@agent-vm/agent-vm 0.0.20

package/dist/controller/active-task-registry.d.ts

@@ -0,0 +1,32 @@
+export interface ActiveWorkerTaskRepo {
+    readonly repoUrl: string;
+    readonly baseBranch: string;
+    readonly hostWorkspacePath: string;
+    readonly vmWorkspacePath: string;
+}
+export interface ActiveWorkerTaskIngress {
+    readonly host: string;
+    readonly port: number;
+}
+export interface ActiveWorkerTask {
+    readonly taskId: string;
+    readonly zoneId: string;
+    readonly taskRoot: string;
+    readonly branchPrefix: string;
+    readonly repos: readonly ActiveWorkerTaskRepo[];
+    readonly workerIngress: ActiveWorkerTaskIngress | null;
+}
+export declare class ActiveTaskRegistry {
+    private readonly tasksByZone;
+    tryReserve(zoneId: string, maxActiveTasksPerPod: number): string | null;
+    activateReservation(zoneId: string, reservationId: string, task: ActiveWorkerTask): void;
+    releaseReservation(zoneId: string, reservationId: string): boolean;
+    get(zoneId: string, taskId: string): ActiveWorkerTask | null;
+    listForZone(zoneId: string): readonly ActiveWorkerTask[];
+    countOccupiedForZone(zoneId: string): number;
+    setWorkerIngress(zoneId: string, taskId: string, workerIngress: ActiveWorkerTaskIngress): void;
+    clear(zoneId: string, taskId: string): void;
+    private getOrCreateZoneState;
+    private deleteZoneIfEmpty;
+}
+//# sourceMappingURL=active-task-registry.d.ts.map

package/dist/controller/active-task-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-task-registry.d.ts","sourceRoot":"","sources":["../../src/controller/active-task-registry.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACvD;AAOD,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAEzD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAUvE,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAWxF,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAUlE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAQ5D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,gBAAgB,EAAE;IAIxD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAQ5C,gBAAgB,CACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,uBAAuB,GACpC,IAAI;IASA,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWlD,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,iBAAiB;CAKzB"}

package/dist/controller/active-task-registry.js

@@ -0,0 +1,83 @@
+import crypto from 'node:crypto';
+export class ActiveTaskRegistry {
+    tasksByZone = new Map();
+    tryReserve(zoneId, maxActiveTasksPerPod) {
+        const state = this.getOrCreateZoneState(zoneId);
+        if (state.tasksById.size + state.reservations.size >= maxActiveTasksPerPod) {
+            return null;
+        }
+        const reservationId = crypto.randomUUID();
+        state.reservations.add(reservationId);
+        return reservationId;
+    }
+    activateReservation(zoneId, reservationId, task) {
+        const state = this.getOrCreateZoneState(zoneId);
+        if (!state.reservations.has(reservationId)) {
+            throw new Error(`Zone '${zoneId}' does not have reservation '${reservationId}' for task '${task.taskId}'.`);
+        }
+        state.reservations.delete(reservationId);
+        state.tasksById.set(task.taskId, task);
+    }
+    releaseReservation(zoneId, reservationId) {
+        const state = this.tasksByZone.get(zoneId);
+        if (!state) {
+            return false;
+        }
+        const deleted = state.reservations.delete(reservationId);
+        this.deleteZoneIfEmpty(zoneId, state);
+        return deleted;
+    }
+    get(zoneId, taskId) {
+        const state = this.tasksByZone.get(zoneId);
+        if (!state) {
+            return null;
+        }
+        return state.tasksById.get(taskId) ?? null;
+    }
+    listForZone(zoneId) {
+        return [...(this.tasksByZone.get(zoneId)?.tasksById.values() ?? [])];
+    }
+    countOccupiedForZone(zoneId) {
+        const state = this.tasksByZone.get(zoneId);
+        if (!state) {
+            return 0;
+        }
+        return state.tasksById.size + state.reservations.size;
+    }
+    setWorkerIngress(zoneId, taskId, workerIngress) {
+        const task = this.get(zoneId, taskId);
+        if (!task) {
+            throw new Error(`Zone '${zoneId}' has no active task '${taskId}' to update.`);
+        }
+        const state = this.getOrCreateZoneState(zoneId);
+        state.tasksById.set(taskId, { ...task, workerIngress });
+    }
+    clear(zoneId, taskId) {
+        const state = this.tasksByZone.get(zoneId);
+        if (!state) {
+            throw new Error(`Zone '${zoneId}' has no active task '${taskId}' to clear.`);
+        }
+        if (!state.tasksById.delete(taskId)) {
+            throw new Error(`Zone '${zoneId}' has no active task '${taskId}' to clear.`);
+        }
+        this.deleteZoneIfEmpty(zoneId, state);
+    }
+    getOrCreateZoneState(zoneId) {
+        const existingState = this.tasksByZone.get(zoneId);
+        if (existingState) {
+            return existingState;
+        }
+        const state = {
+            reservations: new Set(),
+            tasksById: new Map(),
+        };
+        this.tasksByZone.set(zoneId, state);
+        return state;
+    }
+    deleteZoneIfEmpty(zoneId, state) {
+        if (state.tasksById.size === 0 && state.reservations.size === 0) {
+            this.tasksByZone.delete(zoneId);
+        }
+    }
+}
+//# sourceMappingURL=active-task-registry.js.map

package/dist/controller/active-task-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-task-registry.js","sourceRoot":"","sources":["../../src/controller/active-task-registry.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AA4BjC,MAAM,OAAO,kBAAkB;IACb,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEzD,UAAU,CAAC,MAAc,EAAE,oBAA4B;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACtC,OAAO,aAAa,CAAC;IACtB,CAAC;IAEM,mBAAmB,CAAC,MAAc,EAAE,aAAqB,EAAE,IAAsB;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACd,SAAS,MAAM,gCAAgC,aAAa,eAAe,IAAI,CAAC,MAAM,IAAI,CAC1F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAEM,kBAAkB,CAAC,MAAc,EAAE,aAAqB;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,GAAG,CAAC,MAAc,EAAE,MAAc;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAEM,WAAW,CAAC,MAAc;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAEM,oBAAoB,CAAC,MAAc;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC;QACV,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACvD,CAAC;IAEM,gBAAgB,CACtB,MAAc,EACd,MAAc,EACd,aAAsC;QAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,yBAAyB,MAAM,cAAc,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,MAAc,EAAE,MAAc;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,yBAAyB,MAAM,aAAa,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,yBAAyB,MAAM,aAAa,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAEO,oBAAoB,CAAC,MAAc;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,aAAa,EAAE,CAAC;YACnB,OAAO,aAAa,CAAC;QACtB,CAAC;QACD,MAAM,KAAK,GAAkB;YAC5B,YAAY,EAAE,IAAI,GAAG,EAAU;YAC/B,SAAS,EAAE,IAAI,GAAG,EAA4B;SAC9C,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,KAAoB;QAC7D,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;IACF,CAAC;CACD"}

package/dist/controller/composite-secret-resolver.d.ts

@@ -0,0 +1,3 @@
+import type { SecretResolver } from '@agent-vm/gondolin-adapter';
+export declare function createCompositeSecretResolver(onePasswordResolver: SecretResolver | null, env?: NodeJS.ProcessEnv): SecretResolver;
+//# sourceMappingURL=composite-secret-resolver.d.ts.map

package/dist/controller/composite-secret-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite-secret-resolver.d.ts","sourceRoot":"","sources":["../../src/controller/composite-secret-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5E,wBAAgB,6BAA6B,CAC5C,mBAAmB,EAAE,cAAc,GAAG,IAAI,EAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,cAAc,CAuChB"}

package/dist/controller/composite-secret-resolver.js

@@ -0,0 +1,38 @@
+export function createCompositeSecretResolver(onePasswordResolver, env = process.env) {
+    return {
+        async resolve(ref) {
+            switch (ref.source) {
+                case 'environment': {
+                    const value = env[ref.ref];
+                    if (value === undefined) {
+                        throw new Error(`Environment variable '${ref.ref}' is not set.`);
+                    }
+                    if (value.trim().length === 0) {
+                        throw new Error(`Environment variable '${ref.ref}' is set but empty.`);
+                    }
+                    return value;
+                }
+                case '1password': {
+                    if (!onePasswordResolver) {
+                        throw new Error("Secret with source '1password' requires host.secretsProvider to be configured.");
+                    }
+                    return await onePasswordResolver.resolve(ref);
+                }
+                default: {
+                    const exhaustiveCheck = ref;
+                    throw new Error(`Unsupported secret source: ${JSON.stringify(exhaustiveCheck)}`);
+                }
+            }
+        },
+        async resolveAll(refs) {
+            const resolved = {};
+            for (const [name, ref] of Object.entries(refs)) {
+                // Resolution is intentionally sequential to preserve exact per-secret error context.
+                // oxlint-disable-next-line eslint/no-await-in-loop
+                resolved[name] = await this.resolve(ref);
+            }
+            return resolved;
+        },
+    };
+}
+//# sourceMappingURL=composite-secret-resolver.js.map

package/dist/controller/composite-secret-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite-secret-resolver.js","sourceRoot":"","sources":["../../src/controller/composite-secret-resolver.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,6BAA6B,CAC5C,mBAA0C,EAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO;QACN,KAAK,CAAC,OAAO,CAAC,GAAc;YAC3B,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,aAAa,CAAC,CAAC,CAAC;oBACpB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC;oBAClE,CAAC;oBACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC;oBACxE,CAAC;oBACD,OAAO,KAAK,CAAC;gBACd,CAAC;gBACD,KAAK,WAAW,CAAC,CAAC,CAAC;oBAClB,IAAI,CAAC,mBAAmB,EAAE,CAAC;wBAC1B,MAAM,IAAI,KAAK,CACd,gFAAgF,CAChF,CAAC;oBACH,CAAC;oBACD,OAAO,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,eAAe,GAAU,GAAG,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;gBAClF,CAAC;YACF,CAAC;QACF,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAA+B;YAC/C,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,qFAAqF;gBACrF,mDAAmD;gBACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,QAAQ,CAAC;QACjB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/controller/controller-runtime-operations.d.ts

@@ -0,0 +1,62 @@
+import type { GatewayProcessSpec } from '@agent-vm/gateway-interface';
+import type { SecretResolver } from '@agent-vm/gondolin-adapter';
+import type { SystemConfig } from '../config/system-config.js';
+import type { LeaseManager } from './leases/lease-manager.js';
+interface GatewayZoneRuntime {
+    readonly ingress: {
+        readonly host: string;
+        readonly port: number;
+    };
+    readonly processSpec: GatewayProcessSpec;
+    readonly vm: {
+        close(): Promise<void>;
+        enableSsh(): Promise<unknown>;
+        exec(command: string): Promise<{
+            readonly exitCode: number;
+            readonly stderr: string;
+            readonly stdout: string;
+        }>;
+    };
+}
+interface ControllerRuntimeOperations {
+    readonly destroyZone: (targetZoneId: string, purge: boolean) => Promise<unknown>;
+    readonly enableSshForZone: (targetZoneId: string) => Promise<unknown>;
+    readonly execInZone: (targetZoneId: string, command: string) => Promise<{
+        readonly exitCode: number;
+        readonly stderr: string;
+        readonly stdout: string;
+    }>;
+    readonly getStatus: () => Promise<unknown>;
+    readonly getZoneLogs: (targetZoneId: string) => Promise<{
+        readonly output: string;
+        readonly zoneId: string;
+    }>;
+    readonly refreshZoneCredentials: (targetZoneId: string) => Promise<{
+        readonly ok: true;
+        readonly zoneId: string;
+    }>;
+    readonly upgradeZone: (targetZoneId: string) => Promise<unknown>;
+}
+export declare function createControllerRuntimeOperations(options: {
+    readonly activeZoneId: string;
+    readonly getGateway: () => GatewayZoneRuntime;
+    readonly getZone: (zoneId: string) => SystemConfig['zones'][number];
+    readonly leaseManager: Pick<LeaseManager, 'listLeases' | 'releaseLease'>;
+    readonly restartGatewayZone: () => Promise<void>;
+    readonly secretResolver: SecretResolver;
+    readonly stopGatewayZone: () => Promise<void>;
+    readonly systemConfig: SystemConfig;
+}): ControllerRuntimeOperations;
+export declare function createStopControllerOperation(options: {
+    readonly clearReaperTimer: () => void;
+    readonly closeControllerServer: () => void;
+    readonly getLeases: () => readonly {
+        readonly id: string;
+    }[];
+    readonly releaseLease: (leaseId: string) => Promise<void>;
+    readonly stopGatewayZone: () => Promise<void>;
+}): () => Promise<{
+    readonly ok: true;
+}>;
+export {};
+//# sourceMappingURL=controller-runtime-operations.d.ts.map

package/dist/controller/controller-runtime-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime-operations.d.ts","sourceRoot":"","sources":["../../src/controller/controller-runtime-operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAO/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAE9D,UAAU,kBAAkB;IAC3B,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,EAAE,EAAE;QACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;YACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;SACxB,CAAC,CAAC;KACH,CAAC;CACF;AAED,UAAU,2BAA2B;IACpC,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,QAAQ,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,QAAQ,CAAC,UAAU,EAAE,CACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,KACX,OAAO,CAAC;QACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QAClE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,kBAAkB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,cAAc,CAAC,CAAC;IACzE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACpC,GAAG,2BAA2B,CA2F9B;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACtD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,IAAI,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C,GAAG,MAAM,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAcvC"}

package/dist/controller/controller-runtime-operations.js

@@ -0,0 +1,99 @@
+import { resolveZoneSecrets } from '../gateway/credential-manager.js';
+import { buildControllerStatus } from '../operations/controller-status.js';
+import { runControllerCredentialsRefresh } from '../operations/credentials-refresh.js';
+import { runControllerDestroy } from '../operations/destroy-zone.js';
+import { runControllerUpgrade } from '../operations/upgrade-zone.js';
+import { runControllerLogs } from '../operations/zone-logs.js';
+export function createControllerRuntimeOperations(options) {
+    const assertActiveZone = (targetZoneId) => {
+        if (targetZoneId !== options.activeZoneId) {
+            throw new Error(`Controller is running zone '${options.activeZoneId}', not '${targetZoneId}'. Multi-zone runtime selection is not implemented yet.`);
+        }
+    };
+    return {
+        enableSshForZone: async (targetZoneId) => {
+            assertActiveZone(targetZoneId);
+            return await options.getGateway().vm.enableSsh();
+        },
+        execInZone: async (targetZoneId, command) => {
+            assertActiveZone(targetZoneId);
+            const result = await options.getGateway().vm.exec(command);
+            return {
+                exitCode: result.exitCode,
+                stderr: result.stderr,
+                stdout: result.stdout,
+            };
+        },
+        destroyZone: async (targetZoneId, purge) => {
+            assertActiveZone(targetZoneId);
+            return await runControllerDestroy({
+                purge,
+                systemConfig: options.systemConfig,
+                zoneId: targetZoneId,
+            }, {
+                releaseZoneLeases: async () => {
+                    for (const lease of options.leaseManager
+                        .listLeases()
+                        .filter((activeLease) => activeLease.zoneId === targetZoneId)) {
+                        // oxlint-disable-next-line eslint/no-await-in-loop -- sequential release avoids TCP slot races
+                        await options.leaseManager.releaseLease(lease.id);
+                    }
+                },
+                stopGatewayZone: options.stopGatewayZone,
+            });
+        },
+        getStatus: async () => buildControllerStatus(options.systemConfig),
+        getZoneLogs: async (targetZoneId) => {
+            assertActiveZone(targetZoneId);
+            const gateway = options.getGateway();
+            return await runControllerLogs({
+                zoneId: targetZoneId,
+            }, {
+                readGatewayLogs: async () => (await gateway.vm.exec(`cat ${gateway.processSpec.logPath} 2>/dev/null || echo ""`))
+                    .stdout,
+            });
+        },
+        refreshZoneCredentials: async (targetZoneId) => {
+            assertActiveZone(targetZoneId);
+            return await runControllerCredentialsRefresh({
+                zoneId: targetZoneId,
+            }, {
+                refreshZoneSecrets: async (zoneId) => {
+                    await resolveZoneSecrets({
+                        secretResolver: options.secretResolver,
+                        systemConfig: options.systemConfig,
+                        zoneId,
+                    });
+                },
+                restartGatewayZone: async () => await options.restartGatewayZone(),
+            });
+        },
+        upgradeZone: async (targetZoneId) => {
+            assertActiveZone(targetZoneId);
+            return await runControllerUpgrade({
+                systemConfig: options.systemConfig,
+                zoneId: targetZoneId,
+            }, {
+                rebuildGatewayImage: async () => { },
+                restartGatewayZone: options.restartGatewayZone,
+            });
+        },
+    };
+}
+export function createStopControllerOperation(options) {
+    return async () => {
+        options.clearReaperTimer();
+        for (const lease of options.getLeases()) {
+            // oxlint-disable-next-line eslint/no-await-in-loop -- sequential release avoids TCP slot races
+            await options.releaseLease(lease.id);
+        }
+        try {
+            await options.stopGatewayZone();
+        }
+        finally {
+            options.closeControllerServer();
+        }
+        return { ok: true };
+    };
+}
+//# sourceMappingURL=controller-runtime-operations.js.map

package/dist/controller/controller-runtime-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime-operations.js","sourceRoot":"","sources":["../../src/controller/controller-runtime-operations.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AA2C/D,MAAM,UAAU,iCAAiC,CAAC,OASjD;IACA,MAAM,gBAAgB,GAAG,CAAC,YAAoB,EAAQ,EAAE;QACvD,IAAI,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACd,+BAA+B,OAAO,CAAC,YAAY,WAAW,YAAY,yDAAyD,CACnI,CAAC;QACH,CAAC;IACF,CAAC,CAAC;IAEF,OAAO;QACN,gBAAgB,EAAE,KAAK,EAAE,YAAoB,EAAE,EAAE;YAChD,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;QAClD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,YAAoB,EAAE,OAAe,EAAE,EAAE;YAC3D,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO;gBACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,YAAoB,EAAE,KAAc,EAAE,EAAE;YAC3D,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,MAAM,oBAAoB,CAChC;gBACC,KAAK;gBACL,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,YAAY;aACpB,EACD;gBACC,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,YAAY;yBACtC,UAAU,EAAE;yBACZ,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,EAAE,CAAC;wBAChE,+FAA+F;wBAC/F,MAAM,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACF,CAAC;gBACD,eAAe,EAAE,OAAO,CAAC,eAAe;aACxC,CACD,CAAC;QACH,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC;QAClE,WAAW,EAAE,KAAK,EAAE,YAAoB,EAAE,EAAE;YAC3C,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,MAAM,iBAAiB,CAC7B;gBACC,MAAM,EAAE,YAAY;aACpB,EACD;gBACC,eAAe,EAAE,KAAK,IAAI,EAAE,CAC3B,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAC;qBAClF,MAAM;aACT,CACD,CAAC;QACH,CAAC;QACD,sBAAsB,EAAE,KAAK,EAAE,YAAoB,EAAE,EAAE;YACtD,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,MAAM,+BAA+B,CAC3C;gBACC,MAAM,EAAE,YAAY;aACpB,EACD;gBACC,kBAAkB,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;oBAC5C,MAAM,kBAAkB,CAAC;wBACxB,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,MAAM;qBACN,CAAC,CAAC;gBACJ,CAAC;gBACD,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,OAAO,CAAC,kBAAkB,EAAE;aAClE,CACD,CAAC;QACH,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,YAAoB,EAAE,EAAE;YAC3C,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/B,OAAO,MAAM,oBAAoB,CAChC;gBACC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,YAAY;aACpB,EACD;gBACC,mBAAmB,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;gBACnC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;aAC9C,CACD,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAM7C;IACA,OAAO,KAAK,IAAoC,EAAE;QACjD,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;YACzC,+FAA+F;YAC/F,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QACjC,CAAC;gBAAS,CAAC;YACV,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAW,CAAC;IAC9B,CAAC,CAAC;AACH,CAAC"}

package/dist/controller/controller-runtime-support.d.ts

@@ -0,0 +1,10 @@
+import type { SecretResolver } from '@agent-vm/gondolin-adapter';
+import { resolveServiceAccountToken } from '@agent-vm/gondolin-adapter';
+import type { SystemConfig } from '../config/system-config.js';
+export declare function createSecretResolverFromSystemConfig(systemConfig: SystemConfig, createSecretResolverImpl: (options: {
+    readonly serviceAccountToken: string;
+}) => Promise<SecretResolver>, resolveTokenImpl?: typeof resolveServiceAccountToken): Promise<SecretResolver>;
+export declare const createSecretResolver: typeof createSecretResolverFromSystemConfig;
+export declare function resolveControllerGithubToken(systemConfig: SystemConfig, secretResolver: SecretResolver): Promise<string | null>;
+export declare function findConfiguredZone(systemConfig: SystemConfig, zoneId: string): SystemConfig['zones'][number];
+//# sourceMappingURL=controller-runtime-support.d.ts.map

package/dist/controller/controller-runtime-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime-support.d.ts","sourceRoot":"","sources":["../../src/controller/controller-runtime-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,wBAAsB,oCAAoC,CACzD,YAAY,EAAE,YAAY,EAC1B,wBAAwB,EAAE,CAAC,OAAO,EAAE;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,KAAK,OAAO,CAAC,cAAc,CAAC,EAC7B,gBAAgB,GAAE,OAAO,0BAAuD,GAC9E,OAAO,CAAC,cAAc,CAAC,CAYzB;AAED,eAAO,MAAM,oBAAoB,6CAAuC,CAAC;AAEzE,wBAAsB,4BAA4B,CACjD,YAAY,EAAE,YAAY,EAC1B,cAAc,EAAE,cAAc,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED,wBAAgB,kBAAkB,CACjC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,MAAM,GACZ,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAM/B"}

package/dist/controller/controller-runtime-support.js

@@ -0,0 +1,36 @@
+import { resolveServiceAccountToken } from '@agent-vm/gondolin-adapter';
+import { createCompositeSecretResolver } from './composite-secret-resolver.js';
+export async function createSecretResolverFromSystemConfig(systemConfig, createSecretResolverImpl, resolveTokenImpl = resolveServiceAccountToken) {
+    let onePasswordResolver = null;
+    if (systemConfig.host.secretsProvider) {
+        const serviceAccountToken = await resolveTokenImpl(systemConfig.host.secretsProvider.tokenSource);
+        onePasswordResolver = await createSecretResolverImpl({
+            serviceAccountToken,
+        });
+    }
+    return createCompositeSecretResolver(onePasswordResolver);
+}
+export const createSecretResolver = createSecretResolverFromSystemConfig;
+export async function resolveControllerGithubToken(systemConfig, secretResolver) {
+    const githubTokenConfig = systemConfig.host.githubToken;
+    if (!githubTokenConfig) {
+        return process.env.GITHUB_TOKEN ?? null;
+    }
+    return await secretResolver.resolve(githubTokenConfig.source === 'environment'
+        ? {
+            source: 'environment',
+            ref: githubTokenConfig.envVar,
+        }
+        : {
+            source: '1password',
+            ref: githubTokenConfig.ref,
+        });
+}
+export function findConfiguredZone(systemConfig, zoneId) {
+    const zone = systemConfig.zones.find((candidateZone) => candidateZone.id === zoneId);
+    if (!zone) {
+        throw new Error(`Unknown zone '${zoneId}'.`);
+    }
+    return zone;
+}
+//# sourceMappingURL=controller-runtime-support.js.map

package/dist/controller/controller-runtime-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime-support.js","sourceRoot":"","sources":["../../src/controller/controller-runtime-support.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAGxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACzD,YAA0B,EAC1B,wBAE6B,EAC7B,mBAAsD,0BAA0B;IAEhF,IAAI,mBAAmB,GAA0B,IAAI,CAAC;IACtD,IAAI,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,mBAAmB,GAAG,MAAM,gBAAgB,CACjD,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,CAC7C,CAAC;QACF,mBAAmB,GAAG,MAAM,wBAAwB,CAAC;YACpD,mBAAmB;SACnB,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,YAA0B,EAC1B,cAA8B;IAE9B,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;IACxD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,OAAO,MAAM,cAAc,CAAC,OAAO,CAClC,iBAAiB,CAAC,MAAM,KAAK,aAAa;QACzC,CAAC,CAAC;YACA,MAAM,EAAE,aAAa;YACrB,GAAG,EAAE,iBAAiB,CAAC,MAAM;SAC7B;QACF,CAAC,CAAC;YACA,MAAM,EAAE,WAAW;YACnB,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC1B,CACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,YAA0B,EAC1B,MAAc;IAEd,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/controller/controller-runtime-types.d.ts

@@ -0,0 +1,58 @@
+import type { GatewayProcessSpec } from '@agent-vm/gateway-interface';
+import type { ManagedVm, SecretResolver } from '@agent-vm/gondolin-adapter';
+import type { LoadedSystemConfig } from '../config/system-config.js';
+import type { deleteGatewayRuntimeRecord } from '../gateway/gateway-runtime-record.js';
+import type { startGatewayZone } from '../gateway/gateway-zone-orchestrator.js';
+import type { RunTaskFn } from '../shared/run-task.js';
+import type { ActiveWorkerTask } from './active-task-registry.js';
+import type { createControllerService } from './http/controller-http-routes.js';
+import type { ToolProfile } from './leases/lease-manager.js';
+import type { executeWorkerTask, prepareWorkerTask } from './worker-task-runner.js';
+export interface ControllerRuntime {
+    readonly controllerPort: number;
+    readonly gateway?: {
+        readonly ingress: {
+            readonly host: string;
+            readonly port: number;
+        };
+        readonly processSpec: GatewayProcessSpec;
+        readonly vm: Pick<ManagedVm, 'close' | 'id'>;
+    };
+    close(): Promise<void>;
+}
+export interface ControllerRuntimeDependencies {
+    readonly clearIntervalImpl?: (timer: NodeJS.Timeout) => void;
+    readonly createManagedToolVm?: (options: {
+        readonly profile: ToolProfile;
+        readonly tcpSlot: number;
+        readonly workspaceDir: string;
+        readonly zoneId: string;
+    }) => Promise<ManagedVm>;
+    readonly createSecretResolver?: (options: {
+        readonly serviceAccountToken: string;
+    }) => Promise<SecretResolver>;
+    readonly deleteGatewayRuntimeRecord?: typeof deleteGatewayRuntimeRecord;
+    readonly now?: () => number;
+    readonly runTask?: RunTaskFn;
+    readonly prepareWorkerTask?: typeof prepareWorkerTask;
+    readonly executeWorkerTask?: typeof executeWorkerTask;
+    readonly onWorkerTaskPrepared?: (task: ActiveWorkerTask) => void | Promise<void>;
+    readonly onWorkerTaskIngress?: (zoneId: string, taskId: string, workerIngress: {
+        readonly host: string;
+        readonly port: number;
+    }) => void | Promise<void>;
+    readonly onWorkerTaskFinished?: (zoneId: string, taskId: string) => void | Promise<void>;
+    readonly setIntervalImpl?: (callback: () => void | Promise<void>, delayMs: number) => NodeJS.Timeout;
+    readonly startGatewayZone?: typeof startGatewayZone;
+    readonly startHttpServer?: (options: {
+        readonly app: ReturnType<typeof createControllerService>;
+        readonly port: number;
+    }) => Promise<{
+        close(): Promise<void>;
+    }>;
+}
+export interface StartControllerRuntimeOptions {
+    readonly systemConfig: LoadedSystemConfig;
+    readonly zoneId: string;
+}
+//# sourceMappingURL=controller-runtime-types.d.ts.map

package/dist/controller/controller-runtime-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime-types.d.ts","sourceRoot":"","sources":["../../src/controller/controller-runtime-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEpF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE;QAClB,QAAQ,CAAC,OAAO,EAAE;YACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;SACtB,CAAC;QACF,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;QACzC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;KAC7C,CAAC;IACF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE;QACxC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;KACrC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9B,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,0BAA0B,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,iBAAiB,CAAC;IACtD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAC3D,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,QAAQ,CAAC,eAAe,CAAC,EAAE,CAC1B,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EACpC,OAAO,EAAE,MAAM,KACX,MAAM,CAAC,OAAO,CAAC;IACpB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,CAAC;IACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACtB,KAAK,OAAO,CAAC;QACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACvB,CAAC,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB"}

package/dist/controller/controller-runtime-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=controller-runtime-types.js.map

package/dist/controller/controller-runtime-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime-types.js","sourceRoot":"","sources":["../../src/controller/controller-runtime-types.ts"],"names":[],"mappings":""}

package/dist/controller/controller-runtime.d.ts

@@ -0,0 +1,3 @@
+import { type ControllerRuntime, type ControllerRuntimeDependencies, type StartControllerRuntimeOptions } from './controller-runtime-types.js';
+export declare function startControllerRuntime(options: StartControllerRuntimeOptions, dependencies: ControllerRuntimeDependencies): Promise<ControllerRuntime>;
+//# sourceMappingURL=controller-runtime.d.ts.map

package/dist/controller/controller-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-runtime.d.ts","sourceRoot":"","sources":["../../src/controller/controller-runtime.ts"],"names":[],"mappings":"AAoBA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,MAAM,+BAA+B,CAAC;AAyCvC,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,6BAA6B,EACtC,YAAY,EAAE,6BAA6B,GACzC,OAAO,CAAC,iBAAiB,CAAC,CAqV5B"}