@agent-vm/agent-vm 0.0.20

package/dist/gateway/gateway-zone-support.d.ts

@@ -0,0 +1,55 @@
+import type { GatewayProcessSpec, GatewayZoneConfig } from '@agent-vm/gateway-interface';
+import type { LoadedSystemConfig, SystemConfig } from '../config/system-config.js';
+import type { RunTaskFn } from '../shared/run-task.js';
+export type GatewayZone = SystemConfig['zones'][number];
+export interface StartGatewayZoneOptions {
+    readonly environmentOverride?: Record<string, string>;
+    readonly runTask?: RunTaskFn;
+    readonly secretResolver: import('@agent-vm/gondolin-adapter').SecretResolver;
+    readonly systemConfig: LoadedSystemConfig;
+    readonly tcpHostsOverride?: Record<string, string>;
+    readonly vfsMountsOverride?: GatewayManagedVmFactoryOptions['vfsMounts'];
+    readonly zoneId: string;
+    readonly zoneOverride?: GatewayZone;
+}
+export interface GatewayZoneStartResult {
+    readonly image: import('@agent-vm/gondolin-adapter').BuildImageResult;
+    readonly ingress: {
+        readonly host: string;
+        readonly port: number;
+    };
+    readonly processSpec: GatewayProcessSpec;
+    readonly vm: import('@agent-vm/gondolin-adapter').ManagedVm;
+    readonly zone: GatewayZone;
+}
+export interface GatewayBuildImageOptions {
+    readonly buildConfig: unknown;
+    readonly cacheDir: string;
+    readonly fingerprintInput: unknown;
+    readonly fullReset?: boolean;
+}
+export interface GatewayManagedVmFactoryOptions {
+    readonly allowedHosts: readonly string[];
+    readonly cpus: number;
+    readonly env?: Record<string, string>;
+    readonly imagePath: string;
+    readonly memory: string;
+    readonly rootfsMode: 'readonly' | 'memory' | 'cow';
+    readonly secrets: Record<string, {
+        readonly hosts: readonly string[];
+        readonly value: string;
+    }>;
+    readonly sessionLabel?: string;
+    readonly tcpHosts?: Record<string, string>;
+    readonly vfsMounts: Record<string, {
+        readonly kind: 'realfs' | 'realfs-readonly' | 'memory' | 'shadow';
+        readonly hostPath?: string;
+        readonly shadowConfig?: {
+            readonly deny: readonly string[];
+            readonly tmpfs: readonly string[];
+        };
+    }>;
+}
+export declare function findGatewayZone(systemConfig: SystemConfig, zoneId: string): GatewayZone;
+export declare function mapSystemGatewayZoneToLifecycleZone(zone: GatewayZone): GatewayZoneConfig;
+//# sourceMappingURL=gateway-zone-support.d.ts.map

package/dist/gateway/gateway-zone-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-zone-support.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-zone-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;IAC7E,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,WAAW,CAAC,CAAC;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC;IACtE,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,EAAE,EAAE,OAAO,4BAA4B,EAAE,SAAS,CAAC;IAC5D,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CACvB,MAAM,EACN;QACC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACvB,CACD,CAAC;IACF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CACzB,MAAM,EACN;QACC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE;YACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;YACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;SAClC,CAAC;KACF,CACD,CAAC;CACF;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAOvF;AAED,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,WAAW,GAAG,iBAAiB,CAmCxF"}

package/dist/gateway/gateway-zone-support.js

@@ -0,0 +1,42 @@
+export function findGatewayZone(systemConfig, zoneId) {
+    const zone = systemConfig.zones.find((candidateZone) => candidateZone.id === zoneId);
+    if (!zone) {
+        throw new Error(`Unknown zone '${zoneId}'.`);
+    }
+    return zone;
+}
+export function mapSystemGatewayZoneToLifecycleZone(zone) {
+    return {
+        id: zone.id,
+        gateway: {
+            cpus: zone.gateway.cpus,
+            config: zone.gateway.config,
+            memory: zone.gateway.memory,
+            port: zone.gateway.port,
+            stateDir: zone.gateway.stateDir,
+            type: zone.gateway.type,
+            workspaceDir: zone.gateway.workspaceDir,
+            authProfilesRef: zone.gateway.authProfilesRef,
+        },
+        secrets: Object.fromEntries(Object.entries(zone.secrets).map(([secretName, secretConfig]) => [
+            secretName,
+            secretConfig.source === 'environment'
+                ? {
+                    source: 'environment',
+                    ...(secretConfig.hosts ? { hosts: secretConfig.hosts } : {}),
+                    injection: secretConfig.injection,
+                    envVar: secretConfig.envVar,
+                }
+                : {
+                    source: '1password',
+                    ...(secretConfig.hosts ? { hosts: secretConfig.hosts } : {}),
+                    injection: secretConfig.injection,
+                    ref: secretConfig.ref,
+                },
+        ])),
+        allowedHosts: zone.allowedHosts,
+        ...(zone.toolProfile ? { toolProfile: zone.toolProfile } : {}),
+        websocketBypass: zone.websocketBypass,
+    };
+}
+//# sourceMappingURL=gateway-zone-support.js.map

package/dist/gateway/gateway-zone-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-zone-support.js","sourceRoot":"","sources":["../../src/gateway/gateway-zone-support.ts"],"names":[],"mappings":"AAiEA,MAAM,UAAU,eAAe,CAAC,YAA0B,EAAE,MAAc;IACzE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,IAAiB;IACpE,OAAO;QACN,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE;YACR,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SAC7C;QACD,OAAO,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;YAChE,UAAU;YACV,YAAY,CAAC,MAAM,KAAK,aAAa;gBACpC,CAAC,CAAC;oBACA,MAAM,EAAE,aAAsB;oBAC9B,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,MAAM,EAAE,YAAY,CAAC,MAAM;iBAC3B;gBACF,CAAC,CAAC;oBACA,MAAM,EAAE,WAAoB;oBAC5B,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,SAAS,EAAE,YAAY,CAAC,SAAS;oBACjC,GAAG,EAAE,YAAY,CAAC,GAAG;iBACrB;SACH,CAAC,CACF;QACD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,eAAe,EAAE,IAAI,CAAC,eAAe;KACrC,CAAC;AACH,CAAC"}

package/dist/gateway-api-client/gateway-api-client.d.ts

@@ -0,0 +1,34 @@
+export interface GatewayToolInvocation {
+    readonly tool: string;
+    readonly args: Record<string, unknown>;
+    readonly sessionKey?: string;
+    readonly dryRun?: boolean;
+}
+/**
+ * Liveness probe response from `/health` or `/healthz`.
+ * Gateway returns `{ ok: true, status: "live" }` when the process is alive.
+ */
+export interface GatewayLivenessResponse {
+    readonly ok: boolean;
+    readonly status: 'live';
+}
+/**
+ * Readiness probe response from `/readyz`.
+ * Authenticated callers also receive `failing` and `uptimeMs` detail fields.
+ */
+export interface GatewayReadinessResponse {
+    readonly ready: boolean;
+    readonly failing?: readonly string[];
+    readonly uptimeMs?: number;
+}
+export interface GatewayApiClient {
+    /** Check gateway readiness via the `/readyz` probe endpoint. */
+    getGatewayStatus(): Promise<GatewayReadinessResponse>;
+    invokeTool(invocation: GatewayToolInvocation): Promise<unknown>;
+}
+export declare function createGatewayApiClient(options: {
+    readonly gatewayUrl: string;
+    readonly token: string;
+    readonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+}): GatewayApiClient;
+//# sourceMappingURL=gateway-api-client.d.ts.map

package/dist/gateway-api-client/gateway-api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-api-client.d.ts","sourceRoot":"","sources":["../../src/gateway-api-client/gateway-api-client.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAChC,gEAAgE;IAChE,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtD,UAAU,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9F,GAAG,gBAAgB,CA4BnB"}

package/dist/gateway-api-client/gateway-api-client.js

@@ -0,0 +1,29 @@
+export function createGatewayApiClient(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const baseUrl = options.gatewayUrl.replace(/\/$/u, '');
+    return {
+        getGatewayStatus: async () => {
+            const response = await fetchImpl(`${baseUrl}/readyz`, {
+                headers: {
+                    authorization: `Bearer ${options.token}`,
+                },
+            });
+            return (await response.json());
+        },
+        invokeTool: async (invocation) => {
+            const response = await fetchImpl(`${baseUrl}/tools/invoke`, {
+                body: JSON.stringify(invocation),
+                headers: {
+                    authorization: `Bearer ${options.token}`,
+                    'content-type': 'application/json',
+                },
+                method: 'POST',
+            });
+            if (!response.ok) {
+                throw new Error(`Gateway API returned status ${response.status}`);
+            }
+            return await response.json();
+        },
+    };
+}
+//# sourceMappingURL=gateway-api-client.js.map

package/dist/gateway-api-client/gateway-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-api-client.js","sourceRoot":"","sources":["../../src/gateway-api-client/gateway-api-client.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,sBAAsB,CAAC,OAItC;IACA,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvD,OAAO;QACN,gBAAgB,EAAE,KAAK,IAAuC,EAAE;YAC/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,SAAS,EAAE;gBACrD,OAAO,EAAE;oBACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;iBACxC;aACD,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;QAC5D,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,UAAiC,EAAoB,EAAE;YACzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,eAAe,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;gBAChC,OAAO,EAAE;oBACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBAClC;gBACD,MAAM,EAAE,MAAM;aACd,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/gateway-api-client/gateway-websocket-client.d.ts

@@ -0,0 +1,45 @@
+interface WebSocketLike {
+    addEventListener(event: string, handler: (data: {
+        data: string;
+    }) => void): void;
+    close(): void;
+    send(data: string): void;
+}
+/** Options for the connect handshake sent to the gateway. */
+export interface GatewayConnectOptions {
+    readonly token: string;
+    readonly clientId?: string;
+    readonly clientVersion?: string;
+    readonly platform?: string;
+    readonly role?: 'operator' | 'node';
+    readonly scopes?: readonly string[];
+    readonly protocolVersion?: number;
+}
+/** Successful connect response payload from the gateway. */
+interface ConnectHelloOkPayload {
+    readonly type: 'hello-ok';
+    readonly protocol: number;
+    readonly policy?: {
+        readonly tickIntervalMs?: number;
+    };
+    readonly auth?: {
+        readonly deviceToken?: string;
+        readonly role?: string;
+        readonly scopes?: readonly string[];
+    };
+}
+export interface GatewayWebSocketClient {
+    /** Resolves when the connect handshake completes. Rejects if the gateway refuses. */
+    readonly connected: Promise<ConnectHelloOkPayload>;
+    chatSend(params: {
+        readonly session: string;
+        readonly text: string;
+    }): Promise<unknown>;
+    close(): void;
+}
+export declare function createGatewayWebSocketClient(options: {
+    readonly createSocket: () => WebSocketLike;
+    readonly connectOptions: GatewayConnectOptions;
+}): GatewayWebSocketClient;
+export {};
+//# sourceMappingURL=gateway-websocket-client.d.ts.map

package/dist/gateway-api-client/gateway-websocket-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-websocket-client.d.ts","sourceRoot":"","sources":["../../src/gateway-api-client/gateway-websocket-client.ts"],"names":[],"mappings":"AAKA,UAAU,aAAa;IACtB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACjF,KAAK,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AA6DD,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,4DAA4D;AAC5D,UAAU,qBAAqB;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;CACF;AAWD,MAAM,WAAW,sBAAsB;IACtC,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,KAAK,IAAI,IAAI,CAAC;CACd;AAID,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,aAAa,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;CAC/C,GAAG,sBAAsB,CA+GzB"}

package/dist/gateway-api-client/gateway-websocket-client.js

@@ -0,0 +1,140 @@
+function parseGatewayFrame(rawFrame) {
+    const parsed = JSON.parse(rawFrame);
+    if (typeof parsed !== 'object' || parsed === null) {
+        return null;
+    }
+    const candidate = parsed;
+    if (candidate.type !== 'req' && candidate.type !== 'res' && candidate.type !== 'event') {
+        return null;
+    }
+    const errorMessage = typeof candidate.error === 'object' &&
+        candidate.error !== null &&
+        typeof candidate.error.message === 'string'
+        ? candidate.error.message
+        : null;
+    return {
+        type: candidate.type,
+        ...(typeof candidate.id === 'string' ? { id: candidate.id } : {}),
+        ...(typeof candidate.method === 'string' ? { method: candidate.method } : {}),
+        ...(typeof candidate.ok === 'boolean' ? { ok: candidate.ok } : {}),
+        ...('payload' in candidate ? { payload: candidate.payload } : {}),
+        ...(typeof candidate.event === 'string' ? { event: candidate.event } : {}),
+        ...(errorMessage !== null ? { error: { message: errorMessage } } : {}),
+    };
+}
+function isConnectChallengePayload(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.nonce === 'string' &&
+        typeof value.ts === 'number');
+}
+function isConnectHelloOkPayload(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.type === 'hello-ok' &&
+        typeof value.protocol === 'number');
+}
+const DEFAULT_PROTOCOL_VERSION = 3;
+export function createGatewayWebSocketClient(options) {
+    const socket = options.createSocket();
+    const pending = new Map();
+    let nextId = 1;
+    /** Resolves when the connect handshake succeeds. */
+    let resolveConnected;
+    let rejectConnected;
+    const connected = new Promise((resolve, reject) => {
+        resolveConnected = resolve;
+        rejectConnected = reject;
+    });
+    /** Tracks whether the handshake has completed so we can gate outbound requests. */
+    let handshakeComplete = false;
+    socket.addEventListener('message', (event) => {
+        const message = parseGatewayFrame(event.data);
+        if (!message) {
+            return;
+        }
+        // --- Handle the connect.challenge event from the gateway ---
+        if (message.type === 'event' && message.event === 'connect.challenge') {
+            if (!isConnectChallengePayload(message.payload)) {
+                rejectConnected(new Error('Gateway sent invalid connect.challenge payload'));
+                return;
+            }
+            const challengePayload = message.payload;
+            const connectOpts = options.connectOptions;
+            const protocolVersion = connectOpts.protocolVersion ?? DEFAULT_PROTOCOL_VERSION;
+            const connectId = String(nextId);
+            nextId += 1;
+            pending.set(connectId, {
+                resolve: (payload) => {
+                    if (!isConnectHelloOkPayload(payload)) {
+                        rejectConnected(new Error('Gateway sent invalid hello-ok payload'));
+                        return;
+                    }
+                    handshakeComplete = true;
+                    resolveConnected(payload);
+                },
+                reject: (error) => {
+                    rejectConnected(error);
+                },
+            });
+            socket.send(JSON.stringify({
+                type: 'req',
+                id: connectId,
+                method: 'connect',
+                params: {
+                    minProtocol: protocolVersion,
+                    maxProtocol: protocolVersion,
+                    client: {
+                        id: connectOpts.clientId ?? 'agent-vm',
+                        version: connectOpts.clientVersion ?? '0.0.0',
+                        platform: connectOpts.platform ?? 'node',
+                        mode: connectOpts.role ?? 'operator',
+                    },
+                    role: connectOpts.role ?? 'operator',
+                    scopes: connectOpts.scopes ?? ['operator.read', 'operator.write'],
+                    caps: [],
+                    commands: [],
+                    permissions: {},
+                    auth: { token: connectOpts.token },
+                    device: {
+                        nonce: challengePayload.nonce,
+                    },
+                },
+            }));
+            return;
+        }
+        // --- Handle response frames ---
+        if (message.type === 'res' && message.id) {
+            const request = pending.get(message.id);
+            if (request) {
+                pending.delete(message.id);
+                if (message.ok) {
+                    request.resolve(message.payload);
+                }
+                else {
+                    request.reject(new Error(message.error?.message ?? 'Gateway WebSocket request failed'));
+                }
+            }
+        }
+    });
+    function sendRequest(method, params) {
+        const id = String(nextId);
+        nextId += 1;
+        return new Promise((resolve, reject) => {
+            pending.set(id, { resolve, reject });
+            socket.send(JSON.stringify({ type: 'req', id, method, params }));
+        });
+    }
+    return {
+        connected,
+        chatSend: async (params) => {
+            // Wait for the connect handshake to complete before sending requests.
+            if (!handshakeComplete) {
+                await connected;
+            }
+            return await sendRequest('chat.send', params);
+        },
+        close: () => socket.close(),
+    };
+}
+//# sourceMappingURL=gateway-websocket-client.js.map

package/dist/gateway-api-client/gateway-websocket-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-websocket-client.js","sourceRoot":"","sources":["../../src/gateway-api-client/gateway-websocket-client.ts"],"names":[],"mappings":"AA4BA,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAiC,CAAC;IACpD,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,YAAY,GACjB,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;QACnC,SAAS,CAAC,KAAK,KAAK,IAAI;QACxB,OAAQ,SAAS,CAAC,KAA+B,CAAC,OAAO,KAAK,QAAQ;QACrE,CAAC,CAAE,SAAS,CAAC,KAA6B,CAAC,OAAO;QAClD,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACN,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,GAAG,CAAC,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,OAAO,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACH,CAAC;AAQD,SAAS,yBAAyB,CAAC,KAAc;IAChD,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA6B,CAAC,KAAK,KAAK,QAAQ;QACxD,OAAQ,KAA0B,CAAC,EAAE,KAAK,QAAQ,CAClD,CAAC;AACH,CAAC;AAyBD,SAAS,uBAAuB,CAAC,KAAc;IAC9C,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA4B,CAAC,IAAI,KAAK,UAAU;QACjD,OAAQ,KAAgC,CAAC,QAAQ,KAAK,QAAQ,CAC9D,CAAC;AACH,CAAC;AASD,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC,MAAM,UAAU,4BAA4B,CAAC,OAG5C;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAClD,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,oDAAoD;IACpD,IAAI,gBAA0D,CAAC;IAC/D,IAAI,eAAuC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,OAAO,CAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxE,gBAAgB,GAAG,OAAO,CAAC;QAC3B,eAAe,GAAG,MAAM,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,mFAAmF;IACnF,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAuB,EAAE,EAAE;QAC9D,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;QACR,CAAC;QAED,8DAA8D;QAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACvE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,eAAe,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACR,CAAC;YACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YACzC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;YAC3C,MAAM,eAAe,GAAG,WAAW,CAAC,eAAe,IAAI,wBAAwB,CAAC;YAChF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,CAAC;YAEZ,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;gBACtB,OAAO,EAAE,CAAC,OAAgB,EAAE,EAAE;oBAC7B,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;wBACvC,eAAe,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;wBACpE,OAAO;oBACR,CAAC;oBACD,iBAAiB,GAAG,IAAI,CAAC;oBACzB,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;gBACD,MAAM,EAAE,CAAC,KAAY,EAAE,EAAE;oBACxB,eAAe,CAAC,KAAK,CAAC,CAAC;gBACxB,CAAC;aACD,CAAC,CAAC;YAEH,MAAM,CAAC,IAAI,CACV,IAAI,CAAC,SAAS,CAAC;gBACd,IAAI,EAAE,KAAK;gBACX,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE;oBACP,WAAW,EAAE,eAAe;oBAC5B,WAAW,EAAE,eAAe;oBAC5B,MAAM,EAAE;wBACP,EAAE,EAAE,WAAW,CAAC,QAAQ,IAAI,UAAU;wBACtC,OAAO,EAAE,WAAW,CAAC,aAAa,IAAI,OAAO;wBAC7C,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,MAAM;wBACxC,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,UAAU;qBACpC;oBACD,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,UAAU;oBACpC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC;oBACjE,IAAI,EAAE,EAAE;oBACR,QAAQ,EAAE,EAAE;oBACZ,WAAW,EAAE,EAAE;oBACf,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE;oBAClC,MAAM,EAAE;wBACP,KAAK,EAAE,gBAAgB,CAAC,KAAK;qBAC7B;iBACD;aACD,CAAC,CACF,CAAC;YACF,OAAO;QACR,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,kCAAkC,CAAC,CAAC,CAAC;gBACzF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,SAAS,WAAW,CAAC,MAAc,EAAE,MAA+B;QACnE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,CAAC,CAAC;QACZ,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,SAAS;QACT,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1B,sEAAsE;YACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACxB,MAAM,SAAS,CAAC;YACjB,CAAC;YACD,OAAO,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC3B,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+export * from './controller/http/controller-client.js';
+export * from './controller/http/controller-http-routes.js';
+export * from './operations/credentials-refresh.js';
+export * from './operations/config-validation.js';
+export * from './gateway/credential-manager.js';
+export * from './operations/destroy-zone.js';
+export * from './operations/doctor.js';
+export * from './gateway/gateway-zone-orchestrator.js';
+export * from './controller/leases/idle-reaper.js';
+export * from './controller/leases/lease-manager.js';
+export * from './operations/zone-logs.js';
+export * from './operations/controller-status.js';
+export * from './config/system-config.js';
+export * from './config/resource-contracts/index.js';
+export * from './controller/leases/tcp-pool.js';
+export * from './operations/upgrade-zone.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sCAAsC,CAAC;AACrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+export * from './controller/http/controller-client.js';
+export * from './controller/http/controller-http-routes.js';
+export * from './operations/credentials-refresh.js';
+export * from './operations/config-validation.js';
+export * from './gateway/credential-manager.js';
+export * from './operations/destroy-zone.js';
+export * from './operations/doctor.js';
+export * from './gateway/gateway-zone-orchestrator.js';
+export * from './controller/leases/idle-reaper.js';
+export * from './controller/leases/lease-manager.js';
+export * from './operations/zone-logs.js';
+export * from './operations/controller-status.js';
+export * from './config/system-config.js';
+export * from './config/resource-contracts/index.js';
+export * from './controller/leases/tcp-pool.js';
+export * from './operations/upgrade-zone.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sCAAsC,CAAC;AACrD,cAAc,iCAAiC,CAAC;AAChD,cAAc,8BAA8B,CAAC"}

package/dist/operations/config-validation.d.ts

@@ -0,0 +1,15 @@
+import type { LoadedSystemConfig } from '../config/system-config.js';
+export interface ConfigValidationCheck {
+    readonly name: string;
+    readonly ok: boolean;
+    readonly hint?: string;
+}
+export interface ConfigValidationResult {
+    readonly ok: boolean;
+    readonly checks: readonly ConfigValidationCheck[];
+}
+export interface RunConfigValidationOptions {
+    readonly systemConfig: LoadedSystemConfig;
+}
+export declare function runConfigValidation(options: RunConfigValidationOptions): Promise<ConfigValidationResult>;
+//# sourceMappingURL=config-validation.d.ts.map

package/dist/operations/config-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-validation.d.ts","sourceRoot":"","sources":["../../src/operations/config-validation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;CAC1C;AAiJD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,sBAAsB,CAAC,CAsBjC"}

package/dist/operations/config-validation.js

@@ -0,0 +1,126 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { loadWorkerConfig } from '@agent-vm/agent-vm-worker';
+import { loadSystemCacheIdentifier } from '../config/system-cache-identifier.js';
+import { collectVmHostSystemDoctorCheck } from './doctor.js';
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function catalogRootForSystemConfig(systemConfig) {
+    return path.resolve(path.dirname(systemConfig.systemConfigPath), '..');
+}
+function resolveCatalogCheckoutPath(systemConfig, configuredPath) {
+    const runtimeConfigRoot = '/etc/agent-vm';
+    const relativeRuntimePath = path.relative(runtimeConfigRoot, configuredPath);
+    if (!path.isAbsolute(configuredPath) ||
+        relativeRuntimePath.startsWith('..') ||
+        path.isAbsolute(relativeRuntimePath)) {
+        return configuredPath;
+    }
+    const catalogRoot = catalogRootForSystemConfig(systemConfig);
+    if (relativeRuntimePath === 'system.json') {
+        return path.join(catalogRoot, 'config', 'system.json');
+    }
+    if (relativeRuntimePath === 'systemCacheIdentifier.json') {
+        return path.join(catalogRoot, 'config', 'systemCacheIdentifier.json');
+    }
+    if (relativeRuntimePath.startsWith(`gateways${path.sep}`) || relativeRuntimePath === 'gateways') {
+        return path.join(catalogRoot, 'config', relativeRuntimePath);
+    }
+    return path.join(catalogRoot, relativeRuntimePath);
+}
+async function collectReadableFileCheck(name, filePath) {
+    try {
+        await fs.access(filePath);
+        return { name, ok: true, hint: filePath };
+    }
+    catch (error) {
+        return {
+            name,
+            ok: false,
+            hint: `Missing ${filePath}: ${getErrorMessage(error)}`,
+        };
+    }
+}
+async function collectSystemCacheIdentifierCheck(systemConfig) {
+    try {
+        await loadSystemCacheIdentifier({ filePath: systemConfig.systemCacheIdentifierPath });
+        return {
+            name: 'system-cache-identifier',
+            ok: true,
+            hint: systemConfig.systemCacheIdentifierPath,
+        };
+    }
+    catch (error) {
+        return {
+            name: 'system-cache-identifier',
+            ok: false,
+            hint: getErrorMessage(error),
+        };
+    }
+}
+async function collectWorkerConfigCheck(systemConfig, zone) {
+    const workerConfigPath = resolveCatalogCheckoutPath(systemConfig, zone.gateway.config);
+    try {
+        await loadWorkerConfig(workerConfigPath);
+        return {
+            name: `worker-config-${zone.id}`,
+            ok: true,
+            hint: workerConfigPath,
+        };
+    }
+    catch (error) {
+        return {
+            name: `worker-config-${zone.id}`,
+            ok: false,
+            hint: getErrorMessage(error),
+        };
+    }
+}
+async function collectGatewayConfigCheck(systemConfig, zone) {
+    const gatewayConfigPath = resolveCatalogCheckoutPath(systemConfig, zone.gateway.config);
+    return await collectReadableFileCheck(`gateway-config-${zone.id}`, gatewayConfigPath);
+}
+async function collectGatewayImageProfileChecks(systemConfig) {
+    const pendingChecks = [];
+    for (const [profileName, profile] of Object.entries(systemConfig.imageProfiles.gateways)) {
+        const buildConfigPath = resolveCatalogCheckoutPath(systemConfig, profile.buildConfig);
+        pendingChecks.push(collectReadableFileCheck(`gateway-${profileName}-build-config`, buildConfigPath));
+        if (profile.dockerfile) {
+            pendingChecks.push(collectReadableFileCheck(`gateway-${profileName}-dockerfile`, resolveCatalogCheckoutPath(systemConfig, profile.dockerfile)));
+        }
+    }
+    const checks = await Promise.all(pendingChecks);
+    return checks;
+}
+async function collectToolImageProfileChecks(systemConfig) {
+    const pendingChecks = [];
+    for (const [profileName, profile] of Object.entries(systemConfig.imageProfiles.toolVms)) {
+        const buildConfigPath = resolveCatalogCheckoutPath(systemConfig, profile.buildConfig);
+        pendingChecks.push(collectReadableFileCheck(`tool-vm-${profileName}-build-config`, buildConfigPath));
+        if (profile.dockerfile) {
+            pendingChecks.push(collectReadableFileCheck(`tool-vm-${profileName}-dockerfile`, resolveCatalogCheckoutPath(systemConfig, profile.dockerfile)));
+        }
+    }
+    const checks = await Promise.all(pendingChecks);
+    return checks;
+}
+export async function runConfigValidation(options) {
+    const systemConfig = options.systemConfig;
+    const zoneConfigChecks = await Promise.all(systemConfig.zones.map(async (zone) => zone.gateway.type === 'worker'
+        ? await collectWorkerConfigCheck(systemConfig, zone)
+        : await collectGatewayConfigCheck(systemConfig, zone)));
+    const vmHostSystemCheck = await collectVmHostSystemDoctorCheck(systemConfig);
+    const checks = [
+        await collectSystemCacheIdentifierCheck(systemConfig),
+        ...(await collectGatewayImageProfileChecks(systemConfig)),
+        ...(await collectToolImageProfileChecks(systemConfig)),
+        ...(vmHostSystemCheck ? [vmHostSystemCheck] : []),
+        ...zoneConfigChecks,
+    ];
+    return {
+        ok: checks.every((check) => check.ok),
+        checks,
+    };
+}
+//# sourceMappingURL=config-validation.js.map

package/dist/operations/config-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-validation.js","sourceRoot":"","sources":["../../src/operations/config-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAiB7D,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAgC;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,0BAA0B,CAClC,YAAgC,EAChC,cAAsB;IAEtB,MAAM,iBAAiB,GAAG,eAAe,CAAC;IAC1C,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IAC7E,IACC,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAChC,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EACnC,CAAC;QACF,OAAO,cAAc,CAAC;IACvB,CAAC;IAED,MAAM,WAAW,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,mBAAmB,KAAK,aAAa,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,mBAAmB,KAAK,4BAA4B,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,mBAAmB,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,KAAK,UAAU,EAAE,CAAC;QACjG,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,IAAY,EACZ,QAAgB;IAEhB,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,IAAI;YACJ,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,WAAW,QAAQ,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE;SACtD,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC/C,YAAgC;IAEhC,IAAI,CAAC;QACJ,MAAM,yBAAyB,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,yBAAyB,EAAE,CAAC,CAAC;QACtF,OAAO;YACN,IAAI,EAAE,yBAAyB;YAC/B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,YAAY,CAAC,yBAAyB;SAC5C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,IAAI,EAAE,yBAAyB;YAC/B,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC;SAC5B,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,YAAgC,EAChC,IAAyC;IAEzC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC;QACJ,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACzC,OAAO;YACN,IAAI,EAAE,iBAAiB,IAAI,CAAC,EAAE,EAAE;YAChC,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,gBAAgB;SACtB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,IAAI,EAAE,iBAAiB,IAAI,CAAC,EAAE,EAAE;YAChC,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC;SAC5B,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,yBAAyB,CACvC,YAAgC,EAChC,IAAyC;IAEzC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxF,OAAO,MAAM,wBAAwB,CAAC,kBAAkB,IAAI,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC9C,YAAgC;IAEhC,MAAM,aAAa,GAAqC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1F,MAAM,eAAe,GAAG,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtF,aAAa,CAAC,IAAI,CACjB,wBAAwB,CAAC,WAAW,WAAW,eAAe,EAAE,eAAe,CAAC,CAChF,CAAC;QACF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CACjB,wBAAwB,CACvB,WAAW,WAAW,aAAa,EACnC,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAC5D,CACD,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC3C,YAAgC;IAEhC,MAAM,aAAa,GAAqC,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,MAAM,eAAe,GAAG,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtF,aAAa,CAAC,IAAI,CACjB,wBAAwB,CAAC,WAAW,WAAW,eAAe,EAAE,eAAe,CAAC,CAChF,CAAC;QACF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CACjB,wBAAwB,CACvB,WAAW,WAAW,aAAa,EACnC,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAC5D,CACD,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmC;IAEnC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACzC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;QAC7B,CAAC,CAAC,MAAM,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC;QACpD,CAAC,CAAC,MAAM,yBAAyB,CAAC,YAAY,EAAE,IAAI,CAAC,CACtD,CACD,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,8BAA8B,CAAC,YAAY,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG;QACd,MAAM,iCAAiC,CAAC,YAAY,CAAC;QACrD,GAAG,CAAC,MAAM,gCAAgC,CAAC,YAAY,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACtD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,gBAAgB;KACiC,CAAC;IAEtD,OAAO;QACN,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM;KACN,CAAC;AACH,CAAC"}

package/dist/operations/controller-status.d.ts

@@ -0,0 +1,13 @@
+import type { SystemConfig } from '../config/system-config.js';
+export interface ControllerStatusSummary {
+    readonly controllerPort: number;
+    readonly toolProfiles: string[];
+    readonly zones: {
+        readonly gatewayType: SystemConfig['zones'][number]['gateway']['type'];
+        readonly id: string;
+        readonly ingressPort: number;
+        readonly toolProfile?: string;
+    }[];
+}
+export declare function buildControllerStatus(systemConfig: SystemConfig): ControllerStatusSummary;
+//# sourceMappingURL=controller-status.d.ts.map

package/dist/operations/controller-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-status.d.ts","sourceRoot":"","sources":["../../src/operations/controller-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QACvE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC9B,EAAE,CAAC;CACJ;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,YAAY,GAAG,uBAAuB,CAWzF"}

package/dist/operations/controller-status.js

@@ -0,0 +1,13 @@
+export function buildControllerStatus(systemConfig) {
+    return {
+        controllerPort: systemConfig.host.controllerPort,
+        toolProfiles: Object.keys(systemConfig.toolProfiles),
+        zones: systemConfig.zones.map((zone) => ({
+            gatewayType: zone.gateway.type,
+            id: zone.id,
+            ingressPort: zone.gateway.port,
+            ...(zone.toolProfile ? { toolProfile: zone.toolProfile } : {}),
+        })),
+    };
+}
+//# sourceMappingURL=controller-status.js.map

package/dist/operations/controller-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-status.js","sourceRoot":"","sources":["../../src/operations/controller-status.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,qBAAqB,CAAC,YAA0B;IAC/D,OAAO;QACN,cAAc,EAAE,YAAY,CAAC,IAAI,CAAC,cAAc;QAChD,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;QACpD,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACxC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC9B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;KACH,CAAC;AACH,CAAC"}

package/dist/operations/credentials-refresh.d.ts

@@ -0,0 +1,10 @@
+export declare function runControllerCredentialsRefresh(options: {
+    readonly zoneId: string;
+}, dependencies: {
+    readonly refreshZoneSecrets: (zoneId: string) => Promise<void>;
+    readonly restartGatewayZone: (zoneId: string) => Promise<void>;
+}): Promise<{
+    readonly ok: true;
+    readonly zoneId: string;
+}>;
+//# sourceMappingURL=credentials-refresh.d.ts.map