuntu-24.04" } },
+  { requirement: { id: "openssh-client", version: "ubuntu-24.04" } },
+  { requirement: { id: "git", version: "ubuntu-24.04" } }
+];
+var strategiesFor = (observation) => observation.os.id === "ubuntu" && observation.architecture === "x64" ? observation.os.versionId === "26.04" ? UBUNTU_2604_X64 : observation.os.versionId === "24.04" ? UBUNTU_2404_X64 : undefined : undefined;
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
 var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
@@ -5040,7 +5077,7 @@ var aptInstall = async (name) => {
 };
 async function executeSoftwareOperation(operation) {
   const { software, version } = operation;
-  if (!UBUNTU_2604_X64.some(({ requirement }) => requirement.id === software && requirement.version === version)) {
+  if (![...UBUNTU_2604_X64, ...UBUNTU_2404_X64].some(({ requirement }) => requirement.id === software && requirement.version === version)) {
     return { exitCode: 2, output: "unsupported software operation" };
   }
   if (operation.kind === "check") {
@@ -5210,7 +5247,7 @@ async function ensureSoftwareRequirements(requirementsInput, options) {
   }
   const results = [];
   for (const requirement of requirements) {
-    const strategy = UBUNTU_2604_X64.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
+    const strategy = strategiesFor(observation)?.find(({ requirement: candidate }) => candidate.id === requirement.id && candidate.version === requirement.version);
     if (!strategy)
       throw new Error(`unsupported software requirement: ${requirement.id}@${requirement.version}`);
     const before = await options.exec({ kind: "check", software: requirement.id, version: requirement.version });
@@ -6015,13 +6052,13 @@ function validateBuiltInProvider(requirement2, where) {
     return;
   const expected = {
     "forgezero.bun": { capability: "runtime.javascript", versions: ["1.3.14"], keys: ["installScope"] },
-    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
-    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
+    "forgezero.docker": { capability: "runtime.container", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "storageDriver", "dataRoot", "liveRestore", "logDriver", "defaultNetwork", "rootless"] },
+    "forgezero.nginx": { capability: "proxy.http", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "websocket", "maximumBodyMiB", "workerProcesses", "workerConnections"] },
     "forgezero.arangodb": { capability: "database.arangodb", versions: ["3.11.14"], keys: ["installScope", "runtime", "dataPath", "bind"] },
     "forgezero.cloudflared": { capability: "network.public-tunnel", versions: ["2026.7.3"], keys: ["installScope", "mode"] },
     "forgezero.warp": { capability: "network.private", versions: ["2026.6.822.0-min"], keys: ["installScope", "mode"] },
-    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
-    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-26.04"], keys: ["installScope", "mode"] },
+    "forgezero.ufw": { capability: "security.firewall", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "defaultIncoming", "defaultOutgoing"] },
+    "forgezero.openssh": { capability: "transport.ssh", versions: ["ubuntu-24.04", "ubuntu-26.04"], keys: ["installScope", "mode"] },
     "forgezero.systemd": { capability: "service.manager", versions: ["ubuntu-26.04"], keys: ["installScope", "credentials", "serviceSandbox"] }
   };
   const contract = expected[requirement2.provider];
@@ -7148,7 +7185,7 @@ async function sha256File(path2) {
   });
   return hash.digest("hex");
 }
-var branchName = (value) => {
+var bootstrapBundleBranch = (value) => {
   if (typeof value !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9._/-]{0,126}[A-Za-z0-9])?$/.test(value) || value.includes("..") || value.includes("//") || value.startsWith("-")) {
     throw new Error("bootstrap bundle branch is malformed");
   }
@@ -7165,7 +7202,7 @@ function parseBootstrapBundleManifest(value) {
   if (source.format !== BOOTSTRAP_BUNDLE_FORMAT || source.kind !== BOOTSTRAP_BUNDLE_KIND) {
     throw new Error("bootstrap bundle manifest format is unsupported");
   }
-  branchName(source.branch);
+  bootstrapBundleBranch(source.branch);
   if (typeof source.revision !== "string" || !/^[a-f0-9]{40}$/.test(source.revision)) {
     throw new Error("bootstrap bundle revision must be an exact lowercase Git commit");
   }
@@ -8550,23 +8587,8 @@ import { tmpdir as tmpdir2 } from "os";
 import { join as join3 } from "path";
 import { fileURLToPath } from "url";
 
-// src/ubuntu.ts
-var SUPPORTED_GUEST_IMAGE = Object.freeze({
-  key: "ubuntu-resolute-20260731",
-  family: "ubuntu-26.04",
-  version: "2026-07-31",
-  label: "Ubuntu 26.04 LTS Resolute",
-  url: "https://cloud-images.ubuntu.com/releases/resolute/release-20260731/ubuntu-26.04-server-cloudimg-amd64.img",
-  sha256: "9dc7c5363c0146a08ba0c9aa834d82c2c6dfbb1c471ad9a2f0aba1189e21be05"
-});
-function assertSupportedGuestImage(imageKey) {
-  if (imageKey !== SUPPORTED_GUEST_IMAGE.key) {
-    throw new Error(`unsupported guest image ${imageKey}; ForgeZero currently supports only ${SUPPORTED_GUEST_IMAGE.key}`);
-  }
-}
-
 // src/version.ts
-var VERSION2 = "0.1.65";
+var VERSION2 = "0.1.67";
 
 // src/ssh-bootstrap.ts
 class SshBootstrapError extends Error {
@@ -8603,10 +8625,12 @@ var checked = async (exec, argv2, code, options) => {
 var validateClaim = (claim) => {
   if (!/^[A-Za-z0-9_-]{1,64}$/.test(claim.computeKey) || !/^[A-Za-z0-9_-]{16,128}$/.test(claim.claimToken) || !/^fze_[A-Za-z0-9_-]{32,128}$/.test(claim.enrolmentToken) || !/^[a-z0-9][a-z0-9_-]{0,62}$/.test(claim.realm) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.projectKey) || !/^[A-Za-z0-9_-]{1,64}$/.test(claim.environmentKey))
     throw new SshBootstrapError("CLAIM_INVALID");
-  const { host, port, user, hostKeySha256, nodeHostname } = claim.target;
+  const { host, port, user, hostKeySha256, nodeHostname, operatingSystem } = claim.target;
   if (!host || host.length > 253 || /[\s/@]/.test(host) || !Number.isSafeInteger(port) || port < 1 || port > 65535 || !/^[a-z_][a-z0-9_-]{0,31}$/.test(user) || !/^SHA256:[A-Za-z0-9+/]{43}$/.test(hostKeySha256) || !/^[a-z0-9](?:[a-z0-9.-]{1,251}[a-z0-9])$/.test(nodeHostname) || !nodeHostname.includes(".")) {
     throw new SshBootstrapError("CLAIM_INVALID");
   }
+  if (operatingSystem?.id !== "ubuntu" || !["24.04", "26.04"].includes(operatingSystem.version) || operatingSystem.architecture !== "x64")
+    throw new SshBootstrapError("CLAIM_INVALID");
   if (!claim.target.credential || claim.target.credential.source !== "runner" && claim.target.credential.source !== "vault" || claim.target.credential.source === "vault" && (typeof claim.target.credential.privateKey !== "string" || claim.target.credential.privateKey.length > 32768 || !claim.target.credential.privateKey.startsWith("-----BEGIN OPENSSH PRIVATE KEY-----") || !claim.target.credential.privateKey.trimEnd().endsWith("-----END OPENSSH PRIVATE KEY-----"))) {
     throw new SshBootstrapError("CLAIM_INVALID");
   }
@@ -8736,6 +8760,7 @@ async function executeSshBootstrap(claim, options) {
       throw new SshBootstrapError("REMOTE_PATH_INVALID");
     const config = {
       kind: "enrolled-compute",
+      operatingSystem: claim.target.operatingSystem,
       apiUrl: api.origin,
       realm: claim.realm,
       nodeHostname: claim.target.nodeHostname,
@@ -9071,10 +9096,10 @@ async function executeMetalAdmission(claim, options) {
         unitDir: "/etc/systemd/system",
         apiUrl: api.origin,
         agentTelemetryEndpoint: telemetry.origin,
-        images: { [SUPPORTED_GUEST_IMAGE.key]: {
-          path: `/var/lib/forgezero/images/${SUPPORTED_GUEST_IMAGE.key}.img`,
-          sha256: SUPPORTED_GUEST_IMAGE.sha256
-        } },
+        images: Object.fromEntries(OS_CATALOG.filter(({ status }) => status === "active").map((image) => [
+          image.imageKey,
+          { path: `/var/lib/forgezero/images/${image.imageKey}.img`, sha256: image.imageSha256 }
+        ])),
         bunVersion: PINNED_BUN_VERSION,
         bunReleaseSha256: BUN_RELEASE_SHA256,
         agentVersion: VERSION2
@@ -9384,6 +9409,36 @@ function shapeEgressUnitDirectives(tap, guaranteedMbps, burstMbps) {
   ];
 }
 
+// src/ubuntu.ts
+var current = OS_CATALOG[0];
+var SUPPORTED_GUEST_IMAGE = Object.freeze({
+  key: current.imageKey,
+  family: `${current.id}-${current.version}`,
+  version: current.imageVersion,
+  label: current.imageLabel,
+  url: current.imageUrl,
+  sha256: current.imageSha256
+});
+var SUPPORTED_GUEST_IMAGES = Object.freeze(OS_CATALOG.filter(({ status }) => status === "active").map(({ id: id2, imageKey, imageLabel, imageVersion, version, confidentialModes }) => ({
+  key: imageKey,
+  label: imageLabel,
+  family: `${id2}-${version}`,
+  version: imageVersion,
+  confidential: confidentialModes.some((mode) => mode === "sev-snp")
+})));
+function supportedGuestImage(imageKey) {
+  return SUPPORTED_GUEST_IMAGES.find(({ key }) => key === imageKey);
+}
+function assertSupportedGuestImage(imageKey, confidential = false) {
+  const selected = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+  if (!selected) {
+    throw new Error(`unsupported guest image ${imageKey}; supported images: ${SUPPORTED_GUEST_IMAGES.map(({ key }) => key).join(", ")}`);
+  }
+  if (confidential && !selected.confidentialModes.some((mode) => mode === "sev-snp")) {
+    throw new Error(`guest image ${imageKey} is not approved for SEV-SNP`);
+  }
+}
+
 // src/metal-provision.ts
 var SAFE_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}$/;
 var DEVICE = /^[a-zA-Z][a-zA-Z0-9_.-]{0,14}$/;
@@ -9443,9 +9498,16 @@ function validateMetalProfile(profile) {
   if (telemetryEndpoint.protocol !== "https:" || telemetryEndpoint.username || telemetryEndpoint.password || telemetryEndpoint.search || telemetryEndpoint.hash || isIP2(telemetryEndpoint.hostname) !== 0 || !telemetryEndpoint.hostname.includes(".") || telemetryEndpoint.hostname === "localhost" || telemetryEndpoint.hostname.endsWith(".local"))
     throw new MetalProvisionError("Agent telemetry endpoint must be a public HTTPS DNS coordinate without credentials, query or fragment");
   const imageKeys = Object.keys(profile.images);
-  if (imageKeys.length !== 1 || imageKeys[0] !== SUPPORTED_GUEST_IMAGE.key || profile.images[SUPPORTED_GUEST_IMAGE.key]?.sha256 !== SUPPORTED_GUEST_IMAGE.sha256) {
-    throw new MetalProvisionError(`metal profile must contain only the pinned ${SUPPORTED_GUEST_IMAGE.key} image contract`);
+  if (imageKeys.length === 0)
+    throw new MetalProvisionError("metal profile requires at least one pinned guest image");
+  for (const imageKey of imageKeys) {
+    const catalog = OS_CATALOG.find((entry) => entry.status === "active" && entry.imageKey === imageKey);
+    if (!catalog || profile.images[imageKey]?.sha256 !== catalog.imageSha256) {
+      throw new MetalProvisionError(`metal profile image ${imageKey} does not match the pinned OS catalog`);
+    }
   }
+  if (profile.confidential && !imageKeys.some((key) => OS_CATALOG.find((entry) => entry.imageKey === key)?.confidentialModes.some((mode) => mode === "sev-snp")))
+    throw new MetalProvisionError("confidential metal profile requires a pinned SEV-SNP guest image");
   if (!Array.isArray(profile.cpuPools) || profile.cpuPools.length === 0) {
     throw new MetalProvisionError("at least one exclusive CPU pool is required");
   }
@@ -9664,7 +9726,7 @@ var checked2 = async (exec, argv2) => {
 };
 async function provisionMetalGuest(profile, claim, exec) {
   validateMetalProfile(profile);
-  assertSupportedGuestImage(claim.spec.imageKey);
+  assertSupportedGuestImage(claim.spec.imageKey, claim.spec.confidential);
   if (!claim.computeKey || !claim.spec.reference || !SAFE_NAME.test(claim.spec.imageKey) || claim.spec.guestName !== undefined && !SAFE_NAME.test(claim.spec.guestName) || claim.spec.cpuPoolKey !== undefined && !SAFE_NAME.test(claim.spec.cpuPoolKey) || !Number.isInteger(claim.spec.physicalCores) || claim.spec.physicalCores < 1 || claim.spec.physicalCores > 256 || !Number.isInteger(claim.spec.vcpu) || claim.spec.vcpu < 1 || claim.spec.vcpu > 512 || !Number.isInteger(claim.spec.memoryGib) || claim.spec.memoryGib < 1 || claim.spec.memoryGib > 8192 || !Number.isInteger(claim.spec.diskGib) || claim.spec.diskGib < 8 || claim.spec.diskGib > 65536 || !Number.isInteger(claim.spec.egressGuaranteedMbps) || claim.spec.egressGuaranteedMbps < 0 || !Number.isInteger(claim.spec.egressBurstMbps) || claim.spec.egressBurstMbps < claim.spec.egressGuaranteedMbps)
     throw new MetalProvisionError("invalid compute claim");
   const image = profile.images[claim.spec.imageKey];
@@ -11544,11 +11606,11 @@ async function heartbeatAgentOnce(options) {
         await options.prepareUpdate?.(release);
         prepared = true;
         const apply = async () => {
-          const applied = await (options.applyUpdate ?? ((next, current, attemptId) => requestAgentUpdate({
+          const applied = await (options.applyUpdate ?? ((next, current2, attemptId) => requestAgentUpdate({
             op: "apply",
             target: options.updateTarget ?? "compute",
             release: next,
-            currentVersion: current,
+            currentVersion: current2,
             attemptId
           })))(release, observation.version, desired.attemptId);
           if (!applied.ok)
@@ -12551,8 +12613,8 @@ function applyAgentEgressPolicy(options) {
   } : undefined;
   if (loopback && !uids.includes(loopback.uid))
     uids.push(loopback.uid);
-  const current = listPolicy(command2);
-  const applied = command2(["/usr/sbin/nft", "--file", "-"], renderAgentEgressNft(uids, current.exitCode === 0, loopback));
+  const current2 = listPolicy(command2);
+  const applied = command2(["/usr/sbin/nft", "--file", "-"], renderAgentEgressNft(uids, current2.exitCode === 0, loopback));
   if (applied.exitCode !== 0) {
     throw new Error(`Could not apply Agent egress policy: ${applied.stderr.trim() || "nft refused it"}`);
   }
@@ -13313,15 +13375,15 @@ var replaceLink = (path2, target2) => {
   renameSync10(pending, path2);
 };
 var secureRelease = (path2, uid, gid) => {
-  const visit = (current) => {
-    const metadata = lstatSync3(current);
+  const visit = (current2) => {
+    const metadata = lstatSync3(current2);
     if (metadata.isSymbolicLink())
       throw new Error("release contains a symbolic link");
-    chownSync(current, uid, gid);
-    chmodSync15(current, metadata.isDirectory() ? 365 : 292);
+    chownSync(current2, uid, gid);
+    chmodSync15(current2, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
-      for (const name of readdirSync4(current))
-        visit(join10(current, name));
+      for (const name of readdirSync4(current2))
+        visit(join10(current2, name));
   };
   visit(path2);
 };
@@ -15162,19 +15224,15 @@ async function verifyPlatformFleetHost(expectedVersion, runtime = localRuntime()
 // src/community-rehearsal-host.ts
 import { createHash as createHash11 } from "crypto";
 import { lstatSync as lstatSync7, mkdirSync as mkdirSync16, readFileSync as readFileSync18, rmSync as rmSync12, symlinkSync as symlinkSync6, unlinkSync as unlinkSync12, writeFileSync as writeFileSync16 } from "fs";
+import { isIP as isIP5 } from "net";
 import { dirname as dirname11 } from "path";
 var COMMUNITY_REHEARSAL_VERSION = "3.11.14";
 var COMMUNITY_REHEARSAL_ROOT = "/opt/forgezero-rehearsals/community-cluster-api";
 var COMMUNITY_DATABASE_ROOT = "/var/lib/forgezero-rehearsal-cluster";
 var COMMUNITY_CREDENTIAL_PARENT = "/etc/forgezero-rehearsal";
 var COMMUNITY_CREDENTIAL_ROOT = "/etc/forgezero-rehearsal/creds";
-var NODES = new Map([
-  ["dev-fz-n1", { address: "10.42.0.21", agency: true }],
-  ["dev-fz-n2", { address: "10.42.0.22", agency: true }],
-  ["dev-fz-n3", { address: "10.42.0.23", agency: true }],
-  ["dev-fz-n4", { address: "10.42.0.24", agency: false }]
-]);
 var RELEASE = /^[a-f0-9]{64}$/;
+var SAFE_NAME2 = /^[a-z][a-z0-9-]{0,62}$/;
 async function ensureCommunityRehearsalArango(execute3 = executeSoftwareOperation) {
   const requirement2 = { software: "arangodb", version: COMMUNITY_REHEARSAL_VERSION };
   if ((await execute3({ kind: "check", ...requirement2 })).exitCode === 0)
@@ -15189,50 +15247,70 @@ var exactObject = (value) => {
     throw new Error("community rehearsal request must be an object");
   return value;
 };
-var exactNode = (node) => {
-  if (typeof node !== "string")
+var nodeName = (node) => {
+  if (typeof node !== "string" || !SAFE_NAME2.test(node))
     throw new Error("community rehearsal node is invalid");
-  const expected = NODES.get(node);
-  if (!expected)
-    throw new Error("community rehearsal accepts only the dedicated dev-fz-n1..n4 fleet");
-  return { name: node, ...expected };
+  return node;
+};
+var validateCommunityRehearsalTopology = (value) => {
+  if (!Array.isArray(value) || value.length !== 4)
+    throw new Error("community rehearsal requires exactly four reviewed nodes");
+  const rows = value.map((item, index) => {
+    const row2 = exactObject(item);
+    if (Object.keys(row2).some((key) => !["name", "address", "agency", "starter", "readPreferred"].includes(key)) || typeof row2.name !== "string" || !SAFE_NAME2.test(row2.name) || typeof row2.address !== "string" || isIP5(row2.address) !== 4 || typeof row2.agency !== "boolean" || typeof row2.starter !== "boolean" || typeof row2.readPreferred !== "boolean") {
+      throw new Error(`community rehearsal topology node ${index + 1} is invalid`);
+    }
+    return row2;
+  });
+  if (new Set(rows.map(({ name }) => name)).size !== rows.length || new Set(rows.map(({ address }) => address)).size !== rows.length) {
+    throw new Error("community rehearsal node names and addresses must be unique");
+  }
+  if (rows.filter(({ agency }) => agency).length !== 3 || rows.filter(({ starter }) => starter).length !== 1 || !rows.find(({ starter }) => starter).agency || rows.filter(({ readPreferred }) => readPreferred).length !== 1 || rows.find(({ readPreferred }) => readPreferred).agency) {
+    throw new Error("community rehearsal requires three Agency voters, one voter starter and one non-voting read-preferred member");
+  }
+  return rows;
 };
 function parseCommunityRehearsalHostRequest(value) {
   const row2 = exactObject(value);
-  const node = exactNode(row2.node);
+  const node = nodeName(row2.node);
+  const topology = validateCommunityRehearsalTopology(row2.topology);
+  const expected = topology.find((entry) => entry.name === node);
+  if (!expected)
+    throw new Error("community rehearsal node is not present in the reviewed topology");
   const action = row2.action;
   if (action === "prepare") {
-    const allowed = ["action", "node", "address", "agency", "release", "archivePath", "archiveSha256", "jwt"];
-    if (Object.keys(row2).some((key) => !allowed.includes(key)) || row2.address !== node.address || row2.agency !== node.agency || typeof row2.release !== "string" || !RELEASE.test(row2.release) || row2.archiveSha256 !== row2.release || row2.archivePath !== `/tmp/forgezero-community-${row2.release}.tar.gz` || typeof row2.jwt !== "string" || !/^[a-f0-9]{64}$/.test(row2.jwt)) {
+    const allowed = ["action", "node", "address", "agency", "topology", "release", "archivePath", "archiveSha256", "jwt"];
+    if (Object.keys(row2).some((key) => !allowed.includes(key)) || row2.address !== expected.address || row2.agency !== expected.agency || typeof row2.release !== "string" || !RELEASE.test(row2.release) || row2.archiveSha256 !== row2.release || row2.archivePath !== `/tmp/forgezero-community-${row2.release}.tar.gz` || typeof row2.jwt !== "string" || !/^[a-f0-9]{64}$/.test(row2.jwt)) {
       throw new Error("community rehearsal prepare request does not match the dedicated fleet contract");
     }
-    return row2;
+    return { ...row2, topology };
   }
   if (action === "cleanup") {
-    if (Object.keys(row2).some((key) => !["action", "node"].includes(key))) {
+    if (Object.keys(row2).some((key) => !["action", "node", "topology"].includes(key))) {
       throw new Error("community rehearsal cleanup has unknown fields");
     }
-    return { action, node: node.name };
+    return { action, node, topology };
   }
   if (["database-enable", "api-enable", "database-ready", "starter-ready", "api-ready", "database-status", "api-status"].includes(String(action))) {
-    if (Object.keys(row2).some((key) => !["action", "node"].includes(key)))
+    if (Object.keys(row2).some((key) => !["action", "node", "topology"].includes(key)))
       throw new Error("community rehearsal host action has unknown fields");
-    return { action, node: node.name };
+    return { action, node, topology };
   }
   if (action === "api") {
-    if (Object.keys(row2).some((key) => !["action", "node", "operation", "key", "value"].includes(key)) || !["health", "init", "write", "read", "query", "cluster"].includes(String(row2.operation)) || row2.key !== undefined && (typeof row2.key !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(row2.key)) || row2.value !== undefined && (typeof row2.value !== "string" || row2.value.length > 4096)) {
+    if (Object.keys(row2).some((key) => !["action", "node", "topology", "operation", "key", "value"].includes(key)) || !["health", "init", "write", "read", "query", "cluster"].includes(String(row2.operation)) || row2.key !== undefined && (typeof row2.key !== "string" || !/^[A-Za-z0-9_.:-]{1,128}$/.test(row2.key)) || row2.value !== undefined && (typeof row2.value !== "string" || row2.value.length > 4096)) {
       throw new Error("community rehearsal API request is invalid");
     }
     if ((row2.operation === "write" || row2.operation === "read") && typeof row2.key !== "string")
       throw new Error("community rehearsal API key is required");
     if ((row2.operation === "write" || row2.operation === "query") && typeof row2.value !== "string")
       throw new Error("community rehearsal API value is required");
-    return row2;
+    return { ...row2, node, topology };
   }
   throw new Error("unsupported community rehearsal host action");
 }
-var databaseUnit = (node) => {
-  const join12 = node.name === "dev-fz-n1" ? "" : " --starter.join=10.42.0.21";
+var databaseUnit = (node, topology) => {
+  const starter = topology.find((entry) => entry.starter);
+  const join12 = node.starter ? "" : ` --starter.join=${starter.address}`;
   const role = node.agency ? "" : " --cluster.start-agent=false --cluster.start-coordinator=true --cluster.start-dbserver=true";
   return `[Unit]
 Description=ForgeZero isolated Community ${COMMUNITY_REHEARSAL_VERSION} rehearsal cluster
@@ -15267,7 +15345,10 @@ LockPersonality=true
 WantedBy=multi-user.target
 `;
 };
-var apiUnit = (node) => `[Unit]
+var apiUnit = (node, topology) => {
+  const urls = topology.map(({ address }) => `http://${address}:8529`).join(",");
+  const readPreferred = topology.filter(({ readPreferred: readPreferred2 }) => readPreferred2).map(({ address }) => `http://${address}:8529`).join(",");
+  return `[Unit]
 Description=ForgeZero typed Community cluster rehearsal API
 After=forgezero-rehearsal-db.service network-online.target
 Requires=forgezero-rehearsal-db.service
@@ -15282,8 +15363,8 @@ Environment=HOST=127.0.0.1
 Environment=PORT=8787
 Environment=NODE_NAME=${node.name}
 Environment=ARANGO_URL=http://127.0.0.1:8529
-Environment=ARANGO_URLS=http://10.42.0.21:8529,http://10.42.0.22:8529,http://10.42.0.23:8529,http://10.42.0.24:8529
-Environment=ARANGO_READ_PREFERRED_URLS=http://10.42.0.24:8529
+Environment=ARANGO_URLS=${urls}
+Environment=ARANGO_READ_PREFERRED_URLS=${readPreferred}
 Environment=ARANGO_READ_PREFERRED_FALLBACK=error
 ExecStart=/usr/local/bin/bun src/index.ts
 Restart=always
@@ -15303,8 +15384,10 @@ LockPersonality=true
 [Install]
 WantedBy=multi-user.target
 `;
+};
 function planCommunityRehearsalPrepare(request) {
-  const node = exactNode(request.node);
+  const topology = validateCommunityRehearsalTopology(request.topology);
+  const node = topology.find(({ name }) => name === request.node);
   const releaseRoot = `${COMMUNITY_REHEARSAL_ROOT}/releases/${request.release}`;
   return [
     { kind: "exec", argv: ["/usr/sbin/arangod", "--version"] },
@@ -15319,13 +15402,13 @@ function planCommunityRehearsalPrepare(request) {
 ` },
     { kind: "exec", argv: ["/usr/bin/chmod", "0400", `${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred.next`] },
     { kind: "exec", argv: ["/usr/bin/mv", "-f", `${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred.next`, `${COMMUNITY_CREDENTIAL_ROOT}/arangodb-jwt.cred`] },
-    { kind: "write", path: "/etc/systemd/system/forgezero-rehearsal-db.service", content: databaseUnit(node), mode: 420 },
+    { kind: "write", path: "/etc/systemd/system/forgezero-rehearsal-db.service", content: databaseUnit(node, topology), mode: 420 },
     { kind: "exec", argv: ["/usr/bin/tar", "-xzf", request.archivePath, "-C", releaseRoot] },
     { kind: "exec", argv: ["/usr/bin/chown", "-R", "forgezero:forgezero", releaseRoot] },
     { kind: "exec", argv: ["/usr/sbin/runuser", "-u", "forgezero", "--", "/usr/local/bin/bun", "install", "--cwd", releaseRoot, "--frozen-lockfile", "--production"] },
     { kind: "unlink", path: `${COMMUNITY_REHEARSAL_ROOT}/current` },
     { kind: "symlink", target: releaseRoot, path: `${COMMUNITY_REHEARSAL_ROOT}/current` },
-    { kind: "write", path: "/etc/systemd/system/forgezero-community-api.service", content: apiUnit(node), mode: 420 },
+    { kind: "write", path: "/etc/systemd/system/forgezero-community-api.service", content: apiUnit(node, topology), mode: 420 },
     { kind: "unlink", path: request.archivePath }
   ];
 }
@@ -15403,7 +15486,10 @@ var responseFor = async (request) => {
 async function runCommunityRehearsalHost(request) {
   if ((process.getuid?.() ?? -1) !== 0)
     throw new Error("community-rehearsal must run as root");
-  const node = exactNode(request.node);
+  const topology = validateCommunityRehearsalTopology(request.topology);
+  const node = topology.find((entry) => entry.name === request.node);
+  if (!node)
+    throw new Error("community rehearsal node is not present in the reviewed topology");
   if (request.action === "cleanup") {
     await applyOperations(planCommunityRehearsalCleanup());
     return { ok: true, action: request.action, node: node.name };
@@ -15440,7 +15526,8 @@ async function runCommunityRehearsalHost(request) {
     return { ok: true, action: request.action, node: node.name };
   }
   if (request.action === "database-ready" || request.action === "starter-ready" || request.action === "api-ready") {
-    const url = request.action === "database-ready" ? "http://127.0.0.1:8529/_api/version" : request.action === "starter-ready" ? "http://10.42.0.21:8528/version" : "http://127.0.0.1:8787/health";
+    const starter = topology.find((entry) => entry.starter);
+    const url = request.action === "database-ready" ? "http://127.0.0.1:8529/_api/version" : request.action === "starter-ready" ? `http://${starter.address}:8528/version` : "http://127.0.0.1:8787/health";
     const response2 = await fetch(url, { signal: AbortSignal.timeout(2000) }).catch(() => {
       return;
     });
@@ -16542,6 +16629,7 @@ export {
   tenantNodeApiUrl,
   systemdListenFd,
   systemdAgentEgressDirectives,
+  supportedGuestImage,
   superviseAgentEgressPolicy,
   startSshBootstrapPull,
   startSoftwareHelper,
@@ -16631,6 +16719,7 @@ export {
   VERSION2 as VERSION,
   SYSTEMD_RESOLVED_STUB,
   SYSTEMD_RESOLVED_ADDRESS,
+  SUPPORTED_GUEST_IMAGES,
   SUPPORTED_GUEST_IMAGE,
   SOFTWARE_HELPER_UNIT_PATH,
   SOFTWARE_HELPER_GROUP,