@forgezero/agent 0.1.133 → 0.1.135

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.133";
+var VERSION3 = "0.1.135";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.133";
+var VERSION = "0.1.135";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/community-rehearsal-host.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/definition.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/deploy-compiler.d.ts

@@ -28,6 +28,7 @@ export interface DeploymentInitProvisioning {
     maxMonthlySpendMinor: string;
 }
 export interface DeploymentInitOptions {
+    branch?: string;
     runtime?: DeploymentInitRuntime;
     operatingSystem?: 'ubuntu-24.04' | 'ubuntu-26.04';
     isolation?: 'standard' | 'sev-snp';

package/dist/deploy-compiler.js

@@ -172,7 +172,7 @@ function validateCapacityCalibrationOptions(options) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -186,6 +186,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -821,7 +828,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -1152,6 +1162,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -1248,6 +1259,7 @@ function initCoordinates(options) {
   const isolation = options.isolation ?? (runtime === "kata-snp" ? "sev-snp" : "standard");
   const operatingSystem = options.operatingSystem ?? (isolation === "sev-snp" ? "ubuntu-26.04" : "ubuntu-24.04");
   const result = {
+    branch: options.branch ?? "main",
     runtime,
     isolation,
     operatingSystem,
@@ -1261,6 +1273,9 @@ function initCoordinates(options) {
   };
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.profile))
     throw new Error("deployment profile must be a lowercase typed name");
+  if (result.branch.length < 1 || result.branch.length > 255 || result.branch === "@" || result.branch.startsWith("/") || result.branch.endsWith("/") || result.branch.startsWith(".") || result.branch.endsWith(".") || result.branch.endsWith(".lock") || result.branch.includes("..") || result.branch.includes("//") || result.branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(result.branch)) {
+    throw new Error("deployment branch must be one exact valid Git branch name");
+  }
   if (!Number.isSafeInteger(result.replicas) || result.replicas < 1 || result.replicas > 1024)
     throw new Error("deployment replicas must be an integer from 1 to 1024");
   if (!Number.isSafeInteger(result.cpuCores) || result.cpuCores < 1 || result.cpuCores > 1024)
@@ -1379,6 +1394,7 @@ export default defineDeployment({
 	kind: 'Deployment',
 	metadata: { name: '${safeName(name)}' },
 	spec: {
+		source: { branch: '${selected.branch}' },
 		security: { attestation: '${selected.isolation === "sev-snp" ? "required" : "preferred"}' },
 		targets: {
 			app: target.compute({

package/dist/deploy-file.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/deploy-plan-runner.js

@@ -172,7 +172,7 @@ function validateCapacityCalibrationOptions(options) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -186,6 +186,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -821,7 +828,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -1152,6 +1162,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,

package/dist/deploy-plan.d.ts

@@ -1,6 +1,6 @@
 import type { DeploymentSource, StageDefinition, WorkflowStepDefinition } from './deploy';
 export declare const DEPLOY_PLAN_FORMAT: "forgezero-deployment-plan";
-export declare const DEPLOY_PLAN_VERSION: 1;
+export declare const DEPLOY_PLAN_VERSION: 2;
 export interface PlannedStep extends WorkflowStepDefinition {
     id: string;
 }
@@ -34,6 +34,8 @@ export interface DeploymentPlan {
 export declare class DeploymentPlanError extends Error {
     constructor(message: string);
 }
+/** Git check-ref-format compatible branch subset accepted by every source adapter. */
+export declare function deploymentBranch(value: unknown, where?: string): string;
 export declare function canonicalJson(value: unknown): string;
 export declare function deploymentSourceDigest(source: DeploymentSource): `sha256:${string}`;
 export declare function compileDeployment(sourceValue: unknown): DeploymentPlan;

package/dist/deploy-plan.js

@@ -172,7 +172,7 @@ function validateCapacityCalibrationOptions(options) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -186,6 +186,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -821,7 +828,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -1152,6 +1162,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -1235,6 +1246,7 @@ export {
   parseDeploymentPlan,
   deploymentSourceDigest,
   deploymentPlanDigest,
+  deploymentBranch,
   compileDeployment,
   canonicalJson,
   DeploymentPlanError,

package/dist/deploy.d.ts

@@ -466,6 +466,10 @@ export interface DeploymentSource {
         description?: string;
     };
     spec: {
+        /** Exact Git branch this checked-in plan is valid for. */
+        source: {
+            branch: string;
+        };
         security?: {
             attestation?: 'required' | 'preferred' | 'disabled';
         };

package/dist/deployment-pull.d.ts

@@ -12,6 +12,7 @@ export interface RemoteDeploymentClaim {
     releaseExecutor: boolean;
     assignment?: NonNullable<import('./deployment').DeploymentRequest['assignment']>;
     connectivityCapabilities?: import('./deployment-connectivity').DeploymentConnectivityCapabilities;
+    credentialBindings?: Readonly<Record<string, string>>;
     source: {
         repository: string;
         branch: string;

package/dist/deployment.d.ts

@@ -62,6 +62,8 @@ export interface DeploymentRequest {
     };
     /** Connector-scoped, one-claim capabilities. Never the project Cloudflare management token. */
     connectivityCapabilities?: DeploymentConnectivityCapabilities;
+    /** Server-owned alias to scoped Vault entry-name overrides. */
+    credentialBindings?: Readonly<Record<string, string>>;
 }
 export interface DeploymentResult {
     key: string;

package/dist/fz-agent.js

@@ -5024,6 +5024,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -5410,6 +5412,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
@@ -6445,7 +6462,7 @@ function validateBuiltInProvider(requirement2, where) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -6459,6 +6476,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -7094,7 +7118,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -7425,6 +7452,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -8551,7 +8579,7 @@ function createDeploymentManager(options) {
               const credential = plan.spec.credentials?.[credentialName];
               if (!credential || !options.cache)
                 throw new DeploymentActionError("refused", `credential ${credentialName} is unavailable`);
-              environment[environmentName] = await options.cache.get(credential.source.name);
+              environment[environmentName] = await options.cache.get(request.credentialBindings?.[credentialName] ?? credential.source.name);
               credentialValues.push(environment[environmentName]);
             }
           }
@@ -9101,7 +9129,8 @@ async function deployClaim(options, claim) {
       revision: claim.revision,
       releaseExecutor: claim.releaseExecutor,
       ...claim.assignment ? { assignment: claim.assignment } : {},
-      ...claim.connectivityCapabilities ? { connectivityCapabilities: claim.connectivityCapabilities } : {}
+      ...claim.connectivityCapabilities ? { connectivityCapabilities: claim.connectivityCapabilities } : {},
+      ...claim.credentialBindings ? { credentialBindings: claim.credentialBindings } : {}
     }).result;
     result = options.telemetry ? await options.telemetry.observe("deployment.run", run2) : await run2();
   } finally {
@@ -9652,7 +9681,7 @@ async function writeAndCloseProcessInput(input, value) {
 }
 
 // src/version.ts
-var VERSION2 = "0.1.133";
+var VERSION2 = "0.1.135";
 
 // src/ssh-bootstrap.ts
 function deriveMetalAdmissionProvisioning(lscpu) {

package/dist/fz.js

@@ -6007,7 +6007,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION2 = "0.1.133";
+var VERSION2 = "0.1.135";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -10816,7 +10816,7 @@ function validateBuiltInProvider(requirement2, where) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -10830,6 +10830,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION3 = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail2(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail2 = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -11465,7 +11472,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -11796,6 +11806,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -11888,6 +11899,7 @@ function initCoordinates(options) {
   const isolation = options.isolation ?? (runtime === "kata-snp" ? "sev-snp" : "standard");
   const operatingSystem = options.operatingSystem ?? (isolation === "sev-snp" ? "ubuntu-26.04" : "ubuntu-24.04");
   const result = {
+    branch: options.branch ?? "main",
     runtime,
     isolation,
     operatingSystem,
@@ -11901,6 +11913,9 @@ function initCoordinates(options) {
   };
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.profile))
     throw new Error("deployment profile must be a lowercase typed name");
+  if (result.branch.length < 1 || result.branch.length > 255 || result.branch === "@" || result.branch.startsWith("/") || result.branch.endsWith("/") || result.branch.startsWith(".") || result.branch.endsWith(".") || result.branch.endsWith(".lock") || result.branch.includes("..") || result.branch.includes("//") || result.branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(result.branch)) {
+    throw new Error("deployment branch must be one exact valid Git branch name");
+  }
   if (!Number.isSafeInteger(result.replicas) || result.replicas < 1 || result.replicas > 1024)
     throw new Error("deployment replicas must be an integer from 1 to 1024");
   if (!Number.isSafeInteger(result.cpuCores) || result.cpuCores < 1 || result.cpuCores > 1024)
@@ -12019,6 +12034,7 @@ export default defineDeployment({
 	kind: 'Deployment',
 	metadata: { name: '${safeName2(name)}' },
 	spec: {
+		source: { branch: '${selected.branch}' },
 		security: { attestation: '${selected.isolation === "sev-snp" ? "required" : "preferred"}' },
 		targets: {
 			app: target.compute({
@@ -20977,6 +20993,7 @@ async function cmdDeploy(options, args) {
       initializeTypeScriptDeployment(options.projectRoot, {
         name: options.projectName ?? basename3(resolve13(options.projectRoot)),
         force: options.force,
+        branch: options.branch,
         runtime: options.deployRuntime,
         operatingSystem: options.deployOperatingSystem,
         isolation: options.deployIsolation,

package/dist/metal-bootstrap.js

@@ -366,7 +366,7 @@ function systemdAgentEgressDirectives(loopbackTcpPorts = []) {
 }
 
 // src/version.ts
-var VERSION = "0.1.133";
+var VERSION = "0.1.135";
 
 // src/otel-collector.ts
 var FORGEZERO_OTEL_COLLECTOR_UNIT = "forgezero-otel-collector.service";

package/dist/metal-helper-socket.js

@@ -168,6 +168,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -554,6 +556,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/metal-provision.js

@@ -168,6 +168,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -554,6 +556,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/operator-bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.133";
+var VERSION = "0.1.135";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";

package/dist/platform-bootstrap-runtime.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/platform-fleet-verification.js

@@ -871,6 +871,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -1257,6 +1259,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join3(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join3(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync4(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
@@ -3032,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.133";
+var VERSION3 = "0.1.135";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/platform-genesis.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/provision.js

@@ -871,6 +871,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -1257,6 +1259,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join3(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join3(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync4(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
@@ -3032,7 +3049,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.133";
+var VERSION3 = "0.1.135";
 
 // src/egress-policy.ts
 import { realpathSync as realpathSync3 } from "node:fs";

package/dist/software-helper.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/software.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/ubuntu.js

@@ -28,6 +28,8 @@ var KATA_CONTAINERS_VERSION = "4.0.0";
 var NERDCTL_SHA256 = "de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee";
 var BUILDKIT_SHA256 = "2975d0f651ad96ba8b80b9992ae1f9a964f4408569af5b6dc36544165c3926af";
 var KATA_SHA256 = "2c3b9dfeba355582b40aee462b12916c9740654d0230f696adf719d67b063a8c";
+var RESOLUTE_HEADERS_MORE_URL = "https://archive.ubuntu.com/ubuntu/pool/universe/libn/libnginx-mod-http-headers-more-filter/libnginx-mod-http-headers-more-filter_0.39-2build3_amd64.deb";
+var RESOLUTE_HEADERS_MORE_SHA256 = "ead6e05183c89c0b6059bb15a493545b84aa4fc1cf05a0b54f825cd540c68bae";
 var OS_CATALOG = [
   {
     id: "ubuntu",
@@ -414,6 +416,21 @@ async function executeSoftwareOperation(operation) {
       if (universe.exitCode !== 0)
         return universe;
       installed = await aptInstallMany(["nginx", "libnginx-mod-http-headers-more-filter"]);
+      if (installed.exitCode !== 0 && version === "ubuntu-26.04") {
+        const core = await aptInstall("nginx");
+        if (core.exitCode !== 0)
+          return core;
+        const directory2 = mkdtempSync(join(tmpdir(), "forgezero-nginx-"));
+        try {
+          const module = join(directory2, "headers-more.deb");
+          await download(RESOLUTE_HEADERS_MORE_URL, module, RESOLUTE_HEADERS_MORE_SHA256, 1024 * 1024);
+          installed = await run(["/usr/bin/apt-get", "install", "-y", module], {
+            DEBIAN_FRONTEND: "noninteractive"
+          });
+        } finally {
+          rmSync(directory2, { recursive: true, force: true });
+        }
+      }
     } else
       installed = await aptInstall(packageName);
     if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** One package version shared by both public binaries. Pinned to package.json by tests. */
-export declare const VERSION = "0.1.133";
+export declare const VERSION = "0.1.135";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forgezero/agent",
-  "version": "0.1.133",
+  "version": "0.1.135",
   "type": "module",
   "scripts": {
     "check": "tsc --noEmit",