@forgezero/agent 0.1.78 → 0.1.80

package/dist/fz.js

@@ -4837,7 +4837,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.78";
+var VERSION2 = "0.1.80";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -10573,7 +10573,7 @@ function reference(value, where) {
   const row2 = object(value, where);
   exact3(row2, ["$ref"], where);
   const coordinate = boundedString(row2.$ref, `${where}.$ref`, 256);
-  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62}|execution\.(targetName|slot|releaseExecutor|runtime|cpuCores|memoryMiB|storageGiB))$/.test(coordinate)) {
+  if (!/^(inputs\.[a-z][A-Za-z0-9-]{0,62}|steps\.[a-z][A-Za-z0-9-]{0,62}\.(status|outputs\.[a-z][A-Za-z0-9-]{0,62})|components\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|targets\.[a-z][A-Za-z0-9-]{0,62}\.[a-z][A-Za-z0-9-]{0,62}|deployment\.[a-z][A-Za-z0-9-]{0,62}|execution\.(targetName|slot|releaseExecutor|runtime|cpuCores|memoryMiB|storageGiB|site|topologyRole|topologyTransport|localRelayAddress))$/.test(coordinate)) {
     fail2(where, "contains an unsupported reference.");
   }
   return { $ref: coordinate };
@@ -11005,6 +11005,12 @@ function validateStep(value, where, targets, context) {
     if (!targets.has(String(scope.target)))
       fail2(`${where}.scope.target`, "must name an existing target.");
     integer(scope.size, `${where}.scope.size`, 1, 32);
+  } else if (scope.kind === "topology-role") {
+    exact3(scope, ["kind", "target", "role"], `${where}.scope`);
+    if (!targets.has(String(scope.target)))
+      fail2(`${where}.scope.target`, "must name an existing target.");
+    if (!["relay", "standby", "member"].includes(String(scope.role)))
+      fail2(`${where}.scope.role`, "is unsupported.");
   } else
     fail2(`${where}.scope.kind`, "is unsupported.");
   if (row2.timeoutMs !== undefined)
@@ -11159,7 +11165,7 @@ function compileDeployment(sourceValue) {
   const targetDefinitions = new Map;
   for (const [targetName, value] of targetEntries) {
     const target = object(value, `deployment.spec.targets.${targetName}`);
-    exact3(target, ["kind", "selector", "cardinality", "allocation", "provisioning", "connectivity", "placement"], `deployment.spec.targets.${targetName}`);
+    exact3(target, ["kind", "selector", "cardinality", "allocation", "provisioning", "connectivity", "topology", "placement"], `deployment.spec.targets.${targetName}`);
     if (target.kind !== "compute")
       fail2(`deployment.spec.targets.${targetName}.kind`, "must be compute.");
     const selector = object(target.selector, `deployment.spec.targets.${targetName}.selector`);
@@ -11281,6 +11287,45 @@ function compileDeployment(sourceValue) {
         }
       }
     }
+    if (target.topology !== undefined) {
+      const topology = object(target.topology, `deployment.spec.targets.${targetName}.topology`);
+      exact3(topology, ["groupBy", "relays", "crossMetal"], `deployment.spec.targets.${targetName}.topology`);
+      if (topology.groupBy !== "metal")
+        fail2(`deployment.spec.targets.${targetName}.topology.groupBy`, "must be metal.");
+      const relays = object(topology.relays, `deployment.spec.targets.${targetName}.topology.relays`);
+      exact3(relays, ["activePerMetal", "standbyPerMetal", "healthPort", "routedTcpPorts"], `deployment.spec.targets.${targetName}.topology.relays`);
+      if (relays.activePerMetal !== 1 || ![0, 1].includes(Number(relays.standbyPerMetal)))
+        fail2(`deployment.spec.targets.${targetName}.topology.relays`, "requires one active relay and zero or one standby per metal.");
+      integer(relays.healthPort, `deployment.spec.targets.${targetName}.topology.relays.healthPort`, 1, 65535);
+      if (!Array.isArray(relays.routedTcpPorts) || relays.routedTcpPorts.length < 1 || relays.routedTcpPorts.length > 64 || new Set(relays.routedTcpPorts).size !== relays.routedTcpPorts.length) {
+        fail2(`deployment.spec.targets.${targetName}.topology.relays.routedTcpPorts`, "must contain 1 to 64 unique ports.");
+      }
+      for (const [index, port] of relays.routedTcpPorts.entries()) {
+        integer(port, `deployment.spec.targets.${targetName}.topology.relays.routedTcpPorts.${index}`, 1, 65535);
+      }
+      if (!relays.routedTcpPorts.includes(relays.healthPort)) {
+        fail2(`deployment.spec.targets.${targetName}.topology.relays`, "routedTcpPorts must include healthPort.");
+      }
+      const crossMetal = object(topology.crossMetal, `deployment.spec.targets.${targetName}.topology.crossMetal`);
+      if (crossMetal.mode === "private-lan")
+        exact3(crossMetal, ["mode"], `deployment.spec.targets.${targetName}.topology.crossMetal`);
+      else if (crossMetal.mode === "cloudflare-warp" || crossMetal.mode === "auto") {
+        exact3(crossMetal, crossMetal.mode === "auto" ? ["mode", "directPrivateMaximumMetals", "credential", "network"] : ["mode", "credential", "network"], `deployment.spec.targets.${targetName}.topology.crossMetal`);
+        if (crossMetal.mode === "auto" && crossMetal.directPrivateMaximumMetals !== 2)
+          fail2(`deployment.spec.targets.${targetName}.topology.crossMetal.directPrivateMaximumMetals`, "must be 2.");
+        if (!credentials[named(crossMetal.credential, `deployment.spec.targets.${targetName}.topology.crossMetal.credential`)])
+          fail2(`deployment.spec.targets.${targetName}.topology.crossMetal.credential`, "must name a declared credential.");
+        if (typeof crossMetal.network === "string")
+          named(crossMetal.network, `deployment.spec.targets.${targetName}.topology.crossMetal.network`);
+        else
+          reference(crossMetal.network, `deployment.spec.targets.${targetName}.topology.crossMetal.network`);
+      } else
+        fail2(`deployment.spec.targets.${targetName}.topology.crossMetal.mode`, "is unsupported.");
+      if (allocation.sharing !== "exclusive")
+        fail2(`deployment.spec.targets.${targetName}.allocation.sharing`, "must be exclusive for a per-metal relay topology.");
+      if (minimum < 1 + Number(relays.standbyPerMetal))
+        fail2(`deployment.spec.targets.${targetName}.cardinality.minimum`, "must allow the declared relay and standby.");
+    }
     if (target.placement !== undefined)
       jsonValue(target.placement, `deployment.spec.targets.${targetName}.placement`);
     targetDefinitions.set(targetName, target);
@@ -11304,6 +11349,9 @@ function compileDeployment(sourceValue) {
     if (target.connectivity?.private?.mode === "cloudflare-warp" && ![...requirementDefinitions.values()].some(({ capability }) => capability === "network.private")) {
       fail2(`deployment.spec.targets.${targetName}.connectivity.private`, "requires one network.private provider requirement.");
     }
+    if (target.topology && target.topology.crossMetal.mode !== "private-lan" && ![...requirementDefinitions.values()].some(({ capability }) => capability === "network.private")) {
+      fail2(`deployment.spec.targets.${targetName}.topology.crossMetal`, "requires one network.private provider requirement.");
+    }
   }
   const components = object(spec.components, "deployment.spec.components");
   const componentEntries = Object.entries(components);
@@ -12058,7 +12106,14 @@ function validatePlatformSharedEnvironment(input) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
-  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
+    throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
+  }
+  for (const member of input.seedSyncMembers)
+    safeAtom("seedSyncMembers item", member);
+  if (!input.seedSyncMembers.includes(input.nodeHostname)) {
+    throw new Error("seedSyncMembers must include this nodeHostname.");
+  }
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
   boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
   boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
@@ -12138,7 +12193,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_DB_MASTER: value.databaseMaster ?? "",
     FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
     FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
-    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_MEMBERS: value.seedSyncMembers.join(","),
     FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
     FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
     FZ_SHARED_DIR: value.sharedDirectory,
@@ -12207,7 +12262,12 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+  for (const path of [
+    input.sharedDirectory,
+    input.sharedEnvironmentFile,
+    input.slotsDirectory,
+    ...input.topologyEnvironmentFile ? [input.topologyEnvironmentFile] : []
+  ]) {
     if (!path.startsWith("/") || /[\r\n]/.test(path))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
@@ -12221,6 +12281,8 @@ function renderPlatformApiUnits(input) {
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
   const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const topologyEnvironment = input.topologyEnvironmentFile ? `EnvironmentFile=-${input.topologyEnvironmentFile}
 ` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
@@ -12234,7 +12296,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${capacityEnvironment}${credentials}
+${capacityEnvironment}${topologyEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2
@@ -14722,7 +14784,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       greenPort: runtime.greenPort,
       collectorUnit: runtime.environment.otlpCollectorUnit,
       credentials,
-      capacityEnvironmentFile: "/etc/forgezero/capacity.env"
+      capacityEnvironmentFile: "/etc/forgezero/capacity.env",
+      topologyEnvironmentFile: "/etc/forgezero/deployment-topology.env"
     });
     const edge = renderPlatformNginx({
       publicPort: runtime.environment.publicApiPort,
@@ -17298,8 +17361,8 @@ function platformGenesisBootstrapConfigs(template, guests, nodes, metalHostname,
       databaseAddress: guest.address,
       databaseMaster: role === "joiner" ? master : undefined,
       nodeHostname: node.nodeHostname,
-      seedSyncPeers: fleet.filter((_, peer) => peer !== index).map((peer) => `ws://${peer.address}:${config.runtime.bluePort}/internal/seed`),
-      seedSyncMembers: 3,
+      seedSyncPeers: fleet.filter((_, peer) => peer !== index).flatMap((peer) => [config.runtime.bluePort, config.runtime.greenPort].map((port) => `ws://${peer.address}:${port}/_internal/forgezero/seed-mesh/v2`)),
+      seedSyncMembers: nodes.map(({ nodeHostname }) => nodeHostname),
       initialInventory,
       custodianEmail: index === 0 ? template.runtime.environment.custodianEmail : undefined
     };
@@ -18642,7 +18705,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
   const collectorUnit = FORGEZERO_OTEL_COLLECTOR_UNIT;
   const replicationFactor = Number(bootstrapAnswer("Database replication factor", "3"));
   const writeConcern = Number(bootstrapAnswer("Database write concern", "2"));
-  const seedPeers = genesis ? fleet.slice(1).map((peer) => `ws://${peer.address}:3001/internal/seed`) : bootstrapAnswer("Seed WebSocket peers (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean);
+  const seedPeers = genesis ? fleet.slice(1).flatMap((peer) => [3001, 3002].map((port) => `ws://${peer.address}:${port}/_internal/forgezero/seed-mesh/v2`)) : bootstrapAnswer("Seed WebSocket peers (comma-separated)").split(",").map((item) => item.trim()).filter(Boolean);
   const emailProvider = bootstrapAnswer("Bootstrap email provider (smtp/jetemail)", "smtp");
   if (!["smtp", "jetemail"].includes(emailProvider))
     throw new Error("Bootstrap email provider must be smtp or jetemail");
@@ -18698,7 +18761,7 @@ function interactiveBootstrap(kind, genesisGuests, genesisCloudflareCheckpoint)
         publicApiPort: Number(bootstrapAnswer("Loopback public API port", "3000")),
         sharedDirectory: "/opt/forgezero/shared",
         seedSyncPeers: seedPeers,
-        seedSyncMembers: Number(bootstrapAnswer("Seed quorum members", "3")),
+        seedSyncMembers: bootstrapList("Seed member hostnames (comma-separated)"),
         seedSyncEpoch: bootstrapAnswer("Seed epoch"),
         concurrencyLimit: Number(bootstrapAnswer("Initial concurrency limit", "128")),
         drainDeadlineMs: Number(bootstrapAnswer("Drain deadline milliseconds", "30000")),

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export type { AgentCredentialLocation, DeploymentCredentialBinding, DeploymentCr
 export { createDeploymentManager, DeploymentError } from './deployment';
 export type { DeploymentManager, DeploymentOptions, DeploymentRequest, DeploymentResult } from './deployment';
 export { DeploymentInputError, resolveDeploymentInputs, resolveDeploymentTargets } from './deployment-targets';
+export { DeploymentTopologyError, planDeploymentTopology, type DeploymentTopologyAssignment, type DeploymentTopologyPlacement, type DeploymentTopologyRole, type DeploymentTopologyTransport } from './deployment-topology';
 export { DEFAULT_CONTROL_SOCKET, requestControl, startControlServer } from './control';
 export { pullDeploymentOnce, startDeploymentPull } from './deployment-pull';
 export type { DeploymentPullOptions, RemoteDeploymentClaim, PullResult } from './deployment-pull';

package/dist/metal-bootstrap.js

@@ -354,7 +354,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.78";
+var VERSION = "0.1.80";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -305,16 +305,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/metal-provision.js

@@ -305,16 +305,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });

package/dist/operator-bootstrap.js

@@ -1416,7 +1416,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.78";
+var VERSION = "0.1.80";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3089,7 +3089,14 @@ function validatePlatformSharedEnvironment(input) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
-  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
+    throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
+  }
+  for (const member of input.seedSyncMembers)
+    safeAtom("seedSyncMembers item", member);
+  if (!input.seedSyncMembers.includes(input.nodeHostname)) {
+    throw new Error("seedSyncMembers must include this nodeHostname.");
+  }
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
   boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
   boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
@@ -3169,7 +3176,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_DB_MASTER: value.databaseMaster ?? "",
     FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
     FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
-    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_MEMBERS: value.seedSyncMembers.join(","),
     FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
     FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
     FZ_SHARED_DIR: value.sharedDirectory,
@@ -3238,7 +3245,12 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+  for (const path of [
+    input.sharedDirectory,
+    input.sharedEnvironmentFile,
+    input.slotsDirectory,
+    ...input.topologyEnvironmentFile ? [input.topologyEnvironmentFile] : []
+  ]) {
     if (!path.startsWith("/") || /[\r\n]/.test(path))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
@@ -3252,6 +3264,8 @@ function renderPlatformApiUnits(input) {
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
   const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const topologyEnvironment = input.topologyEnvironmentFile ? `EnvironmentFile=-${input.topologyEnvironmentFile}
 ` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
@@ -3265,7 +3279,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${capacityEnvironment}${credentials}
+${capacityEnvironment}${topologyEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2
@@ -4517,7 +4531,8 @@ async function applyBootstrap(input, host = localBootstrapHost(), secrets, depen
       greenPort: runtime.greenPort,
       collectorUnit: runtime.environment.otlpCollectorUnit,
       credentials,
-      capacityEnvironmentFile: "/etc/forgezero/capacity.env"
+      capacityEnvironmentFile: "/etc/forgezero/capacity.env",
+      topologyEnvironmentFile: "/etc/forgezero/deployment-topology.env"
     });
     const edge = renderPlatformNginx({
       publicPort: runtime.environment.publicApiPort,

package/dist/platform-bootstrap-runtime.d.ts

@@ -62,7 +62,8 @@ export interface PlatformSharedEnvironment {
     publicApiPort: number;
     sharedDirectory: string;
     seedSyncPeers: string[];
-    seedSyncMembers: number;
+    /** Exact physical API host identities participating in this seed epoch. */
+    seedSyncMembers: string[];
     seedSyncEpoch: string;
     concurrencyLimit: number;
     drainDeadlineMs: number;
@@ -120,6 +121,8 @@ export interface ApiRuntimeRenderOptions {
     credentials: SystemdCredentialSpec[];
     /** Root-owned calibration override, loaded after the ordinary shared environment. */
     capacityEnvironmentFile?: string;
+    /** Root-owned signed deployment topology, absent until post-genesis reconciliation. */
+    topologyEnvironmentFile?: string;
 }
 export declare function renderPlatformApiUnits(input: ApiRuntimeRenderOptions): {
     template: string;

package/dist/platform-bootstrap-runtime.js

@@ -165,16 +165,38 @@ var runSoftwareCommand = async (argv, env = {}) => {
   return { exitCode, output: `${stdout}${stderr}` };
 };
 var run = runSoftwareCommand;
+var softwareDownloadCommand = (url, destination, maximumBytes) => {
+  const source = new URL(url);
+  if (source.protocol !== "https:" || source.username || source.password)
+    throw new Error("software download must use credential-free HTTPS");
+  if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1)
+    throw new Error("software download size bound is invalid");
+  return [
+    "/usr/bin/curl",
+    "--fail",
+    "--location",
+    "--silent",
+    "--show-error",
+    "--proto",
+    "=https",
+    "--tlsv1.2",
+    "--max-time",
+    "1800",
+    "--max-filesize",
+    String(maximumBytes),
+    "--output",
+    destination,
+    source.href
+  ];
+};
 var download = async (url, destination, sha256, maximumBytes = 512 * 1024 * 1024) => {
-  const response = await fetch(url, { redirect: "follow", signal: AbortSignal.timeout(30 * 60000) });
-  if (!response.ok)
-    throw new Error(`download failed with HTTP ${response.status}`);
-  const declared = Number(response.headers.get("content-length") ?? 0);
-  if (declared > maximumBytes)
-    throw new Error("download exceeds reviewed size bound");
   if (existsSync(destination))
     throw new Error("download destination already exists");
-  await Bun.write(destination, response);
+  const received = await run(softwareDownloadCommand(url, destination, maximumBytes));
+  if (received.exitCode !== 0) {
+    rmSync(destination, { force: true });
+    throw new Error(`software download failed (${received.exitCode}): ${received.output.trim()}`);
+  }
   chmodSync(destination, 384);
   if (statSync(destination).size > maximumBytes) {
     rmSync(destination, { force: true });
@@ -789,7 +811,14 @@ function validatePlatformSharedEnvironment(input) {
     throw new Error("Bootstrap email provider must be smtp or jetemail.");
   }
   boundedInteger("publicApiPort", input.publicApiPort, 1024, 65533);
-  boundedInteger("seedSyncMembers", input.seedSyncMembers, 1, 64);
+  if (!Array.isArray(input.seedSyncMembers) || input.seedSyncMembers.length < 3 || input.seedSyncMembers.length > 64 || new Set(input.seedSyncMembers).size !== input.seedSyncMembers.length) {
+    throw new Error("seedSyncMembers must contain 3 to 64 unique physical host identities.");
+  }
+  for (const member of input.seedSyncMembers)
+    safeAtom("seedSyncMembers item", member);
+  if (!input.seedSyncMembers.includes(input.nodeHostname)) {
+    throw new Error("seedSyncMembers must include this nodeHostname.");
+  }
   boundedInteger("concurrencyLimit", input.concurrencyLimit, 1, 1e6);
   boundedInteger("drainDeadlineMs", input.drainDeadlineMs, 1000, 300000);
   boundedInteger("otlpFlushIntervalMs", input.otlpFlushIntervalMs, 1000, 300000);
@@ -869,7 +898,7 @@ function renderPlatformSharedEnvironment(input) {
     FZ_DB_MASTER: value.databaseMaster ?? "",
     FZ_DB_NETWORK_MODE: value.databaseNetworkMode,
     FZ_SEED_SYNC_PEERS: value.seedSyncPeers.join(","),
-    FZ_SEED_SYNC_MEMBERS: String(value.seedSyncMembers),
+    FZ_SEED_SYNC_MEMBERS: value.seedSyncMembers.join(","),
     FZ_SEED_SYNC_EPOCH: value.seedSyncEpoch,
     FZ_SEED_SYNC_CREDENTIAL: "seed-sync-root",
     FZ_SHARED_DIR: value.sharedDirectory,
@@ -938,7 +967,12 @@ function platformApiCredentialSpecs(options) {
   ];
 }
 function renderPlatformApiUnits(input) {
-  for (const path2 of [input.sharedDirectory, input.sharedEnvironmentFile, input.slotsDirectory]) {
+  for (const path2 of [
+    input.sharedDirectory,
+    input.sharedEnvironmentFile,
+    input.slotsDirectory,
+    ...input.topologyEnvironmentFile ? [input.topologyEnvironmentFile] : []
+  ]) {
     if (!path2.startsWith("/") || /[\r\n]/.test(path2))
       throw new Error("Runtime paths must be absolute and single-line.");
   }
@@ -952,6 +986,8 @@ function renderPlatformApiUnits(input) {
   const credentials = input.credentials.map((credential) => `LoadCredentialEncrypted=${credential.name}:${credential.encryptedPath}`).join(`
 `);
   const capacityEnvironment = input.capacityEnvironmentFile ? `EnvironmentFile=-${input.capacityEnvironmentFile}
+` : "";
+  const topologyEnvironment = input.topologyEnvironmentFile ? `EnvironmentFile=-${input.topologyEnvironmentFile}
 ` : "";
   const template = `[Unit]
 Description=ForgeZero (%i slot)
@@ -965,7 +1001,7 @@ WorkingDirectory=${input.slotsDirectory}/%i
 Environment=NODE_ENV=production
 Environment=FZ_SLOT=%i
 EnvironmentFile=${input.sharedEnvironmentFile}
-${capacityEnvironment}${credentials}
+${capacityEnvironment}${topologyEnvironment}${credentials}
 ExecStart=/usr/local/bin/bun run ${input.slotsDirectory}/%i/src/index.ts
 Restart=always
 RestartSec=2