@nodetool-ai/compute 0.8.1

package/README.md

@@ -0,0 +1,46 @@
+# @nodetool-ai/compute
+
+Remote compute orchestration for [NodeTool](https://nodetool.ai) — provisions and reaps GPU workers on RunPod and Vast.ai.
+
+This package manages the lifecycle of remote GPU workers: it provisions instances from worker profiles, tracks their connections, reconciles desired against actual state, and runs a reaper that tears down idle or orphaned instances. Providers for RunPod and Vast.ai sit behind a common `WorkerProvider` interface.
+
+## Install
+
+```bash
+npm install @nodetool-ai/compute
+```
+
+## Exported symbols
+
+| Symbol | Kind | Description |
+| --- | --- | --- |
+| `WorkerManager` | class | Manages worker profiles, provisioning, and reconciliation |
+| `WorkerManagerDeps` | type | Injectable dependencies for `WorkerManager` |
+| `ReconcileSummary` | type | Result of a reconcile pass |
+| `WorkerConnection` / `WorkerOrphan` | type | Tracked worker and orphaned-instance shapes |
+| `startReaper` | function | Starts the background loop that reaps idle/orphaned workers |
+| `runReaperOnce` | function | Runs a single reaper pass |
+| `ReaperDeps` / `ReaperHandle` / `ReaperManager` | type | Reaper wiring and control handle |
+| `RunpodPodProvider` | class | `WorkerProvider` implementation for RunPod |
+| `VastProvider` | class | `WorkerProvider` implementation for Vast.ai |
+| `WorkerProvider` | interface | Provision/status/terminate contract for a compute backend |
+| `WorkerSpec` / `WorkerTarget` / `WorkerStatus` | type | Worker specification and status shapes |
+| `ProviderInstance` / `ProvisionResult` | type | Provider-level instance and provisioning results |
+
+## Usage
+
+```ts
+import { WorkerManager, startReaper } from "@nodetool-ai/compute";
+
+const manager = new WorkerManager();
+const summary = await manager.reconcile();
+
+const reaper = startReaper({ manager });
+// ... later
+reaper.stop();
+```
+
+## Links
+
+- [NodeTool](https://nodetool.ai)
+- [GitHub](https://github.com/nodetool-ai/nodetool)

package/dist/.nodetool-build-stamp

@@ -0,0 +1 @@
+2026-09-28T09:19:06.232Z

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { WorkerManager } from "./manager.js";
+export type { ReconcileSummary, WorkerConnection, WorkerManagerDeps, WorkerOrphan, } from "./manager.js";
+export { runReaperOnce, startReaper } from "./reaper.js";
+export { attachWorkerActivityHeartbeat, installWorkerActivityHeartbeat, } from "./worker-heartbeat.js";
+export type { BridgeCreationRegistrar, WorkerActivityHeartbeatOptions, WorkerActivitySource, } from "./worker-heartbeat.js";
+export type { ReaperDeps, ReaperHandle, ReaperManager } from "./reaper.js";
+export { RunpodPodProvider } from "./providers/runpod.js";
+export { VastProvider } from "./providers/vast.js";
+export type { ProviderInstance, ProvisionResult, WorkerProvider, WorkerSpec, WorkerStatus, WorkerTarget, } from "./providers/types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,UAAU,EACV,YAAY,EACZ,YAAY,GACb,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// Worker provisioning package (`@nodetool-ai/compute`).
+export { WorkerManager } from "./manager.js";
+export { runReaperOnce, startReaper } from "./reaper.js";
+export { attachWorkerActivityHeartbeat, installWorkerActivityHeartbeat, } from "./worker-heartbeat.js";
+export { RunpodPodProvider } from "./providers/runpod.js";
+export { VastProvider } from "./providers/vast.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAO7C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/manager.d.ts

@@ -0,0 +1,150 @@
+import { type CreateWorkerInstanceInput, type CreateWorkerProfileInput, type ListWorkerInstancesOptions, type WorkerInstance, type WorkerInstancePatch, type WorkerProfile } from "@nodetool-ai/models";
+import type { WorkerProvider, WorkerStatus, WorkerTarget } from "./providers/types.js";
+/**
+ * The connection info a caller applies to the Python bridge when attaching to
+ * a worker — the worker's WebSocket URL and its bearer token (if any).
+ */
+export interface WorkerConnection {
+    wsUrl: string;
+    token: string | null;
+}
+/**
+ * A provider-live worker that the DB registry doesn't track — a "true orphan"
+ * billing out-of-band. Surfaced by `reconcile()` for one-click stop-all.
+ */
+export interface WorkerOrphan {
+    target: WorkerTarget;
+    providerRef: string;
+    status: WorkerStatus;
+}
+/**
+ * Result of an orphan reconcile pass: the untracked live workers, the number of
+ * tracked instances still live, and their summed estimated cost.
+ */
+export interface ReconcileSummary {
+    orphans: WorkerOrphan[];
+    liveCount: number;
+    estimatedCostUsd: number;
+}
+/**
+ * The dependencies the manager delegates to — the models accessors, the secret
+ * getter, and a provider factory. Defaults bind to the real `@nodetool-ai/models`
+ * implementations; tests inject in-memory fakes.
+ */
+export interface WorkerManagerDeps {
+    createWorkerProfile: (input: CreateWorkerProfileInput) => Promise<WorkerProfile>;
+    getWorkerProfile: (name: string) => Promise<WorkerProfile | null>;
+    listWorkerProfiles: () => Promise<WorkerProfile[]>;
+    deleteWorkerProfile: (name: string) => Promise<void>;
+    createWorkerInstance: (input: CreateWorkerInstanceInput) => Promise<WorkerInstance>;
+    getWorkerInstance: (id: string) => Promise<WorkerInstance | null>;
+    listWorkerInstances: (options?: ListWorkerInstancesOptions) => Promise<WorkerInstance[]>;
+    updateWorkerInstance: (id: string, patch: WorkerInstancePatch) => Promise<WorkerInstance>;
+    getSecret: (key: string, userId?: string, defaultValue?: string) => Promise<string | null>;
+    getSetting: (key: string) => Promise<string | null>;
+    setSetting: (key: string, value: string) => Promise<void>;
+    deleteSetting: (key: string) => Promise<void>;
+    providerFactory: (target: WorkerTarget, apiKey: string) => WorkerProvider;
+}
+export declare class WorkerManager {
+    private readonly deps;
+    constructor(deps?: Partial<WorkerManagerDeps>);
+    createProfile(input: CreateWorkerProfileInput): Promise<WorkerProfile>;
+    listProfiles(): Promise<WorkerProfile[]>;
+    deleteProfile(name: string): Promise<void>;
+    /**
+     * Provision a worker from a profile: resolve the provider, generate a token
+     * when the profile's policy requires it, call the provider, and persist the
+     * resulting instance transitioning `provisioning → running`.
+     */
+    provision(profileName: string): Promise<WorkerInstance>;
+    /**
+     * Pause a worker: release its GPU compute but keep its volume (and cached
+     * models). Marks the instance `stopped` — resumable via `resume`. The volume
+     * still bills a little while paused; `terminate` to stop all cost.
+     */
+    stop(instanceId: string): Promise<WorkerInstance>;
+    /**
+     * Resume a paused worker: bring it back to running and adopt its fresh
+     * endpoint/cost (the URL can change across a stop/resume). Does NOT re-attach
+     * the bridge — the caller attaches as a separate step. May throw if the
+     * provider cannot re-allocate a GPU.
+     */
+    resume(instanceId: string): Promise<WorkerInstance>;
+    /**
+     * Destroy a worker AND its volume — the real teardown that stops all billing.
+     * The cached models are gone for good. Marks the instance `terminated` (a
+     * tombstone) and drops the active-worker pointer if it referenced it.
+     */
+    terminate(instanceId: string): Promise<WorkerInstance>;
+    /** Pause every instance that is still live (not stopped/terminated). */
+    stopAll(): Promise<void>;
+    /** Return all registered instances. */
+    list(): Promise<WorkerInstance[]>;
+    /**
+     * Return one instance by id with its bearer token decrypted, or null. Use
+     * this — not `list` — whenever the token is needed: bulk reads withhold it.
+     */
+    getInstance(instanceId: string): Promise<WorkerInstance | null>;
+    /** Refresh an instance's status from its provider. */
+    status(instanceId: string): Promise<WorkerStatus>;
+    /**
+     * Reconcile the DB registry against what each provider reports live. Tracked
+     * instances that are `running`/`attached` but absent from their provider's
+     * live list died or were killed out-of-band — mark them `stopped`. Live
+     * provider workers with no matching tracked instance are true orphans,
+     * surfaced (with a live-count and estimated-cost summary) so the cost guard
+     * can offer a one-click stop-all. Already-`stopped` rows are left untouched.
+     */
+    reconcile(): Promise<ReconcileSummary>;
+    /**
+     * Adopt an instance as the active worker: persist the singleton pointer,
+     * mark the instance `attached`, and return its connection info for the
+     * caller to apply to the Python bridge (`bridge.setTarget`). The manager
+     * stays free of a runtime dependency — re-pointing is the caller's job.
+     */
+    attach(instanceId: string): Promise<WorkerConnection>;
+    /**
+     * Read-only connection target for an instance — the same `{wsUrl, token}`
+     * attach returns, but without mutating the attach pointer or status. Used to
+     * health-probe a worker that is `running` but not yet attached.
+     */
+    connectionInfo(instanceId: string): Promise<WorkerConnection>;
+    /**
+     * Release the active worker: clear the pointer and revert the
+     * previously-attached instance to `running`. The caller points the bridge
+     * back at its env/stdio default.
+     */
+    detach(): Promise<void>;
+    /**
+     * Return the currently-attached instance, or null when none is attached.
+     * Never returns a stopped/dead instance: if the pointer references a row that
+     * has since been stopped/terminated (or vanished), clear it and return null
+     * so consumers don't re-point the bridge at a worker that is no longer live.
+     */
+    getActiveWorker(): Promise<WorkerInstance | null>;
+    /** Drop the active-worker pointer if it currently references `instanceId`. */
+    private clearActivePointerIfMatches;
+    private requireInstance;
+    private resolveProvider;
+    /**
+     * Report whether each target's API key is available — store OR environment,
+     * the SAME resolution `provision` uses. The UI must check this rather than the
+     * secrets list alone, which only sees the store and so false-warns on an
+     * env-provided key.
+     */
+    apiKeyStatus(): Promise<Record<WorkerTarget, boolean>>;
+    /**
+     * Load a target's API key from the secret store, falling back to the
+     * environment when the keychain is unreachable (headless/sandboxed). Mirrors
+     * the resolution the deleted `runpod-worker.ts` script used.
+     */
+    private loadApiKey;
+    /**
+     * Resolve a target's API key from the secret store, then the environment.
+     * Returns `null` when neither has it (no throw) — shared by `loadApiKey` (which
+     * throws) and `apiKeyStatus` (which reports).
+     */
+    private resolveApiKey;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AAiBA,OAAO,EAWL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,KAAK,EACV,cAAc,EAEd,YAAY,EACZ,YAAY,EACb,MAAM,sBAAsB,CAAC;AAoB9B;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAiBD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,CACnB,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5B,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClE,kBAAkB,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,oBAAoB,EAAE,CACpB,KAAK,EAAE,yBAAyB,KAC7B,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,iBAAiB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,OAAO,CAAC,EAAE,0BAA0B,KACjC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/B,oBAAoB,EAAE,CACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,mBAAmB,KACvB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,SAAS,EAAE,CACT,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,eAAe,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,cAAc,CAAC;CAC3E;AA2BD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,YAAY,IAAI,GAAE,OAAO,CAAC,iBAAiB,CAAM,EAEhD;IAID,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAErE;IAED,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAEvC;IAED,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzC;IAID;;;;OAIG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiD5D;IAED;;;;OAIG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAQtD;IAED;;;;;OAKG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAcxD;IAED;;;;OAIG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAU3D;IAED,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ7B;IAED,uCAAuC;IACvC,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhC;IAED;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAE9D;IAED,sDAAsD;IAChD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAMtD;IAED;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAqD3C;IAID;;;;;OAKG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAa1D;IAED;;;;OAIG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAGlE;IAED;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAM5B;IAED;;;;;OAKG;IACG,eAAe,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAetD;IAID,8EAA8E;YAChE,2BAA2B;YAO3B,eAAe;YAQf,eAAe;IAK7B;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAS3D;IAED;;;;OAIG;YACW,UAAU;IAYxB;;;;OAIG;YACW,aAAa;CAW5B"}

package/dist/manager.js

@@ -0,0 +1,408 @@
+// WorkerManager — the orchestration layer over the per-target providers.
+//
+// It owns the profiles→instances identity model: profiles are declarative
+// presets persisted in `worker_profiles`, instances are ephemeral,
+// billing-sensitive handles persisted in `worker_instances`. All state lives in
+// the DB (via the models accessors) — never only in memory — so the UI, CLI,
+// and reaper share a single source of truth and a forgotten GPU pod is always
+// recoverable from the registry.
+//
+// The manager resolves a per-target `WorkerProvider` (RunPod pod today, Vast in
+// Group F), loading the provider's API key from the secret store with an env
+// fallback. Every model accessor, the secret getter, and the provider factory
+// are injectable so the lifecycle can be unit-tested with fakes.
+import { randomBytes } from "node:crypto";
+import { createLogger } from "@nodetool-ai/config";
+import { createWorkerInstance as realCreateWorkerInstance, createWorkerProfile as realCreateWorkerProfile, deleteWorkerProfile as realDeleteWorkerProfile, getSecret as realGetSecret, getWorkerInstance as realGetWorkerInstance, getWorkerProfile as realGetWorkerProfile, listWorkerInstances as realListWorkerInstances, listWorkerProfiles as realListWorkerProfiles, updateWorkerInstance as realUpdateWorkerInstance, Setting, } from "@nodetool-ai/models";
+import { RunpodPodProvider } from "./providers/runpod.js";
+import { VastProvider } from "./providers/vast.js";
+const log = createLogger("nodetool.compute.manager");
+/** Local desktop user id used for secret-store reads (shared with the CLI). */
+const LOCAL_USER_ID = "1";
+/**
+ * Settings key holding the id of the worker instance the local NodeTool
+ * instance has attached to. Singleton for the desktop MVP — any NodeTool
+ * instance reads it to re-point its Python bridge.
+ */
+const ACTIVE_WORKER_KEY = "active_worker_instance_id";
+/** Secret-store key holding each target's API key. */
+const API_KEY_SECRET = {
+    runpod: "RUNPOD_API_KEY",
+    vast: "VAST_API_KEY",
+};
+/** Construct the concrete provider for a target. */
+function defaultProviderFactory(target, apiKey) {
+    switch (target) {
+        case "runpod":
+            return new RunpodPodProvider(apiKey);
+        case "vast":
+            return new VastProvider(apiKey);
+        default:
+            throw new Error(`Unsupported worker target: ${target}`);
+    }
+}
+function defaultDeps() {
+    return {
+        createWorkerProfile: realCreateWorkerProfile,
+        getWorkerProfile: realGetWorkerProfile,
+        listWorkerProfiles: realListWorkerProfiles,
+        deleteWorkerProfile: realDeleteWorkerProfile,
+        createWorkerInstance: realCreateWorkerInstance,
+        getWorkerInstance: realGetWorkerInstance,
+        listWorkerInstances: realListWorkerInstances,
+        updateWorkerInstance: realUpdateWorkerInstance,
+        getSecret: realGetSecret,
+        getSetting: async (key) => {
+            const setting = await Setting.find(LOCAL_USER_ID, key);
+            return setting ? setting.getValue() : null;
+        },
+        setSetting: async (key, value) => {
+            await Setting.upsert({ userId: LOCAL_USER_ID, key, value });
+        },
+        deleteSetting: async (key) => {
+            await Setting.deleteSetting(LOCAL_USER_ID, key);
+        },
+        providerFactory: defaultProviderFactory,
+    };
+}
+export class WorkerManager {
+    deps;
+    constructor(deps = {}) {
+        this.deps = { ...defaultDeps(), ...deps };
+    }
+    // --- Profiles -----------------------------------------------------------
+    createProfile(input) {
+        return this.deps.createWorkerProfile(input);
+    }
+    listProfiles() {
+        return this.deps.listWorkerProfiles();
+    }
+    deleteProfile(name) {
+        return this.deps.deleteWorkerProfile(name);
+    }
+    // --- Instance lifecycle -------------------------------------------------
+    /**
+     * Provision a worker from a profile: resolve the provider, generate a token
+     * when the profile's policy requires it, call the provider, and persist the
+     * resulting instance transitioning `provisioning → running`.
+     */
+    async provision(profileName) {
+        const profile = await this.deps.getWorkerProfile(profileName);
+        if (!profile) {
+            throw new Error(`Worker profile not found: ${profileName}`);
+        }
+        const target = profile.target;
+        const provider = await this.resolveProvider(target);
+        const token = profile.token_policy === "generate" ? generateToken() : undefined;
+        const spec = specFromProfile(profile, target, token);
+        const result = await provider.provision(spec);
+        // The provider now holds a billable resource. If persisting it to the
+        // registry fails, the resource would be orphaned — untracked and billing,
+        // recoverable only via reconcile(). Compensate by DESTROYING it (terminate,
+        // not pause — a paused orphan still bills volume and is never tracked), then
+        // re-throw the original DB error so the caller sees the real cause.
+        try {
+            const instance = await this.deps.createWorkerInstance({
+                profile_name: profile.name,
+                target,
+                provider_ref: result.providerRef,
+                ws_url: result.wsUrl,
+                token: result.token ?? null,
+                estimated_cost_usd: result.costUsd ?? null,
+            });
+            return await this.deps.updateWorkerInstance(instance.id, {
+                status: result.status,
+            });
+        }
+        catch (error) {
+            log.error("Failed to persist provisioned worker; tearing down the orphaned " +
+                "provider resource to stop billing", { target, providerRef: result.providerRef, error });
+            try {
+                await provider.terminate(result.providerRef);
+            }
+            catch (terminateError) {
+                log.error("Compensating terminate() of the orphaned provider resource also " +
+                    "failed; it may still be billing and require manual teardown", { target, providerRef: result.providerRef, error: terminateError });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Pause a worker: release its GPU compute but keep its volume (and cached
+     * models). Marks the instance `stopped` — resumable via `resume`. The volume
+     * still bills a little while paused; `terminate` to stop all cost.
+     */
+    async stop(instanceId) {
+        const instance = await this.requireInstance(instanceId);
+        const provider = await this.resolveProvider(instance.target);
+        await provider.stop(instance.provider_ref);
+        await this.clearActivePointerIfMatches(instance.id);
+        return this.deps.updateWorkerInstance(instance.id, { status: "stopped" });
+    }
+    /**
+     * Resume a paused worker: bring it back to running and adopt its fresh
+     * endpoint/cost (the URL can change across a stop/resume). Does NOT re-attach
+     * the bridge — the caller attaches as a separate step. May throw if the
+     * provider cannot re-allocate a GPU.
+     */
+    async resume(instanceId) {
+        const instance = await this.requireInstance(instanceId);
+        const provider = await this.resolveProvider(instance.target);
+        const result = await provider.resume(instance.provider_ref);
+        return this.deps.updateWorkerInstance(instance.id, {
+            status: "running",
+            ws_url: result.wsUrl,
+            estimated_cost_usd: result.costUsd ?? instance.estimated_cost_usd,
+            // Resuming is activity — reset the idle clock so the reaper doesn't
+            // immediately re-stop it before any work runs.
+            last_activity_at: new Date().toISOString(),
+        });
+    }
+    /**
+     * Destroy a worker AND its volume — the real teardown that stops all billing.
+     * The cached models are gone for good. Marks the instance `terminated` (a
+     * tombstone) and drops the active-worker pointer if it referenced it.
+     */
+    async terminate(instanceId) {
+        const instance = await this.requireInstance(instanceId);
+        const provider = await this.resolveProvider(instance.target);
+        await provider.terminate(instance.provider_ref);
+        await this.clearActivePointerIfMatches(instance.id);
+        return this.deps.updateWorkerInstance(instance.id, {
+            status: "terminated",
+        });
+    }
+    /** Pause every instance that is still live (not stopped/terminated). */
+    async stopAll() {
+        const instances = await this.deps.listWorkerInstances();
+        for (const instance of instances) {
+            if (instance.status === "stopped" || instance.status === "terminated") {
+                continue;
+            }
+            await this.stop(instance.id);
+        }
+    }
+    /** Return all registered instances. */
+    list() {
+        return this.deps.listWorkerInstances();
+    }
+    /**
+     * Return one instance by id with its bearer token decrypted, or null. Use
+     * this — not `list` — whenever the token is needed: bulk reads withhold it.
+     */
+    getInstance(instanceId) {
+        return this.deps.getWorkerInstance(instanceId);
+    }
+    /** Refresh an instance's status from its provider. */
+    async status(instanceId) {
+        const instance = await this.requireInstance(instanceId);
+        const provider = await this.resolveProvider(instance.target);
+        return provider.status(instance.provider_ref);
+    }
+    /**
+     * Reconcile the DB registry against what each provider reports live. Tracked
+     * instances that are `running`/`attached` but absent from their provider's
+     * live list died or were killed out-of-band — mark them `stopped`. Live
+     * provider workers with no matching tracked instance are true orphans,
+     * surfaced (with a live-count and estimated-cost summary) so the cost guard
+     * can offer a one-click stop-all. Already-`stopped` rows are left untouched.
+     */
+    async reconcile() {
+        const instances = await this.deps.listWorkerInstances();
+        const targets = [
+            ...new Set(instances.map((i) => i.target)),
+        ];
+        const orphans = [];
+        let liveCount = 0;
+        let estimatedCostUsd = 0;
+        for (const target of targets) {
+            const provider = await this.resolveProvider(target);
+            const live = await provider.list();
+            const liveRefs = new Set(live.map((l) => l.providerRef));
+            const tracked = instances.filter((i) => i.target === target);
+            const trackedRefs = new Set(tracked.map((i) => i.provider_ref));
+            // Tracked-but-dead: running/attached instances missing from the live
+            // list died/were killed out-of-band. The survivors count toward the
+            // live summary; already-stopped rows are skipped entirely.
+            for (const instance of tracked) {
+                if (instance.status !== "running" && instance.status !== "attached") {
+                    continue;
+                }
+                if (liveRefs.has(instance.provider_ref)) {
+                    liveCount += 1;
+                    estimatedCostUsd += instance.estimated_cost_usd ?? 0;
+                }
+                else {
+                    await this.clearActivePointerIfMatches(instance.id);
+                    await this.deps.updateWorkerInstance(instance.id, {
+                        status: "stopped",
+                    });
+                }
+            }
+            // Live-but-untracked: provider workers with no matching instance row.
+            // Only running/attached entries are cost orphans — a stopped/paused or
+            // terminated provider entry isn't burning GPU billing, so don't surface
+            // it for one-click stop-all.
+            for (const entry of live) {
+                if (trackedRefs.has(entry.providerRef))
+                    continue;
+                if (entry.status === "stopped" || entry.status === "terminated") {
+                    continue;
+                }
+                orphans.push({
+                    target,
+                    providerRef: entry.providerRef,
+                    status: entry.status,
+                });
+            }
+        }
+        return { orphans, liveCount, estimatedCostUsd };
+    }
+    // --- Attach pointer -----------------------------------------------------
+    /**
+     * Adopt an instance as the active worker: persist the singleton pointer,
+     * mark the instance `attached`, and return its connection info for the
+     * caller to apply to the Python bridge (`bridge.setTarget`). The manager
+     * stays free of a runtime dependency — re-pointing is the caller's job.
+     */
+    async attach(instanceId) {
+        const instance = await this.requireInstance(instanceId);
+        await this.deps.setSetting(ACTIVE_WORKER_KEY, instance.id);
+        // Attaching is itself activity: reset the idle clock alongside the status.
+        // A worker whose provision + attach outran its idle window still carries a
+        // creation-time `last_activity_at` and has emitted no bridge frame yet, so
+        // without this the reaper would stop the worker on its next pass before any
+        // work runs.
+        await this.deps.updateWorkerInstance(instance.id, {
+            status: "attached",
+            last_activity_at: new Date().toISOString(),
+        });
+        return { wsUrl: instance.ws_url, token: instance.token };
+    }
+    /**
+     * Read-only connection target for an instance — the same `{wsUrl, token}`
+     * attach returns, but without mutating the attach pointer or status. Used to
+     * health-probe a worker that is `running` but not yet attached.
+     */
+    async connectionInfo(instanceId) {
+        const instance = await this.requireInstance(instanceId);
+        return { wsUrl: instance.ws_url, token: instance.token };
+    }
+    /**
+     * Release the active worker: clear the pointer and revert the
+     * previously-attached instance to `running`. The caller points the bridge
+     * back at its env/stdio default.
+     */
+    async detach() {
+        const active = await this.getActiveWorker();
+        await this.deps.deleteSetting(ACTIVE_WORKER_KEY);
+        if (active && active.status === "attached") {
+            await this.deps.updateWorkerInstance(active.id, { status: "running" });
+        }
+    }
+    /**
+     * Return the currently-attached instance, or null when none is attached.
+     * Never returns a stopped/dead instance: if the pointer references a row that
+     * has since been stopped/terminated (or vanished), clear it and return null
+     * so consumers don't re-point the bridge at a worker that is no longer live.
+     */
+    async getActiveWorker() {
+        const id = await this.deps.getSetting(ACTIVE_WORKER_KEY);
+        if (!id) {
+            return null;
+        }
+        const instance = await this.deps.getWorkerInstance(id);
+        if (!instance ||
+            instance.status === "stopped" ||
+            instance.status === "terminated") {
+            await this.deps.deleteSetting(ACTIVE_WORKER_KEY);
+            return null;
+        }
+        return instance;
+    }
+    // --- Internals ----------------------------------------------------------
+    /** Drop the active-worker pointer if it currently references `instanceId`. */
+    async clearActivePointerIfMatches(instanceId) {
+        const activeId = await this.deps.getSetting(ACTIVE_WORKER_KEY);
+        if (activeId === instanceId) {
+            await this.deps.deleteSetting(ACTIVE_WORKER_KEY);
+        }
+    }
+    async requireInstance(instanceId) {
+        const instance = await this.deps.getWorkerInstance(instanceId);
+        if (!instance) {
+            throw new Error(`Worker instance not found: ${instanceId}`);
+        }
+        return instance;
+    }
+    async resolveProvider(target) {
+        const apiKey = await this.loadApiKey(target);
+        return this.deps.providerFactory(target, apiKey);
+    }
+    /**
+     * Report whether each target's API key is available — store OR environment,
+     * the SAME resolution `provision` uses. The UI must check this rather than the
+     * secrets list alone, which only sees the store and so false-warns on an
+     * env-provided key.
+     */
+    async apiKeyStatus() {
+        const targets = Object.keys(API_KEY_SECRET);
+        const entries = await Promise.all(targets.map(async (target) => [target, (await this.resolveApiKey(target)) !== null]));
+        return Object.fromEntries(entries);
+    }
+    /**
+     * Load a target's API key from the secret store, falling back to the
+     * environment when the keychain is unreachable (headless/sandboxed). Mirrors
+     * the resolution the deleted `runpod-worker.ts` script used.
+     */
+    async loadApiKey(target) {
+        const key = await this.resolveApiKey(target);
+        if (key !== null) {
+            return key;
+        }
+        const secretName = API_KEY_SECRET[target];
+        throw new Error(`${secretName} not found in the secret store or environment. ` +
+            `Store it with: nodetool secrets store ${secretName}`);
+    }
+    /**
+     * Resolve a target's API key from the secret store, then the environment.
+     * Returns `null` when neither has it (no throw) — shared by `loadApiKey` (which
+     * throws) and `apiKeyStatus` (which reports).
+     */
+    async resolveApiKey(target) {
+        const key = API_KEY_SECRET[target];
+        if (!key) {
+            throw new Error(`No API key mapping for worker target: ${target}`);
+        }
+        const fromStore = await this.deps.getSecret(key, LOCAL_USER_ID);
+        if (fromStore) {
+            return fromStore;
+        }
+        return process.env[key] ?? null;
+    }
+}
+/** Build a provision spec from a profile's declarative fields. */
+function specFromProfile(profile, target, token) {
+    const spec = profile.spec ?? {};
+    return {
+        name: profile.name,
+        image: profile.image,
+        target,
+        gpu: typeof spec.gpu === "string" ? spec.gpu : undefined,
+        vcpu: typeof spec.vcpu === "number" ? spec.vcpu : undefined,
+        disk: typeof spec.disk === "number" ? spec.disk : undefined,
+        env: isStringRecord(spec.env) ? spec.env : undefined,
+        sshPublicKey: typeof spec.sshPublicKey === "string" ? spec.sshPublicKey : undefined,
+        token,
+    };
+}
+function isStringRecord(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        Object.values(value).every((v) => typeof v === "string"));
+}
+/** Generate a high-entropy worker bearer token. */
+function generateToken() {
+    return randomBytes(32).toString("hex");
+}
+//# sourceMappingURL=manager.js.map