@forgezero/agent 0.1.134 → 0.1.136

package/README.md

@@ -101,7 +101,7 @@ export default defineDeployment({
 	  provisioning: {
 	    regionKey: 'default', imageKey: 'ubuntu-24.04-x64', environmentKey: 'production', ownership: 'platform',
 	    resources: {
-	      physicalCores: 1, vcpu: 2, memoryGib: 2, diskGib: 16,
+	      physicalCores: 1, vcpu: 2, memoryGib: 2, diskGib: 16, diskEncryption: 'luks2',
 	      egressGuaranteedMbps: 100, egressBurstMbps: 200, confidential: false
 	    },
 	    monthlyAmountCents: '1200', maxMonthlySpendMinor: '25000'

package/dist/agent-heartbeat.js

@@ -917,7 +917,7 @@ async function postSignedNode(options, path, body) {
 }
 
 // src/version.ts
-var VERSION3 = "0.1.134";
+var VERSION3 = "0.1.136";
 
 // src/agent-heartbeat.ts
 function readAgentHostMetrics() {

package/dist/bootstrap.js

@@ -1460,7 +1460,7 @@ var UPDATE_RETRY_BASE_MS = 5 * 60000;
 var UPDATE_RETRY_MAX_MS = 24 * 60 * 60000;
 
 // src/version.ts
-var VERSION = "0.1.134";
+var VERSION = "0.1.136";
 
 // src/software.ts
 var PINNED_BUN_VERSION = "1.3.14";
@@ -3070,6 +3070,10 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       throw new Error("platform genesis vCPU count cannot be smaller than physical cores");
     const memoryGib = integer(input.memoryGib, 1, 8192, "memory");
     const diskGib = integer(input.diskGib, 8, 65536, "disk");
+    const diskEncryption = input.diskEncryption ?? "none";
+    if (!["none", "luks2"].includes(diskEncryption)) {
+      throw new Error("platform genesis disk encryption mode is unsupported");
+    }
     const egressGuaranteedMbps = integer(input.egressGuaranteedMbps, 0, 1e6, "guaranteed egress");
     const egressBurstMbps = integer(input.egressBurstMbps, egressGuaranteedMbps, 1e6, "burst egress");
     return {
@@ -3081,6 +3085,7 @@ function validatePlatformGenesisGuests(guests, expectedCount = 3) {
       vcpu,
       memoryGib,
       diskGib,
+      diskEncryption,
       egressGuaranteedMbps,
       egressBurstMbps,
       confidential: input.confidential
@@ -3111,6 +3116,7 @@ var claimFor = (guest, keys, action) => {
       vcpu: guest.vcpu,
       memoryGib: guest.memoryGib,
       diskGib: guest.diskGib,
+      diskEncryption: guest.diskEncryption,
       egressGuaranteedMbps: guest.egressGuaranteedMbps,
       egressBurstMbps: guest.egressBurstMbps,
       confidential: guest.confidential
@@ -3200,6 +3206,7 @@ function validatePlatformInitialInventory(value) {
       "vcpu",
       "memoryGib",
       "diskGib",
+      "diskEncryption",
       "egressGuaranteedMbps",
       "egressBurstMbps",
       "confidential",
@@ -5230,6 +5237,7 @@ function strictBootstrapDocument(value) {
           "vcpu",
           "memoryGib",
           "diskGib",
+          "diskEncryption",
           "egressGuaranteedMbps",
           "egressBurstMbps",
           "confidential",

package/dist/compute.d.ts

@@ -35,6 +35,13 @@ export interface GuestSpec {
     memoryGib: number;
     /** Block device or image path. Raw LVM on our metal; a file is allowed. */
     disk: string;
+    /** Host-at-rest LUKS2 envelope. The key is a host-sealed systemd credential. */
+    diskEncryption?: {
+        source: string;
+        mapper: string;
+        credentialName: string;
+        credentialPath: string;
+    };
     /** cloud-init seed, attached read-only. */
     seed: string;
     bridge: string;

package/dist/compute.js

@@ -56,6 +56,10 @@ function guestUnit(spec) {
     `ExecStopPost=-/usr/sbin/ip link del ${spec.tap}`
   ].join(`
 `) : "";
+  const encryptedDisk = spec.diskEncryption ? `LoadCredentialEncrypted=${spec.diskEncryption.credentialName}:${spec.diskEncryption.credentialPath}
+ExecStartPre=/usr/sbin/cryptsetup open --type luks2 --key-file %d/${spec.diskEncryption.credentialName} ${spec.diskEncryption.source} ${spec.diskEncryption.mapper}
+ExecStopPost=-/usr/sbin/cryptsetup close ${spec.diskEncryption.mapper}
+` : "";
   return `[Unit]
 Description=ForgeZero guest ${spec.name}
 Documentation=https://www.forgezero.net
@@ -65,7 +69,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 Slice=forgezero-guests.slice
-${tapSetup}
+${encryptedDisk}${tapSetup}
 ExecStart=${argv}
 Restart=always
 RestartSec=5

package/dist/deploy-compiler.d.ts

@@ -20,6 +20,7 @@ export interface DeploymentInitProvisioning {
         vcpu: number;
         memoryGib: number;
         diskGib: number;
+        diskEncryption?: 'none' | 'luks2';
         egressGuaranteedMbps: number;
         egressBurstMbps: number;
         confidential: boolean;
@@ -28,6 +29,7 @@ export interface DeploymentInitProvisioning {
     maxMonthlySpendMinor: string;
 }
 export interface DeploymentInitOptions {
+    branch?: string;
     runtime?: DeploymentInitRuntime;
     operatingSystem?: 'ubuntu-24.04' | 'ubuntu-26.04';
     isolation?: 'standard' | 'sev-snp';

package/dist/deploy-compiler.js

@@ -172,7 +172,7 @@ function validateCapacityCalibrationOptions(options) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -186,6 +186,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -821,7 +828,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -918,11 +928,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")
@@ -1152,6 +1164,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -1248,6 +1261,7 @@ function initCoordinates(options) {
   const isolation = options.isolation ?? (runtime === "kata-snp" ? "sev-snp" : "standard");
   const operatingSystem = options.operatingSystem ?? (isolation === "sev-snp" ? "ubuntu-26.04" : "ubuntu-24.04");
   const result = {
+    branch: options.branch ?? "main",
     runtime,
     isolation,
     operatingSystem,
@@ -1261,6 +1275,9 @@ function initCoordinates(options) {
   };
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(result.profile))
     throw new Error("deployment profile must be a lowercase typed name");
+  if (result.branch.length < 1 || result.branch.length > 255 || result.branch === "@" || result.branch.startsWith("/") || result.branch.endsWith("/") || result.branch.startsWith(".") || result.branch.endsWith(".") || result.branch.endsWith(".lock") || result.branch.includes("..") || result.branch.includes("//") || result.branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(result.branch)) {
+    throw new Error("deployment branch must be one exact valid Git branch name");
+  }
   if (!Number.isSafeInteger(result.replicas) || result.replicas < 1 || result.replicas > 1024)
     throw new Error("deployment replicas must be an integer from 1 to 1024");
   if (!Number.isSafeInteger(result.cpuCores) || result.cpuCores < 1 || result.cpuCores > 1024)
@@ -1290,7 +1307,7 @@ function initCoordinates(options) {
       if (!/^[a-z][a-z0-9-]{0,62}$/.test(value))
         throw new Error(`deployment provisioning ${label} must be a lowercase typed name`);
     const resources = options.provisioning.resources;
-    for (const [label, value] of Object.entries(resources).filter(([key]) => key !== "confidential")) {
+    for (const [label, value] of Object.entries(resources).filter(([key]) => !["confidential", "diskEncryption"].includes(key))) {
       if (!Number.isSafeInteger(value) || Number(value) < 0)
         throw new Error(`deployment provisioning ${label} must be a non-negative integer`);
     }
@@ -1299,6 +1316,8 @@ function initCoordinates(options) {
     }
     if (result.isolation === "sev-snp" && !resources.confidential)
       throw new Error("deployment provisioning must provide confidential capacity for sev-snp");
+    if (resources.diskEncryption !== undefined && !["none", "luks2"].includes(resources.diskEncryption))
+      throw new Error("deployment provisioning disk encryption mode is unsupported");
     if (!/^\d{1,18}$/.test(options.provisioning.monthlyAmountCents))
       throw new Error("deployment provisioning monthly amount must be a bounded USD-cent amount");
     if (!/^\d{1,18}$/.test(options.provisioning.maxMonthlySpendMinor))
@@ -1310,7 +1329,10 @@ function initCoordinates(options) {
     if (options.provisioning.metalHostname && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(options.provisioning.metalHostname))
       throw new Error("deployment provisioning metal hostname is invalid");
   }
-  return { ...result, ...options.provisioning ? { provisioning: options.provisioning } : {} };
+  return { ...result, ...options.provisioning ? { provisioning: {
+    ...options.provisioning,
+    resources: { ...options.provisioning.resources, diskEncryption: options.provisioning.resources.diskEncryption ?? "luks2" }
+  } } : {} };
 }
 function defaultTypeScriptDeployment(name, options = {}) {
   const selected = initCoordinates(options);
@@ -1379,6 +1401,7 @@ export default defineDeployment({
 	kind: 'Deployment',
 	metadata: { name: '${safeName(name)}' },
 	spec: {
+		source: { branch: '${selected.branch}' },
 		security: { attestation: '${selected.isolation === "sev-snp" ? "required" : "preferred"}' },
 		targets: {
 			app: target.compute({

package/dist/deploy-plan-runner.js

@@ -172,7 +172,7 @@ function validateCapacityCalibrationOptions(options) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -186,6 +186,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -821,7 +828,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -918,11 +928,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")
@@ -1152,6 +1164,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,

package/dist/deploy-plan.d.ts

@@ -1,6 +1,6 @@
 import type { DeploymentSource, StageDefinition, WorkflowStepDefinition } from './deploy';
 export declare const DEPLOY_PLAN_FORMAT: "forgezero-deployment-plan";
-export declare const DEPLOY_PLAN_VERSION: 1;
+export declare const DEPLOY_PLAN_VERSION: 2;
 export interface PlannedStep extends WorkflowStepDefinition {
     id: string;
 }
@@ -34,6 +34,8 @@ export interface DeploymentPlan {
 export declare class DeploymentPlanError extends Error {
     constructor(message: string);
 }
+/** Git check-ref-format compatible branch subset accepted by every source adapter. */
+export declare function deploymentBranch(value: unknown, where?: string): string;
 export declare function canonicalJson(value: unknown): string;
 export declare function deploymentSourceDigest(source: DeploymentSource): `sha256:${string}`;
 export declare function compileDeployment(sourceValue: unknown): DeploymentPlan;

package/dist/deploy-plan.js

@@ -172,7 +172,7 @@ function validateCapacityCalibrationOptions(options) {
 
 // src/deploy-plan.ts
 var DEPLOY_PLAN_FORMAT = "forgezero-deployment-plan";
-var DEPLOY_PLAN_VERSION = 1;
+var DEPLOY_PLAN_VERSION = 2;
 
 class DeploymentPlanError extends Error {
   constructor(message) {
@@ -186,6 +186,13 @@ var ACTION = /^[a-z][a-z0-9.-]{0,127}\/[a-z][a-z0-9.-]{0,127}@[1-9][0-9]{0,5}$/;
 var VERSION = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
 var ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/?)*$/;
 var HEALTH_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,255}$/;
+function deploymentBranch(value, where = "deployment.spec.source.branch") {
+  const branch = boundedString(value, where, 255);
+  if (branch === "@" || branch.startsWith("/") || branch.endsWith("/") || branch.startsWith(".") || branch.endsWith(".") || branch.endsWith(".lock") || branch.includes("..") || branch.includes("//") || branch.includes("@{") || /[\x00-\x20~^:?*\[\\]/.test(branch)) {
+    fail(where, "must be one exact valid Git branch name.");
+  }
+  return branch;
+}
 var fail = (where, message) => {
   throw new DeploymentPlanError(`${where} ${message}`);
 };
@@ -821,7 +828,10 @@ function compileDeployment(sourceValue) {
   if (metadata.description !== undefined)
     boundedString(metadata.description, "deployment.metadata.description", 1024);
   const spec = object(source.spec, "deployment.spec");
-  exact3(spec, ["security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  exact3(spec, ["source", "security", "inputs", "credentials", "targets", "requirements", "components", "workflows"], "deployment.spec");
+  const sourceSelector = object(spec.source, "deployment.spec.source");
+  exact3(sourceSelector, ["branch"], "deployment.spec.source");
+  deploymentBranch(sourceSelector.branch);
   if (spec.security !== undefined) {
     const security = object(spec.security, "deployment.spec.security");
     exact3(security, ["attestation"], "deployment.spec.security");
@@ -918,11 +928,13 @@ function compileDeployment(sourceValue) {
       if (provisioning.metalHostname !== undefined && !/^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?$/.test(String(provisioning.metalHostname)))
         fail(`deployment.spec.targets.${targetName}.provisioning.metalHostname`, "is invalid.");
       const provisionedResources = object(provisioning.resources, `deployment.spec.targets.${targetName}.provisioning.resources`);
-      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
+      exact3(provisionedResources, ["physicalCores", "vcpu", "memoryGib", "diskGib", "diskEncryption", "egressGuaranteedMbps", "egressBurstMbps", "confidential"], `deployment.spec.targets.${targetName}.provisioning.resources`);
       integer(provisionedResources.physicalCores, `deployment.spec.targets.${targetName}.provisioning.resources.physicalCores`, 1, 1024);
       integer(provisionedResources.vcpu, `deployment.spec.targets.${targetName}.provisioning.resources.vcpu`, 1, 4096);
       integer(provisionedResources.memoryGib, `deployment.spec.targets.${targetName}.provisioning.resources.memoryGib`, 1, 4194304);
       integer(provisionedResources.diskGib, `deployment.spec.targets.${targetName}.provisioning.resources.diskGib`, 1, 1048576);
+      if (provisionedResources.diskEncryption !== undefined && !["none", "luks2"].includes(String(provisionedResources.diskEncryption)))
+        fail(`deployment.spec.targets.${targetName}.provisioning.resources.diskEncryption`, "must be none or luks2.");
       integer(provisionedResources.egressGuaranteedMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressGuaranteedMbps`, 0, 1e7);
       integer(provisionedResources.egressBurstMbps, `deployment.spec.targets.${targetName}.provisioning.resources.egressBurstMbps`, Number(provisionedResources.egressGuaranteedMbps), 1e7);
       if (typeof provisionedResources.confidential !== "boolean")
@@ -1152,6 +1164,7 @@ function compileDeployment(sourceValue) {
     ...metadata.description ? { description: metadata.description } : {},
     requiredProviders: [...requiredProviders.values()].sort((left, right) => `${left.provider}:${left.contract}:${left.capability}`.localeCompare(`${right.provider}:${right.contract}:${right.capability}`)),
     spec: {
+      source: sourceSelector,
       ...spec.security ? { security: spec.security } : {},
       inputs,
       credentials,
@@ -1235,6 +1248,7 @@ export {
   parseDeploymentPlan,
   deploymentSourceDigest,
   deploymentPlanDigest,
+  deploymentBranch,
   compileDeployment,
   canonicalJson,
   DeploymentPlanError,

package/dist/deploy.d.ts

@@ -195,6 +195,7 @@ export interface TargetDefinition {
             vcpu: number;
             memoryGib: number;
             diskGib: number;
+            diskEncryption?: 'none' | 'luks2';
             egressGuaranteedMbps: number;
             egressBurstMbps: number;
             confidential: boolean;
@@ -466,6 +467,10 @@ export interface DeploymentSource {
         description?: string;
     };
     spec: {
+        /** Exact Git branch this checked-in plan is valid for. */
+        source: {
+            branch: string;
+        };
         security?: {
             attestation?: 'required' | 'preferred' | 'disabled';
         };

package/dist/deployment-pull.d.ts

@@ -12,6 +12,7 @@ export interface RemoteDeploymentClaim {
     releaseExecutor: boolean;
     assignment?: NonNullable<import('./deployment').DeploymentRequest['assignment']>;
     connectivityCapabilities?: import('./deployment-connectivity').DeploymentConnectivityCapabilities;
+    credentialBindings?: Readonly<Record<string, string>>;
     source: {
         repository: string;
         branch: string;

package/dist/deployment.d.ts

@@ -62,6 +62,8 @@ export interface DeploymentRequest {
     };
     /** Connector-scoped, one-claim capabilities. Never the project Cloudflare management token. */
     connectivityCapabilities?: DeploymentConnectivityCapabilities;
+    /** Server-owned alias to scoped Vault entry-name overrides. */
+    credentialBindings?: Readonly<Record<string, string>>;
 }
 export interface DeploymentResult {
     key: string;
@@ -137,6 +139,7 @@ export interface ResolvedDeploymentTarget {
             vcpu: number;
             memoryGib: number;
             diskGib: number;
+            diskEncryption?: 'none' | 'luks2';
             egressGuaranteedMbps: number;
             egressBurstMbps: number;
             confidential: boolean;