@forgezero/agent 0.1.53 → 0.1.56

package/dist/platform-fleet-verification.js

@@ -682,6 +682,7 @@ import {
   accessSync,
   chmodSync as chmodSync3,
   copyFileSync,
+  existsSync as existsSync3,
   mkdtempSync,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
@@ -702,6 +703,7 @@ var OS_CATALOG = [
 ];
 var SOFTWARE_CATALOG = [
   { id: "bun", version: "1.3.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
+  { id: "docker", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "nginx", version: "ubuntu-26.04", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "arangodb", version: "3.11.14", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
   { id: "cloudflared", version: "2026.7.3", status: "active", os: "ubuntu", osVersion: "26.04", architecture: "x64", evidence: "reviewed-strategy-and-tests" },
@@ -711,6 +713,7 @@ var SOFTWARE_CATALOG = [
 ];
 var UBUNTU_2604_X64 = [
   { requirement: { id: "bun", version: "1.3.14" } },
+  { requirement: { id: "docker", version: "ubuntu-26.04" } },
   { requirement: { id: "nginx", version: "ubuntu-26.04" } },
   { requirement: { id: "arangodb", version: "3.11.14" } },
   { requirement: { id: "cloudflared", version: "2026.7.3" } },
@@ -719,6 +722,15 @@ var UBUNTU_2604_X64 = [
   { requirement: { id: "openssh-client", version: "ubuntu-26.04" } }
 ];
 var path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var DOCKER_DAEMON_PATH = "/etc/docker/daemon.json";
+var DOCKER_DAEMON_CONFIG = `${JSON.stringify({
+  "data-root": "/var/lib/docker",
+  "storage-driver": "overlay2",
+  "live-restore": true,
+  "log-driver": "local",
+  "log-opts": { "max-size": "10m", "max-file": "3" }
+}, null, 2)}
+`;
 var softwareSpawnFailure = (cause, argv) => cause.code === "ENOENT" ? { exitCode: 127, output: `executable is absent: ${argv[0]}` } : undefined;
 var runSoftwareCommand = async (argv, env = {}) => {
   let child;
@@ -761,6 +773,15 @@ async function executeSoftwareOperation(operation) {
   if (operation.kind === "check") {
     if (software === "bun")
       return run(["/usr/local/bin/bun", "--version"]).then((r) => ({ ...r, exitCode: successful(r, /^1\.3\.14\s*$/m) ? 0 : 1 }));
+    if (software === "docker") {
+      const binary = await run(["/usr/bin/docker", "--version"]);
+      if (!successful(binary, /Docker version/))
+        return { ...binary, exitCode: 1 };
+      if (!existsSync3(DOCKER_DAEMON_PATH) || readFileSync3(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG)
+        return { exitCode: 1, output: "Docker daemon policy is absent or differs from the reviewed ForgeZero policy" };
+      const active = await run(["/usr/bin/systemctl", "is-active", "--quiet", "docker.service"]);
+      return active.exitCode === 0 ? { exitCode: 0, output: binary.output } : active;
+    }
     if (software === "nginx") {
       const binary = await run(["/usr/sbin/nginx", "-v"]);
       return binary.exitCode === 0 ? run(["/usr/bin/systemctl", "is-active", "--quiet", "nginx.service"]) : binary;
@@ -793,11 +814,22 @@ async function executeSoftwareOperation(operation) {
       return { exitCode: 1, output: cause instanceof Error ? cause.message : String(cause) };
     }
   }
-  if (software === "nginx" || software === "ufw" || software === "openssh-client") {
-    const installed = await aptInstall(software === "openssh-client" ? "openssh-client" : software);
-    if (installed.exitCode !== 0 || software !== "nginx")
+  if (software === "docker" || software === "nginx" || software === "ufw" || software === "openssh-client") {
+    const packageName = software === "openssh-client" ? "openssh-client" : software === "docker" ? "docker.io" : software;
+    const installed = await aptInstall(packageName);
+    if (installed.exitCode !== 0 || software !== "nginx" && software !== "docker")
       return installed;
-    return run(["/usr/bin/systemctl", "enable", "--now", "nginx.service"]);
+    if (software === "docker") {
+      mkdirSync3("/etc/docker", { recursive: true, mode: 493 });
+      if (existsSync3(DOCKER_DAEMON_PATH) && readFileSync3(DOCKER_DAEMON_PATH, "utf8") !== DOCKER_DAEMON_CONFIG) {
+        return { exitCode: 2, output: "refusing to overwrite an existing Docker daemon configuration that differs from the reviewed ForgeZero policy" };
+      }
+      if (!existsSync3(DOCKER_DAEMON_PATH))
+        writeFileSync3(DOCKER_DAEMON_PATH, DOCKER_DAEMON_CONFIG, { mode: 420, flag: "wx" });
+      const enabled = await run(["/usr/bin/systemctl", "enable", "docker.service"]);
+      return enabled.exitCode === 0 ? run(["/usr/bin/systemctl", "restart", "docker.service"]) : enabled;
+    }
+    return run(["/usr/bin/systemctl", "enable", "--now", `${software}.service`]);
   }
   const directory = mkdtempSync(join3(tmpdir(), "forgezero-software-"));
   try {
@@ -882,7 +914,7 @@ function validateSoftwareRequirements(value, _options = {}) {
     if (Object.keys(row).some((key) => key !== "id" && key !== "version")) {
       throw new Error("software requirement contains an unknown field");
     }
-    if (!["bun", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
+    if (!["bun", "docker", "nginx", "arangodb", "cloudflared", "cloudflare-warp", "ufw", "openssh-client"].includes(String(row.id)) || typeof row.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9.-]{0,31}$/.test(row.version)) {
       throw new Error("software requirement coordinate is invalid");
     }
     const requirement = { id: row.id, version: row.version };
@@ -1355,13 +1387,13 @@ function phasePipeline(definition, phase, profile, executeRelease = false) {
 }
 
 // src/software-helper.ts
-import { chmodSync as chmodSync4, existsSync as existsSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync6, unlinkSync as unlinkSync3 } from "node:fs";
 import { connect as connect2, createServer as createServer2 } from "node:net";
-import { dirname as dirname4 } from "node:path";
+import { dirname as dirname5 } from "node:path";
 
 // src/service-supervisor.ts
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync, realpathSync, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, readdirSync, realpathSync, renameSync as renameSync4, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname3, join as join4, resolve as resolve3, sep } from "node:path";
 var SERVICE_STATE_DIRECTORY = "/var/lib/forgezero/services";
 var SERVICE_CONFIG_DIRECTORY = "/etc/forgezero/services";
@@ -1378,8 +1410,8 @@ var defaultHost = {
     renameSync4(next, path2);
   },
   read: (path2) => readFileSync4(path2, "utf8"),
-  exists: existsSync3,
-  list: (path2) => existsSync3(path2) ? readdirSync(path2) : [],
+  exists: existsSync4,
+  list: (path2) => existsSync4(path2) ? readdirSync(path2) : [],
   realpath: realpathSync,
   mkdir: (path2, mode) => mkdirSync4(path2, { recursive: true, mode }),
   remove: (path2) => rmSync4(path2, { force: true }),
@@ -1576,6 +1608,297 @@ async function activateSupervisedService(request, host = defaultHost) {
   return state;
 }
 
+// src/container-supervisor.ts
+import { createHash as createHash4 } from "node:crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname4, resolve as resolve4, sep as sep2 } from "node:path";
+var defaultHost2 = {
+  realpath: realpathSync2,
+  exists: existsSync5,
+  read: (path2) => readFileSync5(path2, "utf8"),
+  write(path2, content, mode) {
+    mkdirSync5(dirname4(path2), { recursive: true, mode: 493 });
+    const next = `${path2}.next`;
+    writeFileSync5(next, content, { mode });
+    renameSync5(next, path2);
+  },
+  remove: (path2) => rmSync5(path2, { force: true }),
+  list: (path2) => existsSync5(path2) ? readdirSync2(path2) : [],
+  mkdir: (path2, mode) => mkdirSync5(path2, { recursive: true, mode }),
+  async exec(argv2) {
+    const child = Bun.spawn([...argv2], { stdout: "pipe", stderr: "pipe", env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", LANG: "C", LC_ALL: "C" } });
+    const [stdout, stderr, exitCode] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+    return { exitCode, output: `${stdout}${stderr}` };
+  },
+  async health(port, path2, timeoutMs, method, expectedStatus) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}${path2}`, { method, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return expectedStatus.includes(response.status);
+    } catch {
+      return false;
+    }
+  },
+  sleep: (ms) => Bun.sleep(ms),
+  now: Date.now
+};
+var within2 = (root, path2) => path2 === root || path2.startsWith(`${root}${sep2}`);
+var idFor2 = (key) => createHash4("sha256").update(key).digest("hex").slice(0, 24);
+var statePath2 = (id) => `${SERVICE_STATE_DIRECTORY}/${id}.json`;
+var nameFor = (id, slot) => `forgezero-${id}-slot${slot}`;
+function validateRequest(request, host) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.:@/-]{0,255}$/.test(request.key) || !/^[a-f0-9]{40}$/.test(request.revision) || !/^[a-z][A-Za-z0-9-]{0,62}$/.test(request.component))
+    throw new Error("CONTAINER_IDENTITY_INVALID");
+  const root = host.realpath(resolve4(request.root));
+  const release = host.realpath(resolve4(request.release));
+  if (!within2(root, release))
+    throw new Error("CONTAINER_RELEASE_OUTSIDE_ROOT");
+  const application = request.application;
+  if (application.kind !== "application" || application.runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  if (!application.resources.cpu || !application.resources.memory || !application.resources.pids)
+    throw new Error("CONTAINER_LIMITS_REQUIRED");
+  if (application.runtime.security.privileged !== false || application.runtime.security.noNewPrivileges !== true || !application.runtime.security.dropCapabilities.includes("ALL"))
+    throw new Error("CONTAINER_SECURITY_INVALID");
+  if (!application.network?.container || !["bridge", "host"].includes(application.network.container.mode))
+    throw new Error("CONTAINER_NETWORK_INVALID");
+  if (!application.network.ingress?.stablePort)
+    throw new Error("CONTAINER_STABLE_PORT_REQUIRED");
+  return { ...request, root, release };
+}
+async function checked3(host, argv2, code) {
+  const result = await host.exec(argv2);
+  if (result.exitCode !== 0)
+    throw new Error(`${code}: ${result.output.slice(0, 512)}`);
+  return result.output.trim();
+}
+async function buildContainerImage(requestValue, host = defaultHost2) {
+  const request = validateRequest(requestValue, host);
+  const runtime = request.application.runtime;
+  if (runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  const source = runtime.image.source;
+  if (source.kind === "registry") {
+    if (!source.reference.includes("@sha256:"))
+      throw new Error("CONTAINER_IMAGE_DIGEST_REQUIRED");
+    await checked3(host, ["/usr/bin/docker", "pull", "--quiet", source.reference], "CONTAINER_PULL_FAILED");
+    const digest2 = await checked3(host, ["/usr/bin/docker", "image", "inspect", "--format={{.Id}}", source.reference], "CONTAINER_INSPECT_FAILED");
+    if (!/^sha256:[a-f0-9]{64}$/.test(digest2))
+      throw new Error("CONTAINER_DIGEST_INVALID");
+    return { image: source.reference, digest: digest2 };
+  }
+  const context = host.realpath(resolve4(request.release, source.context));
+  const dockerfile = host.realpath(resolve4(request.release, source.dockerfile));
+  if (!within2(request.release, context) || !within2(context, dockerfile))
+    throw new Error("CONTAINER_BUILD_PATH_INVALID");
+  const tag = `forgezero/${idFor2(request.key)}:${request.revision}`;
+  await checked3(host, [
+    "/usr/bin/docker",
+    "build",
+    "--pull",
+    ...request.noCache ? ["--no-cache"] : [],
+    "--file",
+    dockerfile,
+    "--tag",
+    tag,
+    "--label",
+    `net.forgezero.revision=${request.revision}`,
+    "--label",
+    `net.forgezero.component=${request.component}`,
+    context
+  ], "CONTAINER_BUILD_FAILED");
+  const digest = await checked3(host, ["/usr/bin/docker", "image", "inspect", "--format={{.Id}}", tag], "CONTAINER_INSPECT_FAILED");
+  if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+    throw new Error("CONTAINER_DIGEST_INVALID");
+  return { image: tag, digest };
+}
+function readState2(host, id) {
+  if (!host.exists(statePath2(id)))
+    return null;
+  try {
+    const value = JSON.parse(host.read(statePath2(id)));
+    return value.format === 1 ? value : null;
+  } catch {
+    return null;
+  }
+}
+function usedPorts(host, exceptId) {
+  const ports = new Set;
+  for (const name of host.list(SERVICE_STATE_DIRECTORY).filter((entry) => /^[a-f0-9]{24}\.json$/.test(entry))) {
+    try {
+      const state = JSON.parse(host.read(`${SERVICE_STATE_DIRECTORY}/${name}`));
+      if (state.id !== exceptId) {
+        ports.add(state.publicPort);
+        state.applicationPorts.forEach((port) => ports.add(port));
+      }
+    } catch {}
+  }
+  return ports;
+}
+function allocatePorts(host, id, count, stablePort, previous) {
+  const used = usedPorts(host, id);
+  if (used.has(stablePort))
+    throw new Error("CONTAINER_PUBLIC_PORT_CONFLICT");
+  if (previous?.applicationPorts.length === count && previous.applicationPorts.every((port) => !used.has(port)))
+    return [...previous.applicationPorts];
+  const from = 20000;
+  const to = 49999;
+  const width = to - from + 1;
+  const start = Number.parseInt(id.slice(0, 8), 16) % width;
+  for (let offset = 0;offset < width; offset += 1) {
+    const first = from + (start + offset) % width;
+    const values = Array.from({ length: count }, (_, index) => first + index);
+    if (values.at(-1) <= to && values.every((port) => port !== stablePort && !used.has(port)))
+      return values;
+  }
+  throw new Error("CONTAINER_PORTS_EXHAUSTED");
+}
+function nginx2(request, id, port) {
+  const service = request.application.service;
+  const stablePort = request.application.network.ingress.stablePort;
+  return `# ForgeZero container ${id}
+${service.maximumConnections ? `limit_conn_zone $server_name zone=fz_${id}:64k;
+` : ""}server {
+  listen 127.0.0.1:${stablePort};
+  server_name _;
+${service.maximumConnections ? `  limit_conn fz_${id} ${service.maximumConnections};
+  limit_conn_status 503;
+` : ""}  location / {
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+${service.websocket ? `    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+` : ""}    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+`;
+}
+function runArgv(request, id, slot, port, networkName) {
+  const { application } = request;
+  const resources = application.resources;
+  const runtime = application.runtime;
+  if (runtime.kind !== "container")
+    throw new Error("CONTAINER_RUNTIME_REQUIRED");
+  const memory = resources.memory;
+  const network = application.network.container;
+  const argv2 = [
+    "/usr/bin/docker",
+    "run",
+    "--detach",
+    "--name",
+    nameFor(id, slot),
+    "--restart",
+    "unless-stopped",
+    "--label",
+    `net.forgezero.key=${request.key}`,
+    "--label",
+    `net.forgezero.revision=${request.revision}`,
+    "--cpus",
+    String(resources.cpu.limit),
+    "--cpu-shares",
+    String(resources.cpu.weight ?? 100),
+    "--memory",
+    `${memory.limitMiB}m`,
+    ...memory.reservationMiB ? ["--memory-reservation", `${memory.reservationMiB}m`] : [],
+    ...memory.swap === "disabled" ? ["--memory-swap", `${memory.limitMiB}m`] : [],
+    "--pids-limit",
+    String(resources.pids.limit),
+    "--security-opt",
+    "no-new-privileges=true",
+    "--cap-drop",
+    "ALL",
+    ...runtime.security.root === "read-only" ? ["--read-only"] : [],
+    ...network.mode === "host" ? ["--network", "host", "--env", `FZ_APP_PORT=${port}`] : ["--network", networkName, "--publish", `127.0.0.1:${port}:${application.service.port}`]
+  ];
+  for (const mount of application.storage ?? []) {
+    if (mount.class === "ephemeral")
+      argv2.push("--tmpfs", `${mount.path}:rw,noexec,nosuid,size=${mount.sizeMiB}m`);
+    else
+      argv2.push("--volume", `forgezero-${id}-${mount.name}:${mount.path}`);
+  }
+  argv2.push(request.image, ...runtime.entrypoint ?? []);
+  return argv2;
+}
+async function activateContainer(requestValue, host = defaultHost2) {
+  const request = validateRequest(requestValue, host);
+  if (!/^sha256:[a-f0-9]{64}$/.test(request.image) && !/^forgezero\/[a-f0-9]{24}:[a-f0-9]{40}$/.test(request.image) && !request.image.includes("@sha256:"))
+    throw new Error("CONTAINER_IMAGE_INVALID");
+  const id = idFor2(request.key);
+  host.mkdir(SERVICE_STATE_DIRECTORY, 448);
+  host.mkdir(SERVICE_NGINX_DIRECTORY, 493);
+  const previous = readState2(host, id);
+  const slots = request.application.rollout.strategy === "blue-green" ? 2 : 1;
+  if (!["direct", "blue-green"].includes(request.application.rollout.strategy))
+    throw new Error("CONTAINER_ROLLOUT_REQUIRES_CONTROL_PLANE");
+  const containerNetwork = request.application.network.container;
+  let networkName = "host";
+  if (containerNetwork.mode === "bridge") {
+    networkName = containerNetwork.network ? `forgezero-${id}-${containerNetwork.network}` : "bridge";
+    if (networkName !== "bridge") {
+      const inspected = await host.exec(["/usr/bin/docker", "network", "inspect", '--format={{index .Labels "net.forgezero.owner"}}', networkName]);
+      if (inspected.exitCode !== 0) {
+        await checked3(host, ["/usr/bin/docker", "network", "create", "--driver", "bridge", "--label", `net.forgezero.owner=${id}`, networkName], "CONTAINER_NETWORK_CREATE_FAILED");
+      } else if (inspected.output.trim() !== id)
+        throw new Error("CONTAINER_NETWORK_OWNERSHIP_INVALID");
+    }
+  }
+  const ports = allocatePorts(host, id, slots, request.application.network.ingress.stablePort, previous);
+  const nextSlot = slots === 2 && previous?.activeSlot === 0 ? 1 : 0;
+  const port = ports[nextSlot];
+  const name = nameFor(id, nextSlot);
+  await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+  await checked3(host, runArgv(request, id, nextSlot, port, networkName), "CONTAINER_START_FAILED");
+  let healthy = false;
+  const health = request.application.service.health;
+  for (let attempt = 0;attempt < (health.attempts ?? 30); attempt += 1) {
+    if (await host.health(port, health.path, health.timeoutMs, health.method, health.expectedStatus)) {
+      healthy = true;
+      break;
+    }
+    await host.sleep(health.intervalMs ?? 1000);
+  }
+  if (!healthy) {
+    await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+    throw new Error("CONTAINER_HEALTH_FAILED");
+  }
+  const nginxPath = `${SERVICE_NGINX_DIRECTORY}/forgezero-${id}.conf`;
+  const previousNginx = host.exists(nginxPath) ? host.read(nginxPath) : null;
+  host.write(nginxPath, nginx2(request, id, port), 420);
+  try {
+    await checked3(host, ["/usr/sbin/nginx", "-t"], "CONTAINER_NGINX_INVALID");
+    await checked3(host, ["/usr/bin/systemctl", "reload", "nginx.service"], "CONTAINER_NGINX_RELOAD_FAILED");
+  } catch (cause) {
+    if (previousNginx === null)
+      host.remove(nginxPath);
+    else
+      host.write(nginxPath, previousNginx, 420);
+    await host.exec(["/usr/sbin/nginx", "-t"]);
+    await host.exec(["/usr/bin/systemctl", "reload", "nginx.service"]);
+    await host.exec(["/usr/bin/docker", "rm", "--force", name]);
+    throw cause;
+  }
+  const state = {
+    format: 1,
+    id,
+    key: request.key,
+    revision: request.revision,
+    strategy: request.application.rollout.strategy,
+    publicPort: request.application.network.ingress.stablePort,
+    applicationPorts: ports,
+    activeSlot: nextSlot,
+    healthPath: health.path,
+    updatedAtTs: host.now()
+  };
+  host.write(statePath2(id), `${JSON.stringify(state, null, 2)}
+`, 384);
+  if (previous && previous.activeSlot !== nextSlot) {
+    await host.sleep(request.application.rollout.drainMs ?? 30000);
+    await host.exec(["/usr/bin/docker", "rm", "--force", nameFor(id, previous.activeSlot)]);
+  }
+  return state;
+}
+
 // src/software-helper.ts
 var DEFAULT_SOFTWARE_HELPER_SOCKET = "/run/forgezero-software/helper.sock";
 var SOFTWARE_HELPER_GROUP = "forgezero-software";
@@ -1584,11 +1907,13 @@ var MAX_REQUEST_BYTES2 = 128 * 1024;
 var MAX_PENDING_REQUESTS = 128;
 function startSoftwareHelper(options = {}) {
   const socketPath = options.socketPath ?? DEFAULT_SOFTWARE_HELPER_SOCKET;
-  if (existsSync4(socketPath))
+  if (existsSync6(socketPath))
     unlinkSync3(socketPath);
-  mkdirSync5(dirname4(socketPath), { recursive: true, mode: 488 });
+  mkdirSync6(dirname5(socketPath), { recursive: true, mode: 488 });
   const ensure = options.ensure ?? ensureSoftwareRequirements;
   const activate = options.activate ?? activateSupervisedService;
+  const buildContainer = options.buildContainer ?? buildContainerImage;
+  const activateTypedContainer = options.activateContainer ?? activateContainer;
   let tail = Promise.resolve();
   let pending = 0;
   const server = createServer2((socket) => {
@@ -1621,10 +1946,29 @@ function startSoftwareHelper(options = {}) {
           return;
         }
         if (request.op === "activate-service" && request.request) {
-          if (!options.allowedRoot || request.request.root !== options.allowedRoot) {
+          const serviceRequest = request.request;
+          if (!options.allowedRoot || serviceRequest.root !== options.allowedRoot) {
             throw new Error("service deployment root is not owned by this helper");
           }
-          const state = await activate(request.request);
+          const state = await activate(serviceRequest);
+          socket.end(`${JSON.stringify({ ok: true, state })}
+`);
+          return;
+        }
+        if (request.op === "build-container" && request.request) {
+          const containerRequest = request.request;
+          if (!options.allowedRoot || containerRequest.root !== options.allowedRoot)
+            throw new Error("container deployment root is not owned by this helper");
+          const result = await buildContainer(containerRequest);
+          socket.end(`${JSON.stringify({ ok: true, result })}
+`);
+          return;
+        }
+        if (request.op === "activate-container" && request.request) {
+          const containerRequest = request.request;
+          if (!options.allowedRoot || containerRequest.root !== options.allowedRoot)
+            throw new Error("container deployment root is not owned by this helper");
+          const state = await activateTypedContainer(containerRequest);
           socket.end(`${JSON.stringify({ ok: true, state })}
 `);
           return;
@@ -1648,8 +1992,43 @@ function startSoftwareHelper(options = {}) {
   server.listen(socketPath, () => chmodSync4(socketPath, 432));
   return server;
 }
+function requestContainer(op, request, socketPath, timeoutMs) {
+  return new Promise((resolve5, reject) => {
+    const socket = connect2(socketPath, () => socket.write(`${JSON.stringify({ op, request })}
+`));
+    let buffer = "";
+    socket.setTimeout(timeoutMs, () => {
+      socket.destroy();
+      reject(new Error("container helper timed out"));
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newline = buffer.indexOf(`
+`);
+      if (newline < 0)
+        return;
+      socket.end();
+      try {
+        const response = JSON.parse(buffer.slice(0, newline));
+        const result = response.result ?? response.state;
+        if (!response.ok || !result)
+          throw new Error(response.error?.message ?? "container helper refused request");
+        resolve5(result);
+      } catch (cause) {
+        reject(cause);
+      }
+    });
+    socket.on("error", reject);
+  });
+}
+function requestContainerBuild(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 30 * 60000) {
+  return requestContainer("build-container", request, socketPath, timeoutMs);
+}
+function requestContainerActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
+  return requestContainer("activate-container", request, socketPath, timeoutMs);
+}
 function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 10 * 60000) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const socket = connect2(socketPath, () => socket.write(`${JSON.stringify({ op: "activate-service", request })}
 `));
     let buffer = "";
@@ -1668,7 +2047,7 @@ function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_
         const response = JSON.parse(buffer.slice(0, newline));
         if (!response.ok || !response.state)
           throw new Error(response.error?.message ?? "service helper refused activation");
-        resolve4(response.state);
+        resolve5(response.state);
       } catch (cause) {
         reject(cause);
       }
@@ -1678,7 +2057,7 @@ function requestServiceActivation(request, socketPath = DEFAULT_SOFTWARE_HELPER_
 }
 function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCKET, timeoutMs = 15 * 60000) {
   validateSoftwareRequirements(requirements);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const socket = connect2(socketPath, () => socket.write(`${JSON.stringify({ op: "ensure", requirements })}
 `));
     let buffer = "";
@@ -1697,7 +2076,7 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
         const response = JSON.parse(buffer.slice(0, newline));
         if (!response.ok || !response.results)
           throw new Error(response.error?.message ?? "software helper refused the request");
-        resolve4(response.results);
+        resolve5(response.results);
       } catch (cause) {
         reject(cause);
       }
@@ -1707,10 +2086,10 @@ function requestSoftware(requirements, socketPath = DEFAULT_SOFTWARE_HELPER_SOCK
 }
 
 // src/version.ts
-var VERSION3 = "0.1.53";
+var VERSION3 = "0.1.56";
 
 // src/egress-policy.ts
-import { realpathSync as realpathSync2 } from "node:fs";
+import { realpathSync as realpathSync3 } from "node:fs";
 var SYSTEMD_RESOLVED_ADDRESS = "127.0.0.53";
 var BLOCKED_IPV4 = [
   "0.0.0.0/8",
@@ -2686,17 +3065,17 @@ import {
   chmodSync as chmodSync5,
   chownSync,
   copyFileSync as copyFileSync2,
-  existsSync as existsSync5,
+  existsSync as existsSync7,
   lstatSync,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync5,
-  readdirSync as readdirSync2,
-  realpathSync as realpathSync3,
-  renameSync as renameSync5,
-  rmSync as rmSync5,
+  mkdirSync as mkdirSync7,
+  readFileSync as readFileSync6,
+  readdirSync as readdirSync3,
+  realpathSync as realpathSync4,
+  renameSync as renameSync6,
+  rmSync as rmSync6,
   statSync,
   symlinkSync as symlinkSync3,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "node:fs";
 import { join as join5 } from "node:path";
 var safeAtom = (name, value) => {
@@ -3058,13 +3437,13 @@ var platformExec = async (argv2) => {
 };
 var replaceLink = (path2, target) => {
   const pending = `${path2}.next`;
-  rmSync5(pending, { force: true });
+  rmSync6(pending, { force: true });
   if (!target) {
-    rmSync5(path2, { force: true });
+    rmSync6(path2, { force: true });
     return;
   }
   symlinkSync3(target, pending);
-  renameSync5(pending, path2);
+  renameSync6(pending, path2);
 };
 var secureRelease = (path2, uid, gid) => {
   const visit = (current) => {
@@ -3074,7 +3453,7 @@ var secureRelease = (path2, uid, gid) => {
     chownSync(current, uid, gid);
     chmodSync5(current, metadata.isDirectory() ? 365 : 292);
     if (metadata.isDirectory())
-      for (const name of readdirSync2(current))
+      for (const name of readdirSync3(current))
         visit(join5(current, name));
   };
   visit(path2);
@@ -3082,11 +3461,11 @@ var secureRelease = (path2, uid, gid) => {
 async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const rendered = renderPlatformActivationFiles(config);
   const normalized = JSON.parse(rendered.helper);
-  const releases = realpathSync3(join5(normalized.root, "releases"));
-  const release = realpathSync3(requestedRelease);
+  const releases = realpathSync4(join5(normalized.root, "releases"));
+  const release = realpathSync4(requestedRelease);
   if (!release.startsWith(`${releases}/`) || release === releases)
     throw new Error("release is outside configured releases directory");
-  for (const required of [".fz/deploy.json", "src/index.ts", "bun.lock"]) {
+  for (const required of ["forgezero.deploy.ts", ".fz/deploy.plan.json", "src/index.ts", "bun.lock"]) {
     const metadata = statSync(join5(release, required));
     if (!metadata.isFile() || metadata.size < 1)
       throw new Error(`release is incomplete: ${required}`);
@@ -3095,15 +3474,15 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   const request = options.fetch ?? fetch;
   const sleep = options.sleep ?? Bun.sleep;
   const slots = join5(normalized.root, "slots");
-  mkdirSync6(slots, { recursive: true, mode: 493 });
+  mkdirSync7(slots, { recursive: true, mode: 493 });
   const slotFile = join5(normalized.root, ".forge-slot");
-  const previousSlot = existsSync5(slotFile) ? readFileSync5(slotFile, "utf8").trim() : undefined;
+  const previousSlot = existsSync7(slotFile) ? readFileSync6(slotFile, "utf8").trim() : undefined;
   const target = previousSlot === "blue" ? "green" : "blue";
   const port = target === "blue" ? normalized.bluePort : normalized.greenPort;
   const targetLink = join5(slots, target);
   let previousTarget;
   try {
-    previousTarget = realpathSync3(targetLink);
+    previousTarget = realpathSync4(targetLink);
   } catch {}
   const user = await exec(["/usr/bin/id", "-u", normalized.serviceUser]);
   const group = await exec(["/usr/bin/id", "-g", normalized.serviceUser]);
@@ -3137,35 +3516,35 @@ async function activatePlatformRelease(config, requestedRelease, options = {}) {
   }
   const upstream = "/etc/nginx/conf.d/forgezero-upstream.conf";
   const backup = `${upstream}.forgezero-backup`;
-  if (existsSync5(upstream))
+  if (existsSync7(upstream))
     copyFileSync2(upstream, backup);
   else
-    rmSync5(backup, { force: true });
-  writeFileSync5(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
+    rmSync6(backup, { force: true });
+  writeFileSync6(upstream, `upstream forgezero { server 127.0.0.1:${port}; }
 `, { mode: 420 });
   const test = await exec(["/usr/sbin/nginx", "-t"]);
   const reload = test.exitCode === 0 ? await exec(["/usr/sbin/nginx", "-s", "reload"]) : test;
   if (reload.exitCode !== 0) {
-    if (existsSync5(backup))
-      renameSync5(backup, upstream);
+    if (existsSync7(backup))
+      renameSync6(backup, upstream);
     else
-      rmSync5(upstream, { force: true });
+      rmSync6(upstream, { force: true });
     await exec(["/usr/sbin/nginx", "-t"]);
     await exec(["/usr/sbin/nginx", "-s", "reload"]);
     await stopTarget();
     throw new Error("nginx refused the promoted upstream");
   }
-  rmSync5(backup, { force: true });
-  writeFileSync5(slotFile, `${target}
+  rmSync6(backup, { force: true });
+  writeFileSync6(slotFile, `${target}
 `, { mode: 420 });
   if (previousSlot && previousSlot !== target) {
     await sleep(normalized.drainDeadlineMs);
     await exec(["/usr/bin/systemctl", "stop", `forgezero@${previousSlot}.service`]);
   }
-  const old = readdirSync2(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join5(releases, entry.name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs).slice(normalized.keepReleases);
+  const old = readdirSync3(releases, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join5(releases, entry.name)).sort((left, right) => statSync(right).mtimeMs - statSync(left).mtimeMs).slice(normalized.keepReleases);
   for (const path2 of old)
     if (path2 !== release)
-      rmSync5(path2, { recursive: true, force: true });
+      rmSync6(path2, { recursive: true, force: true });
   return { release, slot: target };
 }
 function validateCollectorUnit(unit2) {
@@ -3209,18 +3588,18 @@ function planLocalOtlpProof(endpoint, collectorUnit) {
 import { lstatSync as lstatSync4 } from "node:fs";
 
 // src/bootstrap.ts
-import { createHash as createHash4, createHmac, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash5, createHmac, randomBytes as randomBytes3 } from "node:crypto";
 import {
   chmodSync as chmodSync7,
-  existsSync as existsSync7,
+  existsSync as existsSync9,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync7,
-  renameSync as renameSync7,
-  rmSync as rmSync7,
-  writeFileSync as writeFileSync7
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync8,
+  renameSync as renameSync8,
+  rmSync as rmSync8,
+  writeFileSync as writeFileSync8
 } from "node:fs";
-import { dirname as dirname7 } from "node:path";
+import { dirname as dirname8 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/cli/agent-install.ts
@@ -3228,17 +3607,17 @@ import { randomBytes } from "node:crypto";
 import {
   chmodSync as chmodSync6,
   copyFileSync as copyFileSync3,
-  existsSync as existsSync6,
+  existsSync as existsSync8,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync6,
-  realpathSync as realpathSync4,
-  renameSync as renameSync6,
-  rmSync as rmSync6,
+  mkdirSync as mkdirSync8,
+  readFileSync as readFileSync7,
+  realpathSync as realpathSync5,
+  renameSync as renameSync7,
+  rmSync as rmSync7,
   symlinkSync as symlinkSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { dirname as dirname6 } from "node:path";
 async function readCapabilities(run2) {
   const answers = {};
   const checks = Object.entries(CAPABILITY_CHECKS);
@@ -3297,28 +3676,28 @@ var runProvisionOperation = async (operation) => {
   }
   if (operation.kind === "install-runtime") {
     const release = `/opt/forgezero/agent/versions/${operation.version}`;
-    mkdirSync7(`${release}/dist`, { recursive: true, mode: 493 });
-    mkdirSync7(dirname5(operation.binary), { recursive: true, mode: 493 });
+    mkdirSync8(`${release}/dist`, { recursive: true, mode: 493 });
+    mkdirSync8(dirname6(operation.binary), { recursive: true, mode: 493 });
     copyFileSync3(operation.source, `${release}/dist/fz-agent.js`);
     chmodSync6(`${release}/dist/fz-agent.js`, 493);
-    const gitSshSource = `${dirname5(operation.source)}/fz-git-ssh.js`;
-    if (!existsSync6(gitSshSource))
+    const gitSshSource = `${dirname6(operation.source)}/fz-git-ssh.js`;
+    if (!existsSync8(gitSshSource))
       return { stdout: "packaged fz-git-ssh.js is missing", exitCode: 1 };
     copyFileSync3(gitSshSource, `${release}/dist/fz-git-ssh.js`);
     chmodSync6(`${release}/dist/fz-git-ssh.js`, 493);
     const pending = "/opt/forgezero/agent/current.next";
-    rmSync6(pending, { force: true });
+    rmSync7(pending, { force: true });
     symlinkSync4(`versions/${operation.version}`, pending);
-    renameSync6(pending, "/opt/forgezero/agent/current");
-    rmSync6(operation.binary, { force: true });
+    renameSync7(pending, "/opt/forgezero/agent/current");
+    rmSync7(operation.binary, { force: true });
     symlinkSync4("/opt/forgezero/agent/current/dist/fz-agent.js", operation.binary);
     const gitSshBinary = "/usr/local/lib/forgezero/agent/fz-git-ssh";
-    rmSync6(gitSshBinary, { force: true });
+    rmSync7(gitSshBinary, { force: true });
     symlinkSync4("/opt/forgezero/agent/current/dist/fz-git-ssh.js", gitSshBinary);
     return { stdout: "", exitCode: 0 };
   }
   if (operation.kind === "ensure-seed") {
-    if (existsSync6(operation.credential) && lstatSync2(operation.credential).size > 0)
+    if (existsSync8(operation.credential) && lstatSync2(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
     const seed = randomBytes(32).toString("base64url");
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=agent-seed", "-", operation.credential], seed);
@@ -3330,9 +3709,9 @@ var runProvisionOperation = async (operation) => {
     const key = "/run/forgezero-git-deploy-key";
     const publicKey = `${key}.pub`;
     try {
-      if (!existsSync6(operation.credential) || lstatSync2(operation.credential).size < 1) {
-        rmSync6(key, { force: true });
-        rmSync6(publicKey, { force: true });
+      if (!existsSync8(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync7(key, { force: true });
+        rmSync7(publicKey, { force: true });
         let result = await fixed(["/usr/bin/ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", "forgezero-compute", "-f", key]);
         if (result.exitCode !== 0)
           return result;
@@ -3341,8 +3720,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync6(operation.credential, 256);
       }
-      if (!existsSync6(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
-        if (!existsSync6(key)) {
+      if (!existsSync8(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync8(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=git-deploy-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -3350,25 +3729,25 @@ var runProvisionOperation = async (operation) => {
         const derived = await fixed(["/usr/bin/ssh-keygen", "-y", "-f", key]);
         if (derived.exitCode !== 0)
           return derived;
-        writeFileSync6(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
+        writeFileSync7(operation.publicKey, `${derived.stdout.trim()} forgezero-compute
 `, { mode: 292 });
       }
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync6(key, { force: true });
-      rmSync6(publicKey, { force: true });
+      rmSync7(key, { force: true });
+      rmSync7(publicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-bootstrap-ssh-identity") {
     const key = "/run/forgezero-bootstrap-ssh-key";
     const generatedPublicKey = `${key}.pub`;
     try {
-      if (!existsSync6(operation.credential) || lstatSync2(operation.credential).size < 1) {
-        rmSync6(key, { force: true });
-        rmSync6(generatedPublicKey, { force: true });
+      if (!existsSync8(operation.credential) || lstatSync2(operation.credential).size < 1) {
+        rmSync7(key, { force: true });
+        rmSync7(generatedPublicKey, { force: true });
         let result;
         if (operation.source) {
-          const source = existsSync6(operation.source) ? lstatSync2(operation.source) : undefined;
+          const source = existsSync8(operation.source) ? lstatSync2(operation.source) : undefined;
           if (!source?.isFile() || source.isSymbolicLink() || source.uid !== 0 || source.nlink !== 1 || (source.mode & 63) !== 0 || source.size < 32 || source.size > 16 * 1024) {
             return { stdout: "bootstrap SSH private-key source is missing or unsafe", exitCode: 1 };
           }
@@ -3388,8 +3767,8 @@ var runProvisionOperation = async (operation) => {
           return result;
         chmodSync6(operation.credential, 256);
       }
-      if (!existsSync6(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
-        if (!existsSync6(key)) {
+      if (!existsSync8(operation.publicKey) || lstatSync2(operation.publicKey).size < 1) {
+        if (!existsSync8(key)) {
           const decrypted = await fixed(["/usr/bin/systemd-creds", "decrypt", "--name=bootstrap-ssh-key", operation.credential, key]);
           if (decrypted.exitCode !== 0)
             return decrypted;
@@ -3399,28 +3778,28 @@ var runProvisionOperation = async (operation) => {
         if (derived.exitCode !== 0 || !/^ssh-ed25519 [A-Za-z0-9+/]+={0,3}\s*$/.test(derived.stdout)) {
           return { stdout: "bootstrap SSH public key derivation failed", exitCode: 1 };
         }
-        mkdirSync7(dirname5(operation.publicKey), { recursive: true, mode: 493 });
-        writeFileSync6(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
+        mkdirSync8(dirname6(operation.publicKey), { recursive: true, mode: 493 });
+        writeFileSync7(operation.publicKey, `${derived.stdout.trim()} forgezero-bootstrap-runner
 `, { mode: 292 });
         chmodSync6(operation.publicKey, 292);
       }
       if (operation.source)
-        rmSync6(operation.source, { force: true });
+        rmSync7(operation.source, { force: true });
       return { stdout: "", exitCode: 0 };
     } finally {
-      rmSync6(key, { force: true });
-      rmSync6(generatedPublicKey, { force: true });
+      rmSync7(key, { force: true });
+      rmSync7(generatedPublicKey, { force: true });
     }
   }
   if (operation.kind === "ensure-enrolment") {
-    if (existsSync6(operation.state) && lstatSync2(operation.state).size > 0 || existsSync6(operation.credential) && lstatSync2(operation.credential).size > 0)
+    if (existsSync8(operation.state) && lstatSync2(operation.state).size > 0 || existsSync8(operation.credential) && lstatSync2(operation.credential).size > 0)
       return { stdout: "", exitCode: 0 };
-    if (!existsSync6(operation.source))
+    if (!existsSync8(operation.source))
       return { stdout: "enrolment source is missing", exitCode: 1 };
     const result = await fixed(["/usr/bin/systemd-creds", "encrypt", "--name=enrol-token", operation.source, operation.credential]);
     if (result.exitCode === 0) {
       chmodSync6(operation.credential, 256);
-      rmSync6(operation.source, { force: true });
+      rmSync7(operation.source, { force: true });
     }
     return result;
   }
@@ -3435,7 +3814,7 @@ var runProvisionOperation = async (operation) => {
     return { stdout: `socket did not become ready: ${operation.path}`, exitCode: 1 };
   }
   if (operation.kind === "verify-file")
-    return existsSync6(operation.path) && lstatSync2(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
+    return existsSync8(operation.path) && lstatSync2(operation.path).size > 0 ? { stdout: "", exitCode: 0 } : { stdout: "required file is empty", exitCode: 1 };
   if (operation.kind === "verify-egress") {
     const active = await fixed(["/usr/bin/systemctl", "is-active", "forgezero-agent-egress.service"]);
     if (active.exitCode !== 0)
@@ -3451,31 +3830,31 @@ var runProvisionOperation = async (operation) => {
   if (operation.kind === "verify-resolved-stub") {
     try {
       const expected = "/run/systemd/resolve/stub-resolv.conf";
-      return realpathSync4("/etc/resolv.conf") === expected && realpathSync4(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
+      return realpathSync5("/etc/resolv.conf") === expected && realpathSync5(expected) === expected ? { stdout: expected, exitCode: 0 } : { stdout: "resolver stub mismatch", exitCode: 1 };
     } catch {
       return { stdout: "resolver stub missing", exitCode: 1 };
     }
   }
   if (operation.kind === "install-warp") {
-    const os = readFileSync6("/etc/os-release", "utf8");
+    const os = readFileSync7("/etc/os-release", "utf8");
     if (!/^ID=ubuntu$/m.test(os) || !/^VERSION_ID="?26\.04"?$/m.test(os))
       return { stdout: "unsupported WARP host OS", exitCode: 1 };
     const response = await fetch("https://pkg.cloudflareclient.com/pubkey.gpg", { signal: AbortSignal.timeout(30000) });
     if (!response.ok)
       return { stdout: `WARP key HTTP ${response.status}`, exitCode: 1 };
-    mkdirSync7("/usr/share/keyrings", { recursive: true, mode: 493 });
-    mkdirSync7("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
-    mkdirSync7("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
+    mkdirSync8("/usr/share/keyrings", { recursive: true, mode: 493 });
+    mkdirSync8("/etc/apt/sources.list.d", { recursive: true, mode: 493 });
+    mkdirSync8("/etc/systemd/system/warp-svc.service.d", { recursive: true, mode: 493 });
     const key = "/run/cloudflare-warp-key.gpg";
-    writeFileSync6(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
+    writeFileSync7(key, new Uint8Array(await response.arrayBuffer()), { mode: 384 });
     let result = await fixed(["/usr/bin/gpg", "--batch", "--yes", "--dearmor", "-o", "/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg", key]);
-    rmSync6(key, { force: true });
+    rmSync7(key, { force: true });
     if (result.exitCode !== 0)
       return result;
     const codename = os.match(/^VERSION_CODENAME=(.+)$/m)?.[1]?.replace(/^"|"$/g, "");
     if (!codename)
       return { stdout: "Ubuntu codename missing", exitCode: 1 };
-    writeFileSync6("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
+    writeFileSync7("/etc/apt/sources.list.d/cloudflare-client.list", `deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ ${codename} main
 `, { mode: 420 });
     result = await fixed(["/usr/bin/apt-get", "update", "-qq"]);
     return result.exitCode === 0 ? fixed(["/usr/bin/apt-get", "install", "-y", "cloudflare-warp"]) : result;
@@ -3520,7 +3899,7 @@ async function applyPlan(plan, run2) {
 import { constants } from "node:fs";
 import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
 import { chmod, lstat, mkdir, open, readdir, rename, rmdir, stat, unlink } from "node:fs/promises";
-import { dirname as dirname6, join as join6, resolve as resolve4 } from "node:path";
+import { dirname as dirname7, join as join6, resolve as resolve5 } from "node:path";
 import { isIP as isIP3 } from "node:net";
 
 // src/cloudflare-edge.ts
@@ -3692,9 +4071,9 @@ async function bootstrapStatus(host = localBootstrapHost()) {
       if (health.exitCode !== 0)
         problems.push("platform API health check failed");
     }
-    const nginx2 = await host.exec(["nginx", "-t"]);
-    services["nginx-config"] = nginx2.exitCode === 0;
-    if (nginx2.exitCode !== 0)
+    const nginx3 = await host.exec(["nginx", "-t"]);
+    services["nginx-config"] = nginx3.exitCode === 0;
+    if (nginx3.exitCode !== 0)
       problems.push("nginx configuration is invalid");
     if (state.databaseRole !== "none") {
       const unitPath = "/etc/systemd/system/forgezero-db.service";
@@ -3739,17 +4118,17 @@ function localBootstrapHost() {
   };
   return {
     uid: () => process.getuid?.() ?? -1,
-    exists: existsSync7,
-    read: (path2) => readFileSync7(path2, "utf8"),
+    exists: existsSync9,
+    read: (path2) => readFileSync8(path2, "utf8"),
     write(path2, content, mode) {
-      mkdirSync8(dirname7(path2), { recursive: true, mode: 493 });
+      mkdirSync9(dirname8(path2), { recursive: true, mode: 493 });
       const temporary = `${path2}.next.${process.pid}`;
-      writeFileSync7(temporary, content, { mode });
+      writeFileSync8(temporary, content, { mode });
       chmodSync7(temporary, mode);
-      renameSync7(temporary, path2);
+      renameSync8(temporary, path2);
     },
-    mkdir: (path2, mode) => mkdirSync8(path2, { recursive: true, mode }),
-    remove: (path2) => rmSync7(path2, { force: true }),
+    mkdir: (path2, mode) => mkdirSync9(path2, { recursive: true, mode }),
+    remove: (path2) => rmSync8(path2, { force: true }),
     inspect(path2) {
       const value = lstatSync3(path2);
       return { regular: value.isFile(), symbolic: value.isSymbolicLink(), uid: value.uid, mode: value.mode, links: value.nlink, size: value.size };
@@ -3773,7 +4152,7 @@ function localBootstrapHost() {
     async installAgent(config, enrolTokenSourcePath) {
       const capabilities = await readCapabilities(localRunner);
       const deployRoot = config.deployRoot ?? "/opt/forgezero";
-      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync7("/var/lib/forgezero/enrolment.json");
+      const hasBinding = config.kind === "enrolled-compute" || Boolean(enrolTokenSourcePath) || existsSync9("/var/lib/forgezero/enrolment.json");
       if (config.kind === "platform") {
         const lifecycle = config.database.role === "none" ? {
           apiUnits: ["forgezero@blue.service", "forgezero@green.service"],
@@ -3785,8 +4164,8 @@ function localBootstrapHost() {
           databaseHealthUrl: `http://${config.database.address}:8529/_api/version`,
           databasePorts: [8529]
         };
-        mkdirSync8(dirname7(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
-        writeFileSync7(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
+        mkdirSync9(dirname8(LIFECYCLE_PROFILE), { recursive: true, mode: 493 });
+        writeFileSync8(LIFECYCLE_PROFILE, `${JSON.stringify(lifecycle, null, 2)}
 `, { mode: 256 });
       }
       const plan = planInstall({
@@ -3827,8 +4206,8 @@ function localBootstrapHost() {
         } : {}
       });
       for (const unit2 of [{ path: plan.unitPath, unit: plan.unit }, ...plan.auxiliaryUnits]) {
-        mkdirSync8(dirname7(unit2.path), { recursive: true, mode: 493 });
-        writeFileSync7(unit2.path, unit2.unit, { mode: 420 });
+        mkdirSync9(dirname8(unit2.path), { recursive: true, mode: 493 });
+        writeFileSync8(unit2.path, unit2.unit, { mode: 420 });
       }
       await applyPlan(plan, localRunner);
       return plan;