@agent-vm/agent-vm 0.0.20

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Shravan Sunder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/backup/backup-archive-layout.d.ts

@@ -0,0 +1,15 @@
+import type { BackupResult } from './backup-manager.js';
+export declare const BACKUP_FILENAME_DELIMITER = "__";
+export declare function buildBackupPaths(options: {
+    readonly backupDir: string;
+    readonly timestamp: string;
+    readonly zoneId: string;
+}): {
+    readonly encryptedPath: string;
+    readonly tarPath: string;
+};
+export declare function listBackupArtifacts(options: {
+    readonly backupDir: string;
+    readonly zoneId?: string;
+}): BackupResult[];
+//# sourceMappingURL=backup-archive-layout.d.ts.map

package/dist/backup/backup-archive-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-archive-layout.d.ts","sourceRoot":"","sources":["../../src/backup/backup-archive-layout.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,GAAG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAOA;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,YAAY,EAAE,CA0BjB"}

package/dist/backup/backup-archive-layout.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const BACKUP_FILENAME_DELIMITER = '__';
+export function buildBackupPaths(options) {
+    const tarName = `${options.zoneId}${BACKUP_FILENAME_DELIMITER}${options.timestamp}.tar`;
+    const tarPath = path.join(options.backupDir, tarName);
+    return {
+        encryptedPath: `${tarPath}.age`,
+        tarPath,
+    };
+}
+export function listBackupArtifacts(options) {
+    if (!fs.existsSync(options.backupDir)) {
+        return [];
+    }
+    const backupFiles = fs
+        .readdirSync(options.backupDir)
+        .filter((fileName) => fileName.endsWith('.tar.age'));
+    const filteredFiles = options.zoneId
+        ? backupFiles.filter((fileName) => fileName.startsWith(`${options.zoneId}${BACKUP_FILENAME_DELIMITER}`))
+        : backupFiles;
+    return filteredFiles.map((fileName) => {
+        const fileStem = fileName.replace('.tar.age', '');
+        const delimiterIndex = fileStem.indexOf(BACKUP_FILENAME_DELIMITER);
+        return {
+            backupPath: path.join(options.backupDir, fileName),
+            timestamp: delimiterIndex >= 0
+                ? fileStem.slice(delimiterIndex + BACKUP_FILENAME_DELIMITER.length)
+                : '',
+            zoneId: delimiterIndex >= 0 ? fileStem.slice(0, delimiterIndex) : fileStem,
+        };
+    });
+}
+//# sourceMappingURL=backup-archive-layout.js.map

package/dist/backup/backup-archive-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-archive-layout.js","sourceRoot":"","sources":["../../src/backup/backup-archive-layout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,gBAAgB,CAAC,OAIhC;IAIA,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,yBAAyB,GAAG,OAAO,CAAC,SAAS,MAAM,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO;QACN,aAAa,EAAE,GAAG,OAAO,MAAM;QAC/B,OAAO;KACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAGnC;IACA,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,EAAE;SACpB,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM;QACnC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChC,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC,CACpE;QACF,CAAC,CAAC,WAAW,CAAC;IAEf,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnE,OAAO;YACN,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;YAClD,SAAS,EACR,cAAc,IAAI,CAAC;gBAClB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,yBAAyB,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,EAAE;YACN,MAAM,EAAE,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC1E,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/backup/backup-create-operation.d.ts

@@ -0,0 +1,9 @@
+import type { BackupEncryption, BackupResult } from './backup-manager.js';
+export declare function createEncryptedBackup(options: {
+    readonly backupDir: string;
+    readonly encryption: BackupEncryption;
+    readonly stateDir: string;
+    readonly workspaceDir: string;
+    readonly zoneId: string;
+}): Promise<BackupResult>;
+//# sourceMappingURL=backup-create-operation.d.ts.map

package/dist/backup/backup-create-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-create-operation.d.ts","sourceRoot":"","sources":["../../src/backup/backup-create-operation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI1E,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiDxB"}

package/dist/backup/backup-create-operation.js

@@ -0,0 +1,50 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { buildBackupPaths } from './backup-archive-layout.js';
+const execFileAsync = promisify(execFile);
+export async function createEncryptedBackup(options) {
+    const timestamp = new Date().toISOString().replace(/[:.]/gu, '-');
+    const backupPaths = buildBackupPaths({
+        backupDir: options.backupDir,
+        timestamp,
+        zoneId: options.zoneId,
+    });
+    await fs.mkdir(options.backupDir, { recursive: true });
+    const stagingDirectory = await fs.mkdtemp(path.join(os.tmpdir(), 'backup-stage-'));
+    try {
+        await execFileAsync('cp', ['-a', options.stateDir, path.join(stagingDirectory, 'state')]);
+        await execFileAsync('cp', [
+            '-a',
+            options.workspaceDir,
+            path.join(stagingDirectory, 'workspace'),
+        ]);
+        await fs.writeFile(path.join(stagingDirectory, 'manifest.json'), JSON.stringify({
+            createdAt: new Date().toISOString(),
+            timestamp,
+            zoneId: options.zoneId,
+        }));
+        await execFileAsync('tar', [
+            'cf',
+            backupPaths.tarPath,
+            '-C',
+            stagingDirectory,
+            'state',
+            'workspace',
+            'manifest.json',
+        ]);
+    }
+    finally {
+        await fs.rm(stagingDirectory, { recursive: true, force: true });
+    }
+    await options.encryption.encrypt(backupPaths.tarPath, backupPaths.encryptedPath);
+    await fs.unlink(backupPaths.tarPath);
+    return {
+        backupPath: backupPaths.encryptedPath,
+        timestamp,
+        zoneId: options.zoneId,
+    };
+}
+//# sourceMappingURL=backup-create-operation.js.map

package/dist/backup/backup-create-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-create-operation.js","sourceRoot":"","sources":["../../src/backup/backup-create-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAM3C;IACA,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvD,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC;QACJ,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,aAAa,CAAC,IAAI,EAAE;YACzB,IAAI;YACJ,OAAO,CAAC,YAAY;YACpB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,SAAS,CACjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CACF,CAAC;QAEF,MAAM,aAAa,CAAC,KAAK,EAAE;YAC1B,IAAI;YACJ,WAAW,CAAC,OAAO;YACnB,IAAI;YACJ,gBAAgB;YAChB,OAAO;YACP,WAAW;YACX,eAAe;SACf,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO;QACN,UAAU,EAAE,WAAW,CAAC,aAAa;QACrC,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC;AACH,CAAC"}

package/dist/backup/backup-encryption.d.ts

@@ -0,0 +1,20 @@
+import type { BackupEncryption } from './backup-manager.js';
+interface AgeEncryptionDependencies {
+    /** Resolves the age identity (secret key) string from 1Password.
+     *  Format: AGE-SECRET-KEY-1... (the full key line from age-keygen).
+     *  Store this in 1Password as a "password" field. Generate with: age-keygen */
+    readonly resolveIdentity: () => Promise<string>;
+}
+/**
+ * Age identity-key-based encryption for zone backups.
+ *
+ * Uses age public-key encryption: the identity key (AGE-SECRET-KEY-1...)
+ * is stored in 1Password per zone. The public key (recipient) is derived
+ * at encryption time via age-keygen -y.
+ *
+ * Secret keys are written only to a short-lived 0600 temp file for tool
+ * compatibility, then deleted immediately after each operation.
+ */
+export declare function createAgeBackupEncryption(dependencies: AgeEncryptionDependencies): BackupEncryption;
+export {};
+//# sourceMappingURL=backup-encryption.d.ts.map

package/dist/backup/backup-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-encryption.d.ts","sourceRoot":"","sources":["../../src/backup/backup-encryption.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,UAAU,yBAAyB;IAClC;;mFAE+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAqED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACxC,YAAY,EAAE,yBAAyB,GACrC,gBAAgB,CA8BlB"}

package/dist/backup/backup-encryption.js

@@ -0,0 +1,93 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+/**
+ * Run a command with optional stdin input. Returns stdout as a string.
+ * Rejects if the process exits non-zero.
+ */
+function runWithStdin(command, args, stdinInput) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], { stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (data) => {
+            stdout += data.toString('utf8');
+        });
+        child.stderr.on('data', (data) => {
+            stderr += data.toString('utf8');
+        });
+        child.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`${command} failed (exit ${code}): ${stderr.trim()}`));
+                return;
+            }
+            resolve(stdout);
+        });
+        if (stdinInput !== undefined) {
+            child.stdin.write(stdinInput);
+            child.stdin.end();
+        }
+        else {
+            child.stdin.end();
+        }
+    });
+}
+async function withTemporaryIdentityFile(identityLine, runWithIdentityFile) {
+    const temporaryIdentityPath = path.join(os.tmpdir(), `agent-vm-age-identity-${process.pid}-${Date.now()}.txt`);
+    await fs.writeFile(temporaryIdentityPath, `${identityLine}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    try {
+        return await runWithIdentityFile(temporaryIdentityPath);
+    }
+    finally {
+        await fs.rm(temporaryIdentityPath, { force: true });
+    }
+}
+/**
+ * Derive the public key (recipient) from an age identity key via a short-lived
+ * 0600 temp file. `/dev/stdin` is not portable enough across CI runners.
+ */
+async function deriveRecipientFromIdentity(identityLine) {
+    return await withTemporaryIdentityFile(identityLine, async (identityFilePath) => (await runWithStdin('age-keygen', ['-y', identityFilePath])).trim());
+}
+/**
+ * Age identity-key-based encryption for zone backups.
+ *
+ * Uses age public-key encryption: the identity key (AGE-SECRET-KEY-1...)
+ * is stored in 1Password per zone. The public key (recipient) is derived
+ * at encryption time via age-keygen -y.
+ *
+ * Secret keys are written only to a short-lived 0600 temp file for tool
+ * compatibility, then deleted immediately after each operation.
+ */
+export function createAgeBackupEncryption(dependencies) {
+    return {
+        encrypt: async (inputPath, outputPath) => {
+            const identity = await dependencies.resolveIdentity();
+            const recipient = await deriveRecipientFromIdentity(identity);
+            await runWithStdin('age', [
+                '--encrypt',
+                '--recipient',
+                recipient,
+                '--output',
+                outputPath,
+                inputPath,
+            ]);
+        },
+        decrypt: async (inputPath, outputPath) => {
+            const identity = await dependencies.resolveIdentity();
+            await withTemporaryIdentityFile(identity, async (identityFilePath) => await runWithStdin('age', [
+                '--decrypt',
+                '--identity',
+                identityFilePath,
+                '--output',
+                outputPath,
+                inputPath,
+            ]));
+        },
+    };
+}
+//# sourceMappingURL=backup-encryption.js.map

package/dist/backup/backup-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-encryption.js","sourceRoot":"","sources":["../../src/backup/backup-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B;;;GAGG;AACH,SAAS,YAAY,CACpB,OAAe,EACf,IAAuB,EACvB,UAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,iBAAiB,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxE,OAAO;YACR,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACvC,YAAoB,EACpB,mBAAmE;IAEnE,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CACtC,EAAE,CAAC,MAAM,EAAE,EACX,yBAAyB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CACxD,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,qBAAqB,EAAE,GAAG,YAAY,IAAI,EAAE;QAC9D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACX,CAAC,CAAC;IACH,IAAI,CAAC;QACJ,OAAO,MAAM,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACzD,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IAC9D,OAAO,MAAM,yBAAyB,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAC/E,CAAC,MAAM,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CACnE,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACxC,YAAuC;IAEvC,OAAO;QACN,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,YAAY,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,aAAa;gBACb,SAAS;gBACT,UAAU;gBACV,UAAU;gBACV,SAAS;aACT,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,yBAAyB,CAC9B,QAAQ,EACR,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAC1B,MAAM,YAAY,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,YAAY;gBACZ,gBAAgB;gBAChB,UAAU;gBACV,UAAU;gBACV,SAAS;aACT,CAAC,CACH,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/backup/backup-manager.d.ts

@@ -0,0 +1,42 @@
+export interface BackupEncryption {
+    readonly encrypt: (inputPath: string, outputPath: string) => Promise<void>;
+    readonly decrypt: (inputPath: string, outputPath: string) => Promise<void>;
+}
+export interface BackupResult {
+    readonly backupPath: string;
+    readonly timestamp: string;
+    readonly zoneId: string;
+}
+export interface BackupRestoreResult {
+    readonly stateDir: string;
+    readonly workspaceDir: string;
+    readonly zoneId: string;
+}
+export interface ZoneBackupManager {
+    createBackup(options: {
+        readonly zoneId: string;
+        readonly stateDir: string;
+        readonly workspaceDir: string;
+        readonly backupDir: string;
+    }): Promise<BackupResult>;
+    restoreBackup(options: {
+        readonly backupPath: string;
+        readonly stateDir: string;
+        readonly workspaceDir: string;
+    }): Promise<BackupRestoreResult>;
+    listBackups(options: {
+        readonly backupDir: string;
+        readonly zoneId?: string;
+    }): BackupResult[];
+}
+/**
+ * Archive layout inside the tar:
+ *   state/      — contents of stateDir
+ *   workspace/  — contents of workspaceDir
+ *   manifest.json
+ *
+ * This fixed layout decouples archive structure from host paths, so stateDir
+ * and workspaceDir can live under completely different parents on restore.
+ */
+export declare function createZoneBackupManager(encryption: BackupEncryption): ZoneBackupManager;
+//# sourceMappingURL=backup-manager.d.ts.map

package/dist/backup/backup-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-manager.d.ts","sourceRoot":"","sources":["../../src/backup/backup-manager.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IACjC,YAAY,CAAC,OAAO,EAAE;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1B,aAAa,CAAC,OAAO,EAAE;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEjC,WAAW,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,EAAE,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,gBAAgB,GAAG,iBAAiB,CAuBvF"}

package/dist/backup/backup-manager.js

@@ -0,0 +1,37 @@
+import { listBackupArtifacts } from './backup-archive-layout.js';
+import { createEncryptedBackup } from './backup-create-operation.js';
+import { restoreEncryptedBackup } from './backup-restore-operation.js';
+/**
+ * Archive layout inside the tar:
+ *   state/      — contents of stateDir
+ *   workspace/  — contents of workspaceDir
+ *   manifest.json
+ *
+ * This fixed layout decouples archive structure from host paths, so stateDir
+ * and workspaceDir can live under completely different parents on restore.
+ */
+export function createZoneBackupManager(encryption) {
+    return {
+        async createBackup(options) {
+            return await createEncryptedBackup({
+                encryption,
+                backupDir: options.backupDir,
+                stateDir: options.stateDir,
+                workspaceDir: options.workspaceDir,
+                zoneId: options.zoneId,
+            });
+        },
+        async restoreBackup(options) {
+            return await restoreEncryptedBackup({
+                encryption,
+                backupPath: options.backupPath,
+                stateDir: options.stateDir,
+                workspaceDir: options.workspaceDir,
+            });
+        },
+        listBackups(options) {
+            return listBackupArtifacts(options);
+        },
+    };
+}
+//# sourceMappingURL=backup-manager.js.map

package/dist/backup/backup-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-manager.js","sourceRoot":"","sources":["../../src/backup/backup-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAoCvE;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAA4B;IACnE,OAAO;QACN,KAAK,CAAC,YAAY,CAAC,OAAO;YACzB,OAAO,MAAM,qBAAqB,CAAC;gBAClC,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO;YAC1B,OAAO,MAAM,sBAAsB,CAAC;gBACnC,UAAU;gBACV,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;aAClC,CAAC,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,OAAO;YAClB,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/backup/backup-restore-operation.d.ts

@@ -0,0 +1,8 @@
+import type { BackupEncryption, BackupRestoreResult } from './backup-manager.js';
+export declare function restoreEncryptedBackup(options: {
+    readonly backupPath: string;
+    readonly encryption: BackupEncryption;
+    readonly stateDir: string;
+    readonly workspaceDir: string;
+}): Promise<BackupRestoreResult>;
+//# sourceMappingURL=backup-restore-operation.d.ts.map

package/dist/backup/backup-restore-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore-operation.d.ts","sourceRoot":"","sources":["../../src/backup/backup-restore-operation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAqCjF,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsB/B"}

package/dist/backup/backup-restore-operation.js

@@ -0,0 +1,53 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+async function copyExtractedDirectoryContents(sourceDirectory, targetDirectory) {
+    try {
+        await fs.access(sourceDirectory);
+    }
+    catch {
+        return;
+    }
+    const entries = await fs.readdir(sourceDirectory);
+    await Promise.all(entries.map(async (entryName) => {
+        await execFileAsync('cp', [
+            '-a',
+            path.join(sourceDirectory, entryName),
+            path.join(targetDirectory, entryName),
+        ]);
+    }));
+}
+async function readZoneIdFromManifest(extractDirectory) {
+    const manifestPath = path.join(extractDirectory, 'manifest.json');
+    try {
+        const rawManifest = await fs.readFile(manifestPath, 'utf8');
+        const manifest = JSON.parse(rawManifest);
+        return manifest.zoneId ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+export async function restoreEncryptedBackup(options) {
+    const decryptedTarPath = `${options.backupPath}.decrypted.tar`;
+    await options.encryption.decrypt(options.backupPath, decryptedTarPath);
+    const extractDirectory = await fs.mkdtemp(path.join(os.tmpdir(), 'backup-extract-'));
+    try {
+        await execFileAsync('tar', ['xf', decryptedTarPath, '-C', extractDirectory]);
+        await copyExtractedDirectoryContents(path.join(extractDirectory, 'state'), options.stateDir);
+        await copyExtractedDirectoryContents(path.join(extractDirectory, 'workspace'), options.workspaceDir);
+        return {
+            stateDir: options.stateDir,
+            workspaceDir: options.workspaceDir,
+            zoneId: await readZoneIdFromManifest(extractDirectory),
+        };
+    }
+    finally {
+        await fs.rm(extractDirectory, { recursive: true, force: true });
+        await fs.unlink(decryptedTarPath);
+    }
+}
+//# sourceMappingURL=backup-restore-operation.js.map

package/dist/backup/backup-restore-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore-operation.js","sourceRoot":"","sources":["../../src/backup/backup-restore-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,KAAK,UAAU,8BAA8B,CAC5C,eAAuB,EACvB,eAAuB;IAEvB,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC/B,MAAM,aAAa,CAAC,IAAI,EAAE;YACzB,IAAI;YACJ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC;SACrC,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,gBAAwB;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiC,CAAC;QACzE,OAAO,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C;IACA,MAAM,gBAAgB,GAAG,GAAG,OAAO,CAAC,UAAU,gBAAgB,CAAC;IAC/D,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAEvE,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC;QACJ,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC7E,MAAM,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7F,MAAM,8BAA8B,CACnC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EACxC,OAAO,CAAC,YAAY,CACpB,CAAC;QAEF,OAAO;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,sBAAsB,CAAC,gBAAgB,CAAC;SACtD,CAAC;IACH,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;AACF,CAAC"}

package/dist/build/docker-image-builder.d.ts

@@ -0,0 +1,11 @@
+export interface DockerImageBuilderDependencies {
+    readonly executeCommand?: (command: string, args: readonly string[]) => Promise<{
+        readonly exitCode?: number;
+    } | void>;
+}
+export interface BuildDockerImageOptions {
+    readonly dockerfilePath: string;
+    readonly imageTag: string;
+}
+export declare function buildDockerImage(options: BuildDockerImageOptions, dependencies?: DockerImageBuilderDependencies): Promise<void>;
+//# sourceMappingURL=docker-image-builder.d.ts.map

package/dist/build/docker-image-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-image-builder.d.ts","sourceRoot":"","sources":["../../src/build/docker-image-builder.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,KACnB,OAAO,CAAC;QACZ,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC,CAAC;CACV;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAMD,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,8BAAmC,GAC/C,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/build/docker-image-builder.js

@@ -0,0 +1,24 @@
+import path from 'node:path';
+import { execa } from 'execa';
+async function executeDockerCommand(command, args) {
+    await execa(command, args, { stdio: 'inherit' });
+}
+export async function buildDockerImage(options, dependencies = {}) {
+    const executeCommand = dependencies.executeCommand ?? executeDockerCommand;
+    const resolvedDockerfilePath = path.resolve(options.dockerfilePath);
+    const dockerBuildContextDirectory = path.dirname(resolvedDockerfilePath);
+    try {
+        await executeCommand('docker', [
+            'build',
+            '-f',
+            resolvedDockerfilePath,
+            '-t',
+            options.imageTag,
+            dockerBuildContextDirectory,
+        ]);
+    }
+    catch (error) {
+        throw new Error(`Docker build failed for ${options.imageTag}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
+//# sourceMappingURL=docker-image-builder.js.map

package/dist/build/docker-image-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-image-builder.js","sourceRoot":"","sources":["../../src/build/docker-image-builder.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAgB9B,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,IAAuB;IAC3E,MAAM,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAgC,EAChC,eAA+C,EAAE;IAEjD,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,IAAI,oBAAoB,CAAC;IAC3E,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,2BAA2B,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEzE,IAAI,CAAC;QACJ,MAAM,cAAc,CAAC,QAAQ,EAAE;YAC9B,OAAO;YACP,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,OAAO,CAAC,QAAQ;YAChB,2BAA2B;SAC3B,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,2BAA2B,OAAO,CAAC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxG,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/build/gondolin-image-builder.d.ts

@@ -0,0 +1,16 @@
+import { type BuildConfig, type BuildImageOptions, type BuildImageResult } from '@agent-vm/gondolin-adapter';
+export interface GondolinImageBuilderDependencies {
+    readonly buildImage?: (options: BuildImageOptions, dependencies?: {
+        readonly gondolinVersion?: string;
+    }) => Promise<BuildImageResult>;
+    readonly loadBuildConfig?: (buildConfigPath: string) => Promise<BuildConfig>;
+    readonly resolveRuntimeBuildVersionTag?: () => Promise<string>;
+}
+export declare function computeFingerprintFromConfigPath(buildConfigPath: string, systemCacheIdentifierPath: string, dependencies?: Pick<GondolinImageBuilderDependencies, 'resolveRuntimeBuildVersionTag'>): Promise<string>;
+export declare function buildGondolinImage(options: {
+    readonly buildConfigPath: string;
+    readonly systemCacheIdentifierPath: string;
+    readonly cacheDir: string;
+    readonly fullReset?: boolean;
+}, dependencies?: GondolinImageBuilderDependencies): Promise<BuildImageResult>;
+//# sourceMappingURL=gondolin-image-builder.d.ts.map

package/dist/build/gondolin-image-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-image-builder.d.ts","sourceRoot":"","sources":["../../src/build/gondolin-image-builder.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,4BAA4B,CAAC;AAKpC,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/D;AAuBD,wBAAsB,gCAAgC,CACrD,eAAe,EAAE,MAAM,EACvB,yBAAyB,EAAE,MAAM,EACjC,YAAY,GAAE,IAAI,CAAC,gCAAgC,EAAE,+BAA+B,CAAM,GACxF,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,kBAAkB,CACvC,OAAO,EAAE;IACR,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC7B,EACD,YAAY,GAAE,gCAAqC,GACjD,OAAO,CAAC,gBAAgB,CAAC,CAwB3B"}

package/dist/build/gondolin-image-builder.js

@@ -0,0 +1,52 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildImage as buildImageFromCore, computeBuildFingerprint, } from '@agent-vm/gondolin-adapter';
+import { loadSystemCacheIdentifier } from '../config/system-cache-identifier.js';
+import { resolveRuntimeBuildVersionTag as resolveRuntimeBuildVersionTagDefault } from './runtime-versions.js';
+async function loadBuildConfigFromJson(buildConfigPath) {
+    let rawContents;
+    try {
+        rawContents = await fs.readFile(buildConfigPath, 'utf8');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to read build config '${buildConfigPath}': ${message}`, {
+            cause: error,
+        });
+    }
+    try {
+        return JSON.parse(rawContents);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to parse build config '${buildConfigPath}': ${message}`, {
+            cause: error,
+        });
+    }
+}
+export async function computeFingerprintFromConfigPath(buildConfigPath, systemCacheIdentifierPath, dependencies = {}) {
+    const buildConfig = await loadBuildConfigFromJson(buildConfigPath);
+    const fingerprintInput = await loadSystemCacheIdentifier({ filePath: systemCacheIdentifierPath });
+    const runtimeBuildVersionTag = await (dependencies.resolveRuntimeBuildVersionTag ?? resolveRuntimeBuildVersionTagDefault)();
+    return computeBuildFingerprint(buildConfig, runtimeBuildVersionTag, fingerprintInput);
+}
+export async function buildGondolinImage(options, dependencies = {}) {
+    const loadBuildConfig = dependencies.loadBuildConfig ?? loadBuildConfigFromJson;
+    const buildImage = dependencies.buildImage ?? buildImageFromCore;
+    const configDir = path.dirname(path.resolve(options.buildConfigPath));
+    const buildConfig = await loadBuildConfig(options.buildConfigPath);
+    const fingerprintInput = await loadSystemCacheIdentifier({
+        filePath: options.systemCacheIdentifierPath,
+    });
+    const runtimeBuildVersionTag = await (dependencies.resolveRuntimeBuildVersionTag ?? resolveRuntimeBuildVersionTagDefault)();
+    return await buildImage({
+        buildConfig,
+        cacheDir: options.cacheDir,
+        configDir,
+        fingerprintInput,
+        ...(options.fullReset ? { fullReset: true } : {}),
+    }, {
+        gondolinVersion: runtimeBuildVersionTag,
+    });
+}
+//# sourceMappingURL=gondolin-image-builder.js.map

package/dist/build/gondolin-image-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-image-builder.js","sourceRoot":"","sources":["../../src/build/gondolin-image-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACN,UAAU,IAAI,kBAAkB,EAChC,uBAAuB,GAIvB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,uBAAuB,CAAC;AAW9G,KAAK,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,gCAAgC,eAAe,MAAM,OAAO,EAAE,EAAE;YAC/E,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAgB,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,iCAAiC,eAAe,MAAM,OAAO,EAAE,EAAE;YAChF,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACrD,eAAuB,EACvB,yBAAiC,EACjC,eAAwF,EAAE;IAE1F,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CAAC,EAAE,QAAQ,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAClG,MAAM,sBAAsB,GAAG,MAAM,CACpC,YAAY,CAAC,6BAA6B,IAAI,oCAAoC,CAClF,EAAE,CAAC;IAEJ,OAAO,uBAAuB,CAAC,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAKC,EACD,eAAiD,EAAE;IAEnD,MAAM,eAAe,GAAG,YAAY,CAAC,eAAe,IAAI,uBAAuB,CAAC;IAChF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,kBAAkB,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CAAC;QACxD,QAAQ,EAAE,OAAO,CAAC,yBAAyB;KAC3C,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,MAAM,CACpC,YAAY,CAAC,6BAA6B,IAAI,oCAAoC,CAClF,EAAE,CAAC;IAEJ,OAAO,MAAM,UAAU,CACtB;QACC,WAAW;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS;QACT,gBAAgB;QAChB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,EACD;QACC,eAAe,EAAE,sBAAsB;KACvC,CACD,CAAC;AACH,CAAC"}

package/dist/build/runtime-versions.d.ts

@@ -0,0 +1,13 @@
+export interface RuntimePackageVersions {
+    readonly agentVm: string;
+    readonly gondolinAdapter: string;
+    readonly gondolinPackage: string;
+}
+export declare function findPackageJsonPathFromStart(startPath: string): Promise<string>;
+export declare function readRuntimePackageVersions(options: {
+    readonly agentVmPackageJsonPath: string;
+    readonly gondolinAdapterPackageJsonPath: string;
+}): Promise<RuntimePackageVersions>;
+export declare function formatRuntimeBuildVersionTag(versions: RuntimePackageVersions): string;
+export declare function resolveRuntimeBuildVersionTag(): Promise<string>;
+//# sourceMappingURL=runtime-versions.d.ts.map

package/dist/build/runtime-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-versions.d.ts","sourceRoot":"","sources":["../../src/build/runtime-versions.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CACjC;AAoDD,wBAAsB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BrF;AAkBD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACzD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;CAChD,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAkBlC;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,CAMrF;AAED,wBAAsB,6BAA6B,IAAI,OAAO,CAAC,MAAM,CAAC,CAerE"}