@agent-vm/gateway-interface 0.0.58 → 0.0.60

package/dist/index.d.ts

@@ -1,49 +1,23 @@
+import { SecretResolver, SecretSpec, VfsMountSpec } from "@agent-vm/gondolin-adapter";
+
 //#region src/gateway-runtime-contract.d.ts
 declare const gatewayTypeValues: readonly ["openclaw", "worker"];
 type GatewayType = (typeof gatewayTypeValues)[number];
 declare function buildGatewaySessionLabel(projectNamespace: string, zoneId: string): string;
 declare function buildToolSessionLabel(projectNamespace: string, zoneId: string, tcpSlot: number): string;
 //#endregion
-//#region ../gondolin-adapter/dist/index.d.ts
-
-//#endregion
-//#region src/pinned-realfs.d.ts
-interface PinnedRealFsRoot {
-  readonly hostPath: string;
-  readonly realPath: string;
-  readonly fd: number;
-  readonly device: number;
-  readonly inode: number;
-}
-//#endregion
-//#region src/types.d.ts
-interface SecretSpec {
-  readonly hosts: readonly string[];
-  readonly value: string;
-}
-type SecretRef = {
-  readonly source: '1password';
-  readonly ref: string;
-} | {
-  readonly source: 'environment';
-  readonly ref: string;
-};
-//#endregion
-//#region src/secret-resolver.d.ts
-
-interface SecretResolver {
-  resolve(ref: SecretRef): Promise<string>;
-  resolveAll(refs: Record<string, SecretRef>): Promise<Record<string, string>>;
-}
-interface VfsMountSpec {
-  readonly kind: 'realfs' | 'realfs-readonly' | 'memory' | 'shadow';
-  readonly hostPath?: string;
-  readonly pinnedHostRoot?: PinnedRealFsRoot;
-  readonly shadowConfig?: {
-    readonly deny: readonly string[];
-    readonly tmpfs: readonly string[];
-  };
-}
+//#region src/audience.d.ts
+declare const vmAudienceValues: readonly ["gateway", "tool-vm", "both"];
+type VmAudience = (typeof vmAudienceValues)[number];
+type RuntimeVmAudience = Exclude<VmAudience, 'both'>;
+interface EgressHostConfig {
+  readonly host: string;
+  readonly audience: VmAudience;
+}
+declare const controllerVmHost = "controller.vm.host";
+declare function targetsAudience(configAudience: VmAudience, runtimeAudience: RuntimeVmAudience): boolean;
+declare function egressHostsForAudience(egressHosts: readonly EgressHostConfig[], runtimeAudience: RuntimeVmAudience): readonly string[];
+declare function gatewayVmAllowedHosts(egressHosts: readonly EgressHostConfig[]): readonly string[];
 //#endregion
 //#region src/gateway-process-spec.d.ts
 type GatewayHealthCheck = {
@@ -135,30 +109,54 @@ interface WorkerGatewayZoneGatewayConfig extends GatewayZoneBaseGatewayConfig {
   readonly type: 'worker';
 }
 type GatewayZoneGatewayConfig = OpenClawGatewayZoneGatewayConfig | WorkerGatewayZoneGatewayConfig;
+interface OnePasswordSecretSourceConfig {
+  readonly source: '1password';
+  readonly ref: string;
+}
+interface EnvironmentSecretSourceConfig {
+  readonly source: 'environment';
+  readonly envVar: string;
+}
+type SecretSourceConfig = OnePasswordSecretSourceConfig | EnvironmentSecretSourceConfig;
+type EnvInjectedGatewaySecretConfig = SecretSourceConfig & {
+  readonly audience: 'gateway';
+  readonly injection: 'env';
+};
+type HttpMediatedGatewaySecretConfig = SecretSourceConfig & {
+  readonly audience: VmAudience;
+  readonly injection: 'http-mediation';
+  readonly hosts: readonly string[];
+};
+type GatewaySecretConfig = EnvInjectedGatewaySecretConfig | HttpMediatedGatewaySecretConfig;
 /**
  * Zone config as the lifecycle sees it.
  * Decoupled from SystemConfig — the controller maps into this shape.
  */
 interface GatewayZoneConfig {
   readonly id: string;
+  readonly agents?: readonly GatewayZoneAgentConfig[];
   readonly gateway: GatewayZoneGatewayConfig;
+  readonly mcp?: GatewayZoneMcpPortalConfig;
+  readonly runtimeMcpServers?: Readonly<Record<string, GatewayZoneMcpServerConfig>>;
   readonly runtimeEnvironment?: Readonly<Record<string, string>>;
   readonly runtimePluginConfigs?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
-  readonly secrets: Record<string, {
-    readonly source: '1password';
-    readonly ref: string;
-    readonly injection: 'env' | 'http-mediation';
-    readonly hosts?: readonly string[] | undefined;
-  } | {
-    readonly source: 'environment';
-    readonly envVar: string;
-    readonly injection: 'env' | 'http-mediation';
-    readonly hosts?: readonly string[] | undefined;
-  }>;
-  readonly allowedHosts: readonly string[];
+  readonly secrets: Readonly<Record<string, GatewaySecretConfig>>;
+  readonly egressHosts: readonly EgressHostConfig[];
   readonly websocketBypass: readonly string[];
   readonly defaultToolVmProfile?: string;
 }
+interface GatewayZoneAgentConfig {
+  readonly id: string;
+  readonly toolVmProfile?: string | undefined;
+}
+interface GatewayZoneMcpPortalConfig {
+  readonly configDir: string;
+}
+interface GatewayZoneMcpServerConfig {
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly transport: 'streamable-http';
+  readonly url: string;
+}
 interface BuildGatewayVmSpecOptions {
   readonly controllerPort: number;
   readonly gatewayCacheDir: string;
@@ -195,11 +193,18 @@ interface GatewayLifecycle {
 }
 //#endregion
 //#region src/split-resolved-gateway-secrets.d.ts
-interface SplitResolvedGatewaySecretsResult {
+interface SplitResolvedSecretsResult {
   readonly environmentSecrets: Record<string, string>;
   readonly mediatedSecrets: Record<string, SecretSpec>;
 }
+type SecretInjectionConfig = GatewaySecretConfig;
+interface SplitResolvedSecretsOptions {
+  readonly audience: RuntimeVmAudience;
+  readonly logPrefix?: string;
+}
+declare function splitResolvedSecretsByInjection(secretConfigs: Readonly<Record<string, SecretInjectionConfig>>, resolvedSecrets: Record<string, string>, options: SplitResolvedSecretsOptions): SplitResolvedSecretsResult;
+type SplitResolvedGatewaySecretsResult = SplitResolvedSecretsResult;
 declare function splitResolvedGatewaySecrets(zone: GatewayZoneConfig, resolvedSecrets: Record<string, string>): SplitResolvedGatewaySecretsResult;
 //#endregion
-export { type BuildGatewayVmSpecOptions, type GatewayAuthConfig, type GatewayHealthCheck, type GatewayLifecycle, type GatewayProcessSpec, type GatewayType, type GatewayVmSpec, type GatewayZoneConfig, type SplitResolvedGatewaySecretsResult, buildGatewaySessionLabel, buildToolSessionLabel, gatewayTypeValues, splitResolvedGatewaySecrets };
+export { type BuildGatewayVmSpecOptions, type EgressHostConfig, type EnvInjectedGatewaySecretConfig, type GatewayAuthConfig, type GatewayHealthCheck, type GatewayLifecycle, type GatewayProcessSpec, type GatewaySecretConfig, type GatewayType, type GatewayVmSpec, type GatewayZoneAgentConfig, type GatewayZoneConfig, type GatewayZoneMcpPortalConfig, type HttpMediatedGatewaySecretConfig, type RuntimeVmAudience, type SecretInjectionConfig, type SplitResolvedGatewaySecretsResult, type SplitResolvedSecretsResult, type VmAudience, buildGatewaySessionLabel, buildToolSessionLabel, controllerVmHost, egressHostsForAudience, gatewayTypeValues, gatewayVmAllowedHosts, splitResolvedGatewaySecrets, splitResolvedSecretsByInjection, targetsAudience, vmAudienceValues };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":["BuildConfig","BuildConfig$1","CreateHttpHooksResult","EnableIngressOptions","EnableSshOptions","IngressRoute","IngressRoute$1","ShadowPredicate","ShadowProviderOptions","VMOptions","VirtualProvider","getDefaultBuildConfig","BuildImageOptions","BuildOutput","Uint8Array","BuildImageResult","buildImageAssetFileNames","BuildPipelineDependencies","Promise","hasBuiltImageAssets","computeBuildFingerprint","computeEffectiveBuildFingerprint","buildImage","parseMinimumZigVersion","resolveGondolinPackageJsonPath","resolveGondolinPackageSpec","ResolveGondolinMinimumZigVersionOptions","resolveGondolinMinimumZigVersion","WritableMountPolicy","RuntimeMountPolicyConfig","Record","Readonly","resolveGuestMountPath","validateWritableMount","validateRuntimeMountPolicy","PinnedRealFsRoot","CreatePinnedRealFsProviderOptions","pinRealFsRoot","closePinnedRealFsRoot","assertPinnedRealFsRoot","createPinnedRealFsProvider","PolicySources","normalizeHostname","dedupeStable","compilePolicy","SecretSpec","SecretRef","SecretResolverClient","SecretResolver","TokenSource","ExecFileOptions","ExecFileResult","resolveServiceAccountToken","CreateSecretResolverDependencies","createSecretResolver","createOpCliSecretResolver","Pick","SYNTHETIC_DNS_IPV4_BENCHMARK","SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK","ExecResult","SshAccess","IngressAccess","ManagedVmInstance","ManagedVmDependencies","Request","Response","VfsMountSpec","CreateVmOptions","ManagedVm","createManagedVm","VolumeConfigEntry","ResolvedVolume","ensureVolumeDir","resolveVolumeDirs","writeFileAtomically"],"sources":["../src/gateway-runtime-contract.ts","../../gondolin-adapter/dist/index.d.ts","../src/gateway-process-spec.ts","../src/gateway-vm-spec.ts","../src/gateway-lifecycle.ts","../src/split-resolved-gateway-secrets.ts"],"sourcesContent":["import { BuildConfig, BuildConfig as BuildConfig$1, CreateHttpHooksResult, EnableIngressOptions, EnableSshOptions, IngressRoute as IngressRoute$1, ShadowPredicate, ShadowProviderOptions, VMOptions, VirtualProvider, getDefaultBuildConfig } from \"@earendil-works/gondolin\";\n\n//#region src/build-pipeline.d.ts\ninterface BuildImageOptions {\n  readonly buildConfig: BuildConfig$1;\n  readonly cacheDir: string;\n  /** Directory to resolve relative paths in buildConfig (e.g. postBuild.copy.src).\n   *  Defaults to process.cwd() if not provided. */\n  readonly configDir?: string;\n  readonly fullReset?: boolean;\n  readonly fingerprintInput?: unknown;\n  readonly output?: BuildOutput;\n}\ninterface BuildOutput {\n  write(chunk: string | Uint8Array): boolean;\n}\ninterface BuildImageResult {\n  readonly built: boolean;\n  readonly fingerprint: string;\n  readonly imagePath: string;\n}\ndeclare const buildImageAssetFileNames: readonly [\"manifest.json\", \"rootfs.ext4\", \"initramfs.cpio.lz4\", \"vmlinuz-virt\"];\ninterface BuildPipelineDependencies {\n  readonly buildAssets?: (buildConfig: BuildConfig$1, outputDirectory: string, configDir?: string) => Promise<unknown>;\n  readonly gondolinVersion?: string;\n}\ndeclare function hasBuiltImageAssets(outputDirectoryPath: string): Promise<boolean>;\ndeclare function computeBuildFingerprint(buildConfig: BuildConfig$1, gondolinVersion?: string, fingerprintInput?: unknown): string;\ndeclare function computeEffectiveBuildFingerprint(options: {\n  readonly buildConfig: BuildConfig$1;\n  readonly configDir?: string;\n  readonly fingerprintInput?: unknown;\n  readonly gondolinVersion?: string;\n}): Promise<{\n  readonly fingerprint: string;\n  readonly rootfsInitExtraContent: string;\n}>;\ndeclare function buildImage(options: BuildImageOptions, dependencies?: BuildPipelineDependencies): Promise<BuildImageResult>;\n//#endregion\n//#region src/gondolin-package.d.ts\ndeclare function parseMinimumZigVersion(rawContents: string): string;\ndeclare function resolveGondolinPackageJsonPath(): string;\ndeclare function resolveGondolinPackageSpec(): Promise<string>;\ninterface ResolveGondolinMinimumZigVersionOptions {\n  readonly buildZigZonPath?: string;\n}\ndeclare function resolveGondolinMinimumZigVersion(options?: ResolveGondolinMinimumZigVersionOptions): Promise<string>;\n//#endregion\n//#region src/mount-policy.d.ts\ninterface WritableMountPolicy {\n  readonly allowAuthWrite: boolean;\n  readonly writableAllowedGuestPrefixes: readonly string[];\n}\ninterface RuntimeMountPolicyConfig {\n  readonly extraMounts: Readonly<Record<string, string>>;\n  readonly mountControls: WritableMountPolicy;\n}\ndeclare function resolveGuestMountPath(guestPath: string, workDir: string): string;\ndeclare function validateWritableMount(guestPath: string, policy: WritableMountPolicy, options: {\n  readonly workDir: string;\n}): void;\ndeclare function validateRuntimeMountPolicy(config: RuntimeMountPolicyConfig, options: {\n  readonly hostHome: string;\n  readonly workDir: string;\n}): Promise<void>;\n//#endregion\n//#region src/pinned-realfs.d.ts\ninterface PinnedRealFsRoot {\n  readonly hostPath: string;\n  readonly realPath: string;\n  readonly fd: number;\n  readonly device: number;\n  readonly inode: number;\n}\ninterface CreatePinnedRealFsProviderOptions {\n  readonly root: PinnedRealFsRoot;\n  readonly createRealFsProvider: (hostPath: string) => VirtualProvider;\n}\ndeclare function pinRealFsRoot(hostPath: string): PinnedRealFsRoot;\ndeclare function closePinnedRealFsRoot(root: PinnedRealFsRoot): void;\ndeclare function assertPinnedRealFsRoot(root: PinnedRealFsRoot): void;\ndeclare function createPinnedRealFsProvider(options: CreatePinnedRealFsProviderOptions): VirtualProvider;\n//#endregion\n//#region src/policy-compiler.d.ts\ninterface PolicySources {\n  readonly base: readonly string[];\n  readonly profile: readonly string[];\n  readonly extra: readonly string[];\n}\ndeclare function normalizeHostname(rawHostname: string): string;\ndeclare function dedupeStable(values: readonly string[]): string[];\ndeclare function compilePolicy(sources: PolicySources): string[];\n//#endregion\n//#region src/types.d.ts\ninterface SecretSpec {\n  readonly hosts: readonly string[];\n  readonly value: string;\n}\ntype SecretRef = {\n  readonly source: '1password';\n  readonly ref: string;\n} | {\n  readonly source: 'environment';\n  readonly ref: string;\n};\n//#endregion\n//#region src/secret-resolver.d.ts\ninterface SecretResolverClient {\n  readonly secrets: {\n    resolve(secretReference: string): Promise<string>;\n    resolveAll(secretReferences: readonly string[]): Promise<unknown>;\n  };\n}\ninterface SecretResolver {\n  resolve(ref: SecretRef): Promise<string>;\n  resolveAll(refs: Record<string, SecretRef>): Promise<Record<string, string>>;\n}\ntype TokenSource = {\n  readonly type: 'op-cli';\n  readonly ref: string;\n} | {\n  readonly type: 'env';\n  readonly envVar?: string | undefined;\n} | {\n  readonly type: 'keychain';\n  readonly service: string;\n  readonly account: string;\n};\ninterface ExecFileOptions {\n  readonly env?: Readonly<Record<string, string | undefined>>;\n}\ninterface ExecFileResult {\n  readonly stdout: string;\n  readonly stderr: string;\n}\ndeclare function resolveServiceAccountToken(source: TokenSource, dependencies?: {\n  readonly execFileAsync?: (command: string, args: readonly string[], options?: ExecFileOptions) => Promise<ExecFileResult>;\n}): Promise<string>;\ninterface CreateSecretResolverDependencies {\n  readonly createClient?: (config: {\n    auth: string;\n    integrationName: string;\n    integrationVersion: string;\n  }) => Promise<SecretResolverClient>;\n  readonly execFileAsync?: (command: string, args: readonly string[], options?: ExecFileOptions) => Promise<ExecFileResult>;\n  readonly integrationName?: string;\n  readonly integrationVersion?: string;\n}\ndeclare function createSecretResolver(options: {\n  readonly serviceAccountToken: string;\n}, dependencies?: CreateSecretResolverDependencies): Promise<SecretResolver>;\ndeclare function createOpCliSecretResolver(options: {\n  readonly serviceAccountToken: string;\n}, dependencies?: Pick<CreateSecretResolverDependencies, 'execFileAsync'>): Promise<SecretResolver>;\n//#endregion\n//#region src/vm-adapter.d.ts\ndeclare const SYNTHETIC_DNS_IPV4_BENCHMARK = \"198.18.0.1\";\ndeclare const SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK = \"::ffff:198.18.0.1\";\ninterface ExecResult {\n  readonly exitCode: number;\n  readonly stdout: string;\n  readonly stderr: string;\n}\ntype IngressRoute = IngressRoute$1;\ninterface SshAccess {\n  readonly host: string;\n  readonly command?: string;\n  readonly identityFile?: string;\n  readonly port: number;\n  readonly user?: string;\n}\ninterface IngressAccess {\n  readonly host: string;\n  readonly port: number;\n}\ninterface ManagedVmInstance {\n  readonly id: string;\n  exec(command: string): Promise<{\n    readonly exitCode: number;\n    readonly stdout?: string;\n    readonly stderr?: string;\n  }>;\n  enableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n  enableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n  setIngressRoutes(routes: readonly IngressRoute[]): void;\n  close(): Promise<void>;\n}\ninterface ManagedVmDependencies {\n  createVm(vmOptions: VMOptions): Promise<ManagedVmInstance>;\n  createHttpHooks(options: {\n    readonly allowedHosts: readonly string[];\n    readonly secrets: Record<string, SecretSpec>;\n    readonly onRequest?: (request: Request) => Promise<Request | Response | void>;\n    readonly onResponse?: (response: Response) => Promise<Response | void>;\n  }): Pick<CreateHttpHooksResult, 'env' | 'httpHooks'>;\n  closePinnedRealFsRoot(root: PinnedRealFsRoot): void;\n  createPinnedRealFsProvider(root: PinnedRealFsRoot): VirtualProvider;\n  createRealFsProvider(hostPath: string): VirtualProvider;\n  createReadonlyProvider(provider: VirtualProvider): VirtualProvider;\n  createMemoryProvider(): VirtualProvider;\n  createShadowProvider(provider: VirtualProvider, options: ShadowProviderOptions): VirtualProvider;\n  createShadowPathPredicate(paths: readonly string[]): ShadowPredicate;\n}\ninterface VfsMountSpec {\n  readonly kind: 'realfs' | 'realfs-readonly' | 'memory' | 'shadow';\n  readonly hostPath?: string;\n  readonly pinnedHostRoot?: PinnedRealFsRoot;\n  readonly shadowConfig?: {\n    readonly deny: readonly string[];\n    readonly tmpfs: readonly string[];\n  };\n}\ninterface CreateVmOptions {\n  readonly imagePath: string;\n  readonly memory: string;\n  readonly cpus: number;\n  readonly rootfsMode: 'readonly' | 'memory' | 'cow';\n  readonly allowedHosts: readonly string[];\n  readonly secrets: Record<string, SecretSpec>;\n  readonly vfsMounts: Record<string, VfsMountSpec>;\n  readonly tcpHosts?: Record<string, string>;\n  readonly env?: Record<string, string>;\n  readonly sessionLabel?: string;\n  readonly onRequest?: (request: Request) => Promise<Request | Response | void>;\n  readonly onResponse?: (response: Response) => Promise<Response | void>;\n}\ninterface ManagedVm {\n  readonly id: string;\n  exec(command: string): Promise<ExecResult>;\n  enableSsh(options?: EnableSshOptions): Promise<SshAccess>;\n  enableIngress(options?: EnableIngressOptions): Promise<IngressAccess>;\n  getVmInstance(): ManagedVmInstance;\n  setIngressRoutes(routes: readonly IngressRoute[]): void;\n  close(): Promise<void>;\n}\ndeclare function createManagedVm(options: CreateVmOptions, dependencies?: ManagedVmDependencies): Promise<ManagedVm>;\n//#endregion\n//#region src/volume-manager.d.ts\ninterface VolumeConfigEntry {\n  readonly guestPath: string;\n}\ninterface ResolvedVolume {\n  readonly hostDir: string;\n  readonly guestPath: string;\n}\ndeclare function ensureVolumeDir(cacheBase: string, workspaceHash: string, volumeName: string): Promise<string>;\ndeclare function resolveVolumeDirs(cacheBase: string, workspaceHash: string, volumes: Readonly<Record<string, VolumeConfigEntry>>): Promise<Record<string, ResolvedVolume>>;\n//#endregion\n//#region src/write-file-atomically.d.ts\ndeclare function writeFileAtomically(filePath: string, content: string, options?: {\n  readonly mode?: number;\n}): Promise<void>;\n//#endregion\nexport { type BuildConfig, BuildImageOptions, BuildImageResult, BuildOutput, CreatePinnedRealFsProviderOptions, CreateSecretResolverDependencies, CreateVmOptions, ExecFileOptions, ExecFileResult, ExecResult, IngressAccess, IngressRoute, ManagedVm, ManagedVmDependencies, ManagedVmInstance, PinnedRealFsRoot, PolicySources, ResolveGondolinMinimumZigVersionOptions, ResolvedVolume, RuntimeMountPolicyConfig, SYNTHETIC_DNS_IPV4_BENCHMARK, SYNTHETIC_DNS_IPV6_IPV4_MAPPED_BENCHMARK, SecretRef, SecretResolver, SecretResolverClient, SecretSpec, SshAccess, TokenSource, VfsMountSpec, VolumeConfigEntry, WritableMountPolicy, assertPinnedRealFsRoot, buildImage, buildImageAssetFileNames, closePinnedRealFsRoot, compilePolicy, computeBuildFingerprint, computeEffectiveBuildFingerprint, createManagedVm, createOpCliSecretResolver, createPinnedRealFsProvider, createSecretResolver, dedupeStable, ensureVolumeDir, getDefaultBuildConfig, hasBuiltImageAssets, normalizeHostname, parseMinimumZigVersion, pinRealFsRoot, resolveGondolinMinimumZigVersion, resolveGondolinPackageJsonPath, resolveGondolinPackageSpec, resolveGuestMountPath, resolveServiceAccountToken, resolveVolumeDirs, validateRuntimeMountPolicy, validateWritableMount, writeFileAtomically };\n//# sourceMappingURL=index.d.ts.map"],"mappings":";cAAa;AAAA,KAED,WAAA,GAFoD,CAAA,OAE9B,iBAF8B,CAAA,CAAA,MAAA,CAAA;AAEpD,iBAEI,wBAAA,CAFmC,gBAAA,EAAA,MAAA,EAAA,MAAA,EAAA,MAAA,CAAA,EAAA,MAAA;AAEnC,iBAIA,qBAAA,CAJwB,gBAAA,EAAA,MAAA,EAAA,MAAA,EAAA,MAAA,EAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA;;;;;;UC+D9BmC,gBAAAA,CGmBuB;EACd,SAAA,QAAA,EAAA,MAAA;EAAM,SAAA,QAAA,EAAA,MAAA;EAoBzB,SAAiB,EAAA,EAAA,MAAA;EAajB,SAAiB,MAAA,EAAA,MAAgB;EAKV,SAAA,KAAA,EAAA,MAAA;;;;UH/BbU,UAAAA,CIlF0B;;;;KJsF/BC,SAAAA;;;;;;;;;;UAeKE,cAAAA;eACKF,YAAY5B;mBACRY,eAAegB,aAAa5B,QAAQY;;UAwF7CoC,YAAAA;;;4BAGkB/B;;;;;;;;KC9MhB,kBAAA;EFAC,SAAA,IAAA,EAAA,MAAmD;EAEpD,SAAA,IAAA,EAAW,MAAA;EAEP,SAAA,IAAA,EAAA,MAAA;AAIhB,CAAA,GAAgB;;;;ACwDL;AA2B0C;AAGjC;AAgBwC;AAI7CW,UC1GE,kBAAA,CD0GFA;EAAY5B,SAAAA,gBAAAA,EAAAA,MAAAA;EACO4B,SAAAA,YAAAA,EAAAA,MAAAA;EAAfhB,SAAAA,WAAAA,ECxGI,kBDwGJA;EAAoCA,SAAAA,eAAAA,EAAAA,MAAAA;EAARZ,SAAAA,OAAAA,EAAAA,MAAAA;;;;ADnH/C;AAEA;AAEA;AAIA;UGFiB,aAAA;wBACM;sBACF,eAAe;EF2D1BiB,SAAAA,eAAgB,EE1DC,MF0DD,CAAA,MAAA,EE1DgB,UF0DhB,CAAA;EA2BhBU,SAAAA,QAAU,EEpFA,MFoFA,CAAA,MAAA,EAAA,MAAA,CAAA;EAIfC,SAAAA,YAAS,EAAA,SAAA,MAAA,EAAA;EAeJE,SAAAA,UAAc,EAAA,UAAA,GAAA,QAAA,GAAA,KAAA;EACTF,SAAAA,YAAAA,EAAAA,MAAAA;;;;AD1Gf;;;;AC2DUX,UGzDO,iBAAA,CHyDS;EA2BhBU;AAAU;AAgBwC;;EAIjC3B,SAAAA,oBAAAA,EAAAA,MAAAA;EACO4B;;;;EAAoB,SAAA,iBAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,QAAA,EAAA;IAwF5CoB,SAAAA,UAAY,CAAA,EAAA,OAGM/B;;;;AC9M5B,UE8BU,sBAAA,CF9BoB;EAQb,SAAA,MAAA,EAAA,WAAkB,GAAA,aAGZ;;UEuBb,iCAAA,SAA0C;;ED5BnC,SAAA,GAAA,EAAA,MAAa;;UCiCpB,iCAAA,SAA0C,sBD/BhB,CAAA;EAAf,SAAA,MAAA,EAAA,aAAA;EACqB,SAAA,MAAA,EAAA,MAAA;;AACtB,KCkCR,uBAAA,GDlCQ,QAAA,GAAA,UAAA,GAAA,OAAA;AAAM,UCoCT,gBAAA,CDpCS;sBCqCL;;UAGX,4BAAA;EAxCO,SAAA,IAAA,EAyCD,WAzCkB;EAoBxB,SAAA,MAAA,EAAA,MAAA;EAIA,SAAA,IAAA,EAAA,MAAA;EAKA,SAAA,IAAA,EAAA,MAAA;EAKE,SAAA,MAAA,EAAA,MAAA;EAEK,SAAA,QAAA,EAAgB,MAAA;EAIvB,SAAA,GAAA,EAOK,gBAPL;EACM,SAAA,eAAA,CAAA,EAQZ,iCARY,GASZ,iCATY,GAAA,SAAA;;UAaN,gCAAA,SAAyC,4BAL/C,CAAA;EACA,SAAA,IAAA,EAAA,UAAA;EAAiC,SAAA,YAAA,EAAA,MAAA;EAI3B,SAAA,mBAAA,CAAA,EAGsB,QAHW,CAIzC,MAJyC,CAAA,MAAA,EAI1B,iCAJ0B,GAIU,iCAJV,CAAA,CAAA;;UAQjC,8BAAA,SAAuC,4BAJI,CAAA;EAAnD,SAAA,IAAA,EAAA,QAAA;;KAQG,wBAAA,GAA2B,gCAZmB,GAYgB,8BAZhB;;AAA4B;AAQF;AAU7E;AAEmB,UAFF,iBAAA,CAEE;EACqB,SAAA,EAAA,EAAA,MAAA;EAAT,SAAA,OAAA,EADZ,wBACY;EACmC,SAAA,kBAAA,CAAA,EADnC,QACmC,CAD1B,MAC0B,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EAAT,SAAA,oBAAA,CAAA,EAAxB,QAAwB,CAAf,MAAe,CAAA,MAAA,EAAA,QAAA,CAAS,MAAT,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA,CAAA,CAAA;EAAf,SAAA,OAAA,EACvB,MADuB,CAAA,MAAA,EAAA;IAAT,SAAA,MAAA,EAAA,WAAA;IACd,SAAA,GAAA,EAAA,MAAA;IAAM,SAAA,SAAA,EAAA,KAAA,GAAA,gBAAA;IAoBR,SAAA,KAAA,CAAA,EAAA,SAAyB,MAAA,EAAA,GAIf,SAMX;EAGC,CAAA,GAAA;IAKM,SAAA,MAAA,EAAA,aAAA;IAMD,SAAA,MAAA,EAAA,MAAA;IAA4B,SAAA,SAAA,EAAA,KAAA,GAAA,gBAAA;IAO1C,SAAA,KAAA,CAAA,EAAA,SAAA,MAAA,EAAA,GAAA,SAAA;EACW,CAAA,CAAA;EACf,SAAA,YAAA,EAAA,SAAA,MAAA,EAAA;EAMqB,SAAA,eAAA,EAAA,SAAA,MAAA,EAAA;EAAmC,SAAA,oBAAA,CAAA,EAAA,MAAA;;AAAwB,UAvCnE,yBAAA,CAuCmE;;;;EC9InE,SAAA,eAAA,ED2GU,MC3GV,CAAA,MAAiC,EAAA,MAAA,CAAA;EACpB,SAAA,UAAA,EAAA,MAAA;EACY,SAAA,OAAA,EAAA;IAAf,SAAA,QAAA,EAAA,MAAA;IAAM,SAAA,IAAA,EAAA,MAAA;EAGjB,CAAA;EACT,SAAA,IAAA,ED2GS,iBC3GT;;AAEJ,UD4Gc,gBAAA,CC5Gd;EAAiC;;;;wBDiHb;;;;;uBAMD,4BAA4B;;;;;yBAO1C,oCACW,yBACf;;;;;0BAMqB,mCAAmC,iBAAiB;;;;AJhJjE,UKEK,iCAAA,CLFkC;EAEnC,SAAA,kBAAwB,EKCV,MLDU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIxB,SAAA,eAAqB,EKFV,MLEU,CAAA,MAAA,EKFK,ULEL,CAAA;;iBKCrB,2BAAA,OACT,oCACW,yBACf"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/gateway-runtime-contract.ts","../src/audience.ts","../src/gateway-process-spec.ts","../src/gateway-vm-spec.ts","../src/gateway-lifecycle.ts","../src/split-resolved-gateway-secrets.ts"],"mappings":";;;cAAa,iBAAA;AAAA,KAED,WAAA,WAAsB,iBAAA;AAAA,iBAElB,wBAAA,CAAyB,gBAAA,UAA0B,MAAA;AAAA,iBAInD,qBAAA,CACf,gBAAA,UACA,MAAA,UACA,OAAA;;;cCXY,gBAAA;AAAA,KAED,UAAA,WAAqB,gBAAA;AAAA,KACrB,iBAAA,GAAoB,OAAA,CAAQ,UAAA;AAAA,UAEvB,gBAAA;EAAA,SACP,IAAA;EAAA,SACA,QAAA,EAAU,UAAA;AAAA;AAAA,cAGP,gBAAA;AAAA,iBAEG,eAAA,CACf,cAAA,EAAgB,UAAA,EAChB,eAAA,EAAiB,iBAAA;AAAA,iBAKF,sBAAA,CACf,WAAA,WAAsB,gBAAA,IACtB,eAAA,EAAiB,iBAAA;AAAA,iBAOF,qBAAA,CAAsB,WAAA,WAAsB,gBAAA;;;KC5BhD,kBAAA;EAAA,SACE,IAAA;EAAA,SAAuB,IAAA;EAAA,SAAuB,IAAA;AAAA;EAAA,SAC9C,IAAA;EAAA,SAA0B,OAAA;AAAA;AFAxC;;;;AAAA,UEMiB,kBAAA;EAAA,SACP,gBAAA;EAAA,SACA,YAAA;EAAA,SACA,WAAA,EAAa,kBAAA;EAAA,SACb,eAAA;EAAA,SACA,OAAA;AAAA;;;;;AFbV;;UGMiB,aAAA;EAAA,SACP,WAAA,EAAa,MAAA;EAAA,SACb,SAAA,EAAW,MAAA,SAAe,YAAA;EAAA,SAC1B,eAAA,EAAiB,MAAA,SAAe,UAAA;EAAA,SAChC,QAAA,EAAU,MAAA;EAAA,SACV,YAAA;EAAA,SACA,UAAA;EAAA,SACA,YAAA;AAAA;;;;;;AHXV;UISiB,iBAAA;;;;AJPjB;WIYU,oBAAA;;;;AJRV;WIcU,iBAAA,GACR,QAAA,UACA,OAAA;IAAA,SACU,UAAA;IAAA,SACA,UAAA;EAAA;AAAA;AAAA,UAKF,sBAAA;EAAA,SACA,MAAA;AAAA;AAAA,UAGA,iCAAA,SAA0C,sBAAA;EAAA,SAC1C,MAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGA,iCAAA,SAA0C,sBAAA;EAAA,SAC1C,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGE,uBAAA;AAAA,UAEK,gBAAA;EAAA,SACP,SAAA,EAAW,uBAAA;AAAA;AAAA,UAGX,4BAAA;EAAA,SACA,IAAA,EAAM,WAAA;EAAA,SACN,MAAA;EAAA,SACA,IAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA;EAAA,SACA,QAAA;EAAA,SACA,GAAA,EAAK,gBAAA;EAAA,SACL,eAAA,GACN,iCAAA,GACA,iCAAA;AAAA;AAAA,UAIM,gCAAA,SAAyC,4BAAA;EAAA,SACzC,IAAA;EAAA,SACA,YAAA;EAAA,SACA,mBAAA,GAAsB,QAAA,CAC9B,MAAA,SAAe,iCAAA,GAAoC,iCAAA;AAAA;AAAA,UAI3C,8BAAA,SAAuC,4BAAA;EAAA,SACvC,IAAA;AAAA;AAAA,KAGL,wBAAA,GAA2B,gCAAA,GAAmC,8BAAA;AAAA,UAEzD,6BAAA;EAAA,SACA,MAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGA,6BAAA;EAAA,SACA,MAAA;EAAA,SACA,MAAA;AAAA;AAAA,KAGL,kBAAA,GAAqB,6BAAA,GAAgC,6BAAA;AAAA,KAE9C,8BAAA,GAAiC,kBAAA;EAAA,SACnC,QAAA;EAAA,SACA,SAAA;AAAA;AAAA,KAGE,+BAAA,GAAkC,kBAAA;EAAA,SACpC,QAAA,EAAU,UAAA;EAAA,SACV,SAAA;EAAA,SACA,KAAA;AAAA;AAAA,KAGE,mBAAA,GAAsB,8BAAA,GAAiC,+BAAA;;;AH1EnE;;UGgFiB,iBAAA;EAAA,SACP,EAAA;EAAA,SACA,MAAA,YAAkB,sBAAA;EAAA,SAClB,OAAA,EAAS,wBAAA;EAAA,SACT,GAAA,GAAM,0BAAA;EAAA,SACN,iBAAA,GAAoB,QAAA,CAAS,MAAA,SAAe,0BAAA;EAAA,SAC5C,kBAAA,GAAqB,QAAA,CAAS,MAAA;EAAA,SAC9B,oBAAA,GAAuB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;EAAA,SACxD,OAAA,EAAS,QAAA,CAAS,MAAA,SAAe,mBAAA;EAAA,SACjC,WAAA,WAAsB,gBAAA;EAAA,SACtB,eAAA;EAAA,SACA,oBAAA;AAAA;AAAA,UAGO,sBAAA;EAAA,SACP,EAAA;EAAA,SACA,aAAA;AAAA;AAAA,UAGO,0BAAA;EAAA,SACP,SAAA;AAAA;AAAA,UAGO,0BAAA;EAAA,SACP,OAAA,GAAU,QAAA,CAAS,MAAA;EAAA,SACnB,SAAA;EAAA,SACA,GAAA;AAAA;AAAA,UAGO,yBAAA;EAAA,SACP,cAAA;EAAA,SACA,eAAA;EAAA,SACA,gBAAA;EAAA,SACA,eAAA,EAAiB,MAAA;EAAA,SACjB,UAAA;EAAA,SACA,OAAA;IAAA,SACC,QAAA;IAAA,SACA,IAAA;EAAA;EAAA,SAED,IAAA,EAAM,iBAAA;AAAA;AAAA,UAGC,gBAAA;ED7IyB;;;;EAAA,SCkJhC,UAAA,GAAa,iBAAA;EDpJb;;;;EC0JT,WAAA,CAAY,OAAA,EAAS,yBAAA,GAA4B,aAAA;EDxJxC;;;;EC8JT,gBAAA,CACC,IAAA,EAAM,iBAAA,EACN,eAAA,EAAiB,MAAA,mBACf,kBAAA;ED/JM;;;;ECqKT,gBAAA,EAAkB,IAAA,EAAM,iBAAA,EAAmB,cAAA,EAAgB,cAAA,GAAiB,OAAA;AAAA;;;UC3K5D,0BAAA;EAAA,SACP,kBAAA,EAAoB,MAAA;EAAA,SACpB,eAAA,EAAiB,MAAA,SAAe,UAAA;AAAA;AAAA,KAG9B,qBAAA,GAAwB,mBAAA;AAAA,UAEnB,2BAAA;EAAA,SACP,QAAA,EAAU,iBAAA;EAAA,SACV,SAAA;AAAA;AAAA,iBAGM,+BAAA,CACf,aAAA,EAAe,QAAA,CAAS,MAAA,SAAe,qBAAA,IACvC,eAAA,EAAiB,MAAA,kBACjB,OAAA,EAAS,2BAAA,GACP,0BAAA;AAAA,KA2CS,iCAAA,GAAoC,0BAAA;AAAA,iBAEhC,2BAAA,CACf,IAAA,EAAM,iBAAA,EACN,eAAA,EAAiB,MAAA,mBACf,iCAAA"}

package/dist/index.js

@@ -6,33 +6,57 @@ function buildGatewaySessionLabel(projectNamespace, zoneId) {
 function buildToolSessionLabel(projectNamespace, zoneId, tcpSlot) {
 	return `${projectNamespace}:${zoneId}:tool:${tcpSlot}`;
 }
-
+//#endregion
+//#region src/audience.ts
+const vmAudienceValues = [
+	"gateway",
+	"tool-vm",
+	"both"
+];
+const controllerVmHost = "controller.vm.host";
+function targetsAudience(configAudience, runtimeAudience) {
+	return configAudience === runtimeAudience || configAudience === "both";
+}
+function egressHostsForAudience(egressHosts, runtimeAudience) {
+	return egressHosts.filter((egressHost) => targetsAudience(egressHost.audience, runtimeAudience)).map((egressHost) => egressHost.host);
+}
+function gatewayVmAllowedHosts(egressHosts) {
+	return Array.from(new Set([controllerVmHost, ...egressHostsForAudience(egressHosts, "gateway")]));
+}
 //#endregion
 //#region src/split-resolved-gateway-secrets.ts
-function splitResolvedGatewaySecrets(zone, resolvedSecrets) {
+function splitResolvedSecretsByInjection(secretConfigs, resolvedSecrets, options) {
 	const environmentSecrets = {};
 	const mediatedSecrets = {};
+	const logPrefix = options.logPrefix ?? "split-resolved-secrets";
 	for (const [secretName, secretValue] of Object.entries(resolvedSecrets)) {
-		const secretConfig = zone.secrets[secretName];
-		if (!secretConfig) {
-			process.stderr.write(`[split-resolved-gateway-secrets] Secret '${secretName}' was resolved but has no matching zone secret config.\n`);
-			continue;
-		}
-		if (secretConfig.injection === "http-mediation" && secretConfig.hosts) {
+		const secretConfig = secretConfigs[secretName];
+		if (!secretConfig) throw new Error(`[${logPrefix}] Secret '${secretName}' was resolved but has no matching secret config.`);
+		if (!targetsAudience(secretConfig.audience, options.audience)) continue;
+		if (secretConfig.injection === "http-mediation") {
+			if (secretConfig.hosts.length === 0) throw new Error(`[${logPrefix}] Secret '${secretName}' uses http-mediation but declares no hosts.`);
 			mediatedSecrets[secretName] = {
 				hosts: [...secretConfig.hosts],
 				value: secretValue
 			};
 			continue;
 		}
-		environmentSecrets[secretName] = secretValue;
+		const envSecretAudience = secretConfig.audience;
+		if (envSecretAudience !== "gateway") throw new Error(`[${logPrefix}] Secret '${secretName}' uses env injection with non-gateway audience '${envSecretAudience}'.`);
+		if (options.audience === "gateway") environmentSecrets[secretName] = secretValue;
 	}
 	return {
 		environmentSecrets,
 		mediatedSecrets
 	};
 }
-
+function splitResolvedGatewaySecrets(zone, resolvedSecrets) {
+	return splitResolvedSecretsByInjection(zone.secrets, resolvedSecrets, {
+		audience: "gateway",
+		logPrefix: "split-resolved-gateway-secrets"
+	});
+}
 //#endregion
-export { buildGatewaySessionLabel, buildToolSessionLabel, gatewayTypeValues, splitResolvedGatewaySecrets };
+export { buildGatewaySessionLabel, buildToolSessionLabel, controllerVmHost, egressHostsForAudience, gatewayTypeValues, gatewayVmAllowedHosts, splitResolvedGatewaySecrets, splitResolvedSecretsByInjection, targetsAudience, vmAudienceValues };
+
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["environmentSecrets: Record<string, string>","mediatedSecrets: Record<string, SecretSpec>"],"sources":["../src/gateway-runtime-contract.ts","../src/split-resolved-gateway-secrets.ts"],"sourcesContent":["export const gatewayTypeValues = ['openclaw', 'worker'] as const;\n\nexport type GatewayType = (typeof gatewayTypeValues)[number];\n\nexport function buildGatewaySessionLabel(projectNamespace: string, zoneId: string): string {\n\treturn `${projectNamespace}:${zoneId}:gateway`;\n}\n\nexport function buildToolSessionLabel(\n\tprojectNamespace: string,\n\tzoneId: string,\n\ttcpSlot: number,\n): string {\n\treturn `${projectNamespace}:${zoneId}:tool:${tcpSlot}`;\n}\n","import type { SecretSpec } from '@agent-vm/gondolin-adapter';\n\nimport type { GatewayZoneConfig } from './gateway-lifecycle.js';\n\nexport interface SplitResolvedGatewaySecretsResult {\n\treadonly environmentSecrets: Record<string, string>;\n\treadonly mediatedSecrets: Record<string, SecretSpec>;\n}\n\nexport function splitResolvedGatewaySecrets(\n\tzone: GatewayZoneConfig,\n\tresolvedSecrets: Record<string, string>,\n): SplitResolvedGatewaySecretsResult {\n\tconst environmentSecrets: Record<string, string> = {};\n\tconst mediatedSecrets: Record<string, SecretSpec> = {};\n\n\tfor (const [secretName, secretValue] of Object.entries(resolvedSecrets)) {\n\t\tconst secretConfig = zone.secrets[secretName];\n\t\tif (!secretConfig) {\n\t\t\tprocess.stderr.write(\n\t\t\t\t`[split-resolved-gateway-secrets] Secret '${secretName}' was resolved but has no matching zone secret config.\\n`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (secretConfig.injection === 'http-mediation' && secretConfig.hosts) {\n\t\t\tmediatedSecrets[secretName] = {\n\t\t\t\thosts: [...secretConfig.hosts],\n\t\t\t\tvalue: secretValue,\n\t\t\t};\n\t\t\tcontinue;\n\t\t}\n\n\t\tenvironmentSecrets[secretName] = secretValue;\n\t}\n\n\treturn { environmentSecrets, mediatedSecrets };\n}\n"],"mappings":";AAAA,MAAa,oBAAoB,CAAC,YAAY,SAAS;AAIvD,SAAgB,yBAAyB,kBAA0B,QAAwB;AAC1F,QAAO,GAAG,iBAAiB,GAAG,OAAO;;AAGtC,SAAgB,sBACf,kBACA,QACA,SACS;AACT,QAAO,GAAG,iBAAiB,GAAG,OAAO,QAAQ;;;;;ACJ9C,SAAgB,4BACf,MACA,iBACoC;CACpC,MAAMA,qBAA6C,EAAE;CACrD,MAAMC,kBAA8C,EAAE;AAEtD,MAAK,MAAM,CAAC,YAAY,gBAAgB,OAAO,QAAQ,gBAAgB,EAAE;EACxE,MAAM,eAAe,KAAK,QAAQ;AAClC,MAAI,CAAC,cAAc;AAClB,WAAQ,OAAO,MACd,4CAA4C,WAAW,0DACvD;AACD;;AAGD,MAAI,aAAa,cAAc,oBAAoB,aAAa,OAAO;AACtE,mBAAgB,cAAc;IAC7B,OAAO,CAAC,GAAG,aAAa,MAAM;IAC9B,OAAO;IACP;AACD;;AAGD,qBAAmB,cAAc;;AAGlC,QAAO;EAAE;EAAoB;EAAiB"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/gateway-runtime-contract.ts","../src/audience.ts","../src/split-resolved-gateway-secrets.ts"],"sourcesContent":["export const gatewayTypeValues = ['openclaw', 'worker'] as const;\n\nexport type GatewayType = (typeof gatewayTypeValues)[number];\n\nexport function buildGatewaySessionLabel(projectNamespace: string, zoneId: string): string {\n\treturn `${projectNamespace}:${zoneId}:gateway`;\n}\n\nexport function buildToolSessionLabel(\n\tprojectNamespace: string,\n\tzoneId: string,\n\ttcpSlot: number,\n): string {\n\treturn `${projectNamespace}:${zoneId}:tool:${tcpSlot}`;\n}\n","export const vmAudienceValues = ['gateway', 'tool-vm', 'both'] as const;\n\nexport type VmAudience = (typeof vmAudienceValues)[number];\nexport type RuntimeVmAudience = Exclude<VmAudience, 'both'>;\n\nexport interface EgressHostConfig {\n\treadonly host: string;\n\treadonly audience: VmAudience;\n}\n\nexport const controllerVmHost = 'controller.vm.host';\n\nexport function targetsAudience(\n\tconfigAudience: VmAudience,\n\truntimeAudience: RuntimeVmAudience,\n): boolean {\n\treturn configAudience === runtimeAudience || configAudience === 'both';\n}\n\nexport function egressHostsForAudience(\n\tegressHosts: readonly EgressHostConfig[],\n\truntimeAudience: RuntimeVmAudience,\n): readonly string[] {\n\treturn egressHosts\n\t\t.filter((egressHost) => targetsAudience(egressHost.audience, runtimeAudience))\n\t\t.map((egressHost) => egressHost.host);\n}\n\nexport function gatewayVmAllowedHosts(egressHosts: readonly EgressHostConfig[]): readonly string[] {\n\treturn Array.from(new Set([controllerVmHost, ...egressHostsForAudience(egressHosts, 'gateway')]));\n}\n","import type { SecretSpec } from '@agent-vm/gondolin-adapter';\n\nimport { targetsAudience, type RuntimeVmAudience } from './audience.js';\nimport type { GatewaySecretConfig, GatewayZoneConfig } from './gateway-lifecycle.js';\n\nexport interface SplitResolvedSecretsResult {\n\treadonly environmentSecrets: Record<string, string>;\n\treadonly mediatedSecrets: Record<string, SecretSpec>;\n}\n\nexport type SecretInjectionConfig = GatewaySecretConfig;\n\nexport interface SplitResolvedSecretsOptions {\n\treadonly audience: RuntimeVmAudience;\n\treadonly logPrefix?: string;\n}\n\nexport function splitResolvedSecretsByInjection(\n\tsecretConfigs: Readonly<Record<string, SecretInjectionConfig>>,\n\tresolvedSecrets: Record<string, string>,\n\toptions: SplitResolvedSecretsOptions,\n): SplitResolvedSecretsResult {\n\tconst environmentSecrets: Record<string, string> = {};\n\tconst mediatedSecrets: Record<string, SecretSpec> = {};\n\tconst logPrefix = options.logPrefix ?? 'split-resolved-secrets';\n\n\tfor (const [secretName, secretValue] of Object.entries(resolvedSecrets)) {\n\t\tconst secretConfig = secretConfigs[secretName];\n\t\tif (!secretConfig) {\n\t\t\tthrow new Error(\n\t\t\t\t`[${logPrefix}] Secret '${secretName}' was resolved but has no matching secret config.`,\n\t\t\t);\n\t\t}\n\t\tif (!targetsAudience(secretConfig.audience, options.audience)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (secretConfig.injection === 'http-mediation') {\n\t\t\tif (secretConfig.hosts.length === 0) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[${logPrefix}] Secret '${secretName}' uses http-mediation but declares no hosts.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tmediatedSecrets[secretName] = {\n\t\t\t\thosts: [...secretConfig.hosts],\n\t\t\t\tvalue: secretValue,\n\t\t\t};\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst envSecretAudience = (secretConfig as { readonly audience: string }).audience;\n\t\tif (envSecretAudience !== 'gateway') {\n\t\t\tthrow new Error(\n\t\t\t\t`[${logPrefix}] Secret '${secretName}' uses env injection with non-gateway audience '${envSecretAudience}'.`,\n\t\t\t);\n\t\t}\n\t\tif (options.audience === 'gateway') {\n\t\t\tenvironmentSecrets[secretName] = secretValue;\n\t\t}\n\t}\n\n\treturn { environmentSecrets, mediatedSecrets };\n}\n\nexport type SplitResolvedGatewaySecretsResult = SplitResolvedSecretsResult;\n\nexport function splitResolvedGatewaySecrets(\n\tzone: GatewayZoneConfig,\n\tresolvedSecrets: Record<string, string>,\n): SplitResolvedGatewaySecretsResult {\n\treturn splitResolvedSecretsByInjection(zone.secrets, resolvedSecrets, {\n\t\taudience: 'gateway',\n\t\tlogPrefix: 'split-resolved-gateway-secrets',\n\t});\n}\n"],"mappings":";AAAA,MAAa,oBAAoB,CAAC,YAAY,SAAS;AAIvD,SAAgB,yBAAyB,kBAA0B,QAAwB;CAC1F,OAAO,GAAG,iBAAiB,GAAG,OAAO;;AAGtC,SAAgB,sBACf,kBACA,QACA,SACS;CACT,OAAO,GAAG,iBAAiB,GAAG,OAAO,QAAQ;;;;ACb9C,MAAa,mBAAmB;CAAC;CAAW;CAAW;CAAO;AAU9D,MAAa,mBAAmB;AAEhC,SAAgB,gBACf,gBACA,iBACU;CACV,OAAO,mBAAmB,mBAAmB,mBAAmB;;AAGjE,SAAgB,uBACf,aACA,iBACoB;CACpB,OAAO,YACL,QAAQ,eAAe,gBAAgB,WAAW,UAAU,gBAAgB,CAAC,CAC7E,KAAK,eAAe,WAAW,KAAK;;AAGvC,SAAgB,sBAAsB,aAA6D;CAClG,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,aAAa,UAAU,CAAC,CAAC,CAAC;;;;ACZlG,SAAgB,gCACf,eACA,iBACA,SAC6B;CAC7B,MAAM,qBAA6C,EAAE;CACrD,MAAM,kBAA8C,EAAE;CACtD,MAAM,YAAY,QAAQ,aAAa;CAEvC,KAAK,MAAM,CAAC,YAAY,gBAAgB,OAAO,QAAQ,gBAAgB,EAAE;EACxE,MAAM,eAAe,cAAc;EACnC,IAAI,CAAC,cACJ,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,mDACrC;EAEF,IAAI,CAAC,gBAAgB,aAAa,UAAU,QAAQ,SAAS,EAC5D;EAGD,IAAI,aAAa,cAAc,kBAAkB;GAChD,IAAI,aAAa,MAAM,WAAW,GACjC,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,8CACrC;GAEF,gBAAgB,cAAc;IAC7B,OAAO,CAAC,GAAG,aAAa,MAAM;IAC9B,OAAO;IACP;GACD;;EAGD,MAAM,oBAAqB,aAA+C;EAC1E,IAAI,sBAAsB,WACzB,MAAM,IAAI,MACT,IAAI,UAAU,YAAY,WAAW,kDAAkD,kBAAkB,IACzG;EAEF,IAAI,QAAQ,aAAa,WACxB,mBAAmB,cAAc;;CAInC,OAAO;EAAE;EAAoB;EAAiB;;AAK/C,SAAgB,4BACf,MACA,iBACoC;CACpC,OAAO,gCAAgC,KAAK,SAAS,iBAAiB;EACrE,UAAU;EACV,WAAW;EACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-vm/gateway-interface",
-  "version": "0.0.58",
+  "version": "0.0.60",
   "description": "Shared TypeScript interfaces for VM gateway lifecycles, VmSpec, and ProcessSpec.",
   "homepage": "https://github.com/ShravanSunder/agent-vm#readme",
   "bugs": {
@@ -29,7 +29,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agent-vm/gondolin-adapter": "0.0.58"
+    "@agent-vm/gondolin-adapter": "0.0.60"
   },
   "scripts": {
     "build": "tsdown",