@shravansunder/agent-vm 0.0.1

package/dist/backup/backup-archive-layout.d.ts

@@ -0,0 +1,15 @@
+import type { BackupResult } from './backup-manager.js';
+export declare const BACKUP_FILENAME_DELIMITER = "__";
+export declare function buildBackupPaths(options: {
+    readonly backupDir: string;
+    readonly timestamp: string;
+    readonly zoneId: string;
+}): {
+    readonly encryptedPath: string;
+    readonly tarPath: string;
+};
+export declare function listBackupArtifacts(options: {
+    readonly backupDir: string;
+    readonly zoneId?: string;
+}): BackupResult[];
+//# sourceMappingURL=backup-archive-layout.d.ts.map

package/dist/backup/backup-archive-layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-archive-layout.d.ts","sourceRoot":"","sources":["../../src/backup/backup-archive-layout.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,GAAG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAOA;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,YAAY,EAAE,CA0BjB"}

package/dist/backup/backup-archive-layout.js

@@ -0,0 +1,34 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const BACKUP_FILENAME_DELIMITER = '__';
+export function buildBackupPaths(options) {
+    const tarName = `${options.zoneId}${BACKUP_FILENAME_DELIMITER}${options.timestamp}.tar`;
+    const tarPath = path.join(options.backupDir, tarName);
+    return {
+        encryptedPath: `${tarPath}.age`,
+        tarPath,
+    };
+}
+export function listBackupArtifacts(options) {
+    if (!fs.existsSync(options.backupDir)) {
+        return [];
+    }
+    const backupFiles = fs
+        .readdirSync(options.backupDir)
+        .filter((fileName) => fileName.endsWith('.tar.age'));
+    const filteredFiles = options.zoneId
+        ? backupFiles.filter((fileName) => fileName.startsWith(`${options.zoneId}${BACKUP_FILENAME_DELIMITER}`))
+        : backupFiles;
+    return filteredFiles.map((fileName) => {
+        const fileStem = fileName.replace('.tar.age', '');
+        const delimiterIndex = fileStem.indexOf(BACKUP_FILENAME_DELIMITER);
+        return {
+            backupPath: path.join(options.backupDir, fileName),
+            timestamp: delimiterIndex >= 0
+                ? fileStem.slice(delimiterIndex + BACKUP_FILENAME_DELIMITER.length)
+                : '',
+            zoneId: delimiterIndex >= 0 ? fileStem.slice(0, delimiterIndex) : fileStem,
+        };
+    });
+}
+//# sourceMappingURL=backup-archive-layout.js.map

package/dist/backup/backup-archive-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-archive-layout.js","sourceRoot":"","sources":["../../src/backup/backup-archive-layout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,gBAAgB,CAAC,OAIhC;IAIA,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,yBAAyB,GAAG,OAAO,CAAC,SAAS,MAAM,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO;QACN,aAAa,EAAE,GAAG,OAAO,MAAM;QAC/B,OAAO;KACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAGnC;IACA,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,EAAE;SACpB,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SAC9B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM;QACnC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChC,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC,CACpE;QACF,CAAC,CAAC,WAAW,CAAC;IAEf,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnE,OAAO;YACN,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;YAClD,SAAS,EACR,cAAc,IAAI,CAAC;gBAClB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,GAAG,yBAAyB,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAC,EAAE;YACN,MAAM,EAAE,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC1E,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/backup/backup-create-operation.d.ts

@@ -0,0 +1,9 @@
+import type { BackupEncryption, BackupResult } from './backup-manager.js';
+export declare function createEncryptedBackup(options: {
+    readonly backupDir: string;
+    readonly encryption: BackupEncryption;
+    readonly stateDir: string;
+    readonly workspaceDir: string;
+    readonly zoneId: string;
+}): Promise<BackupResult>;
+//# sourceMappingURL=backup-create-operation.d.ts.map

package/dist/backup/backup-create-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-create-operation.d.ts","sourceRoot":"","sources":["../../src/backup/backup-create-operation.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI1E,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiDxB"}

package/dist/backup/backup-create-operation.js

@@ -0,0 +1,50 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { buildBackupPaths } from './backup-archive-layout.js';
+const execFileAsync = promisify(execFile);
+export async function createEncryptedBackup(options) {
+    const timestamp = new Date().toISOString().replace(/[:.]/gu, '-');
+    const backupPaths = buildBackupPaths({
+        backupDir: options.backupDir,
+        timestamp,
+        zoneId: options.zoneId,
+    });
+    await fs.mkdir(options.backupDir, { recursive: true });
+    const stagingDirectory = await fs.mkdtemp(path.join(os.tmpdir(), 'backup-stage-'));
+    try {
+        await execFileAsync('cp', ['-a', options.stateDir, path.join(stagingDirectory, 'state')]);
+        await execFileAsync('cp', [
+            '-a',
+            options.workspaceDir,
+            path.join(stagingDirectory, 'workspace'),
+        ]);
+        await fs.writeFile(path.join(stagingDirectory, 'manifest.json'), JSON.stringify({
+            createdAt: new Date().toISOString(),
+            timestamp,
+            zoneId: options.zoneId,
+        }));
+        await execFileAsync('tar', [
+            'cf',
+            backupPaths.tarPath,
+            '-C',
+            stagingDirectory,
+            'state',
+            'workspace',
+            'manifest.json',
+        ]);
+    }
+    finally {
+        await fs.rm(stagingDirectory, { recursive: true, force: true });
+    }
+    await options.encryption.encrypt(backupPaths.tarPath, backupPaths.encryptedPath);
+    await fs.unlink(backupPaths.tarPath);
+    return {
+        backupPath: backupPaths.encryptedPath,
+        timestamp,
+        zoneId: options.zoneId,
+    };
+}
+//# sourceMappingURL=backup-create-operation.js.map

package/dist/backup/backup-create-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-create-operation.js","sourceRoot":"","sources":["../../src/backup/backup-create-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAM3C;IACA,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IAEH,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvD,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC;QACJ,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,aAAa,CAAC,IAAI,EAAE;YACzB,IAAI;YACJ,OAAO,CAAC,YAAY;YACpB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,SAAS,CACjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC,CACF,CAAC;QAEF,MAAM,aAAa,CAAC,KAAK,EAAE;YAC1B,IAAI;YACJ,WAAW,CAAC,OAAO;YACnB,IAAI;YACJ,gBAAgB;YAChB,OAAO;YACP,WAAW;YACX,eAAe;SACf,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACjF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO;QACN,UAAU,EAAE,WAAW,CAAC,aAAa;QACrC,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC;AACH,CAAC"}

package/dist/backup/backup-encryption.d.ts

@@ -0,0 +1,20 @@
+import type { BackupEncryption } from './backup-manager.js';
+interface AgeEncryptionDependencies {
+    /** Resolves the age identity (secret key) string from 1Password.
+     *  Format: AGE-SECRET-KEY-1... (the full key line from age-keygen).
+     *  Store this in 1Password as a "password" field. Generate with: age-keygen */
+    readonly resolveIdentity: () => Promise<string>;
+}
+/**
+ * Age identity-key-based encryption for zone backups.
+ *
+ * Uses age public-key encryption: the identity key (AGE-SECRET-KEY-1...)
+ * is stored in 1Password per zone. The public key (recipient) is derived
+ * at encryption time via age-keygen -y.
+ *
+ * Secret keys are never written to disk — they're passed via stdin
+ * using /dev/stdin as the identity file path.
+ */
+export declare function createAgeBackupEncryption(dependencies: AgeEncryptionDependencies): BackupEncryption;
+export {};
+//# sourceMappingURL=backup-encryption.d.ts.map

package/dist/backup/backup-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-encryption.d.ts","sourceRoot":"","sources":["../../src/backup/backup-encryption.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,UAAU,yBAAyB;IAClC;;mFAE+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD;AAiDD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACxC,YAAY,EAAE,yBAAyB,GACrC,gBAAgB,CAuBlB"}

package/dist/backup/backup-encryption.js

@@ -0,0 +1,71 @@
+import { spawn } from 'node:child_process';
+/**
+ * Run a command with optional stdin input. Returns stdout as a string.
+ * Rejects if the process exits non-zero.
+ */
+function runWithStdin(command, args, stdinInput) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], { stdio: ['pipe', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (data) => {
+            stdout += data.toString('utf8');
+        });
+        child.stderr.on('data', (data) => {
+            stderr += data.toString('utf8');
+        });
+        child.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`${command} failed (exit ${code}): ${stderr.trim()}`));
+                return;
+            }
+            resolve(stdout);
+        });
+        if (stdinInput !== undefined) {
+            child.stdin.write(stdinInput);
+            child.stdin.end();
+        }
+        else {
+            child.stdin.end();
+        }
+    });
+}
+/**
+ * Derive the public key (recipient) from an age identity key via stdin.
+ * No temp files — the secret key stays in memory.
+ */
+async function deriveRecipientFromIdentity(identityLine) {
+    const stdout = await runWithStdin('age-keygen', ['-y', '/dev/stdin'], identityLine + '\n');
+    return stdout.trim();
+}
+/**
+ * Age identity-key-based encryption for zone backups.
+ *
+ * Uses age public-key encryption: the identity key (AGE-SECRET-KEY-1...)
+ * is stored in 1Password per zone. The public key (recipient) is derived
+ * at encryption time via age-keygen -y.
+ *
+ * Secret keys are never written to disk — they're passed via stdin
+ * using /dev/stdin as the identity file path.
+ */
+export function createAgeBackupEncryption(dependencies) {
+    return {
+        encrypt: async (inputPath, outputPath) => {
+            const identity = await dependencies.resolveIdentity();
+            const recipient = await deriveRecipientFromIdentity(identity);
+            await runWithStdin('age', [
+                '--encrypt',
+                '--recipient',
+                recipient,
+                '--output',
+                outputPath,
+                inputPath,
+            ]);
+        },
+        decrypt: async (inputPath, outputPath) => {
+            const identity = await dependencies.resolveIdentity();
+            await runWithStdin('age', ['--decrypt', '--identity', '/dev/stdin', '--output', outputPath, inputPath], identity + '\n');
+        },
+    };
+}
+//# sourceMappingURL=backup-encryption.js.map

package/dist/backup/backup-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-encryption.js","sourceRoot":"","sources":["../../src/backup/backup-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAW3C;;;GAGG;AACH,SAAS,YAAY,CACpB,OAAe,EACf,IAAuB,EACvB,UAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,OAAO,iBAAiB,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBACxE,OAAO;YACR,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACxC,YAAuC;IAEvC,OAAO;QACN,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,YAAY,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,aAAa;gBACb,SAAS;gBACT,UAAU;gBACV,UAAU;gBACV,SAAS;aACT,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC;YACtD,MAAM,YAAY,CACjB,KAAK,EACL,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAC5E,QAAQ,GAAG,IAAI,CACf,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/backup/backup-manager.d.ts

@@ -0,0 +1,42 @@
+export interface BackupEncryption {
+    readonly encrypt: (inputPath: string, outputPath: string) => Promise<void>;
+    readonly decrypt: (inputPath: string, outputPath: string) => Promise<void>;
+}
+export interface BackupResult {
+    readonly backupPath: string;
+    readonly timestamp: string;
+    readonly zoneId: string;
+}
+export interface BackupRestoreResult {
+    readonly stateDir: string;
+    readonly workspaceDir: string;
+    readonly zoneId: string;
+}
+export interface ZoneBackupManager {
+    createBackup(options: {
+        readonly zoneId: string;
+        readonly stateDir: string;
+        readonly workspaceDir: string;
+        readonly backupDir: string;
+    }): Promise<BackupResult>;
+    restoreBackup(options: {
+        readonly backupPath: string;
+        readonly stateDir: string;
+        readonly workspaceDir: string;
+    }): Promise<BackupRestoreResult>;
+    listBackups(options: {
+        readonly backupDir: string;
+        readonly zoneId?: string;
+    }): BackupResult[];
+}
+/**
+ * Archive layout inside the tar:
+ *   state/      — contents of stateDir
+ *   workspace/  — contents of workspaceDir
+ *   manifest.json
+ *
+ * This fixed layout decouples archive structure from host paths, so stateDir
+ * and workspaceDir can live under completely different parents on restore.
+ */
+export declare function createZoneBackupManager(encryption: BackupEncryption): ZoneBackupManager;
+//# sourceMappingURL=backup-manager.d.ts.map

package/dist/backup/backup-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-manager.d.ts","sourceRoot":"","sources":["../../src/backup/backup-manager.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IACjC,YAAY,CAAC,OAAO,EAAE;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1B,aAAa,CAAC,OAAO,EAAE;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEjC,WAAW,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,EAAE,CAAC;CAC/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,gBAAgB,GAAG,iBAAiB,CAuBvF"}

package/dist/backup/backup-manager.js

@@ -0,0 +1,37 @@
+import { listBackupArtifacts } from './backup-archive-layout.js';
+import { createEncryptedBackup } from './backup-create-operation.js';
+import { restoreEncryptedBackup } from './backup-restore-operation.js';
+/**
+ * Archive layout inside the tar:
+ *   state/      — contents of stateDir
+ *   workspace/  — contents of workspaceDir
+ *   manifest.json
+ *
+ * This fixed layout decouples archive structure from host paths, so stateDir
+ * and workspaceDir can live under completely different parents on restore.
+ */
+export function createZoneBackupManager(encryption) {
+    return {
+        async createBackup(options) {
+            return await createEncryptedBackup({
+                encryption,
+                backupDir: options.backupDir,
+                stateDir: options.stateDir,
+                workspaceDir: options.workspaceDir,
+                zoneId: options.zoneId,
+            });
+        },
+        async restoreBackup(options) {
+            return await restoreEncryptedBackup({
+                encryption,
+                backupPath: options.backupPath,
+                stateDir: options.stateDir,
+                workspaceDir: options.workspaceDir,
+            });
+        },
+        listBackups(options) {
+            return listBackupArtifacts(options);
+        },
+    };
+}
+//# sourceMappingURL=backup-manager.js.map

package/dist/backup/backup-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-manager.js","sourceRoot":"","sources":["../../src/backup/backup-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAoCvE;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAA4B;IACnE,OAAO;QACN,KAAK,CAAC,YAAY,CAAC,OAAO;YACzB,OAAO,MAAM,qBAAqB,CAAC;gBAClC,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,OAAO;YAC1B,OAAO,MAAM,sBAAsB,CAAC;gBACnC,UAAU;gBACV,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;aAClC,CAAC,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,OAAO;YAClB,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/backup/backup-restore-operation.d.ts

@@ -0,0 +1,8 @@
+import type { BackupEncryption, BackupRestoreResult } from './backup-manager.js';
+export declare function restoreEncryptedBackup(options: {
+    readonly backupPath: string;
+    readonly encryption: BackupEncryption;
+    readonly stateDir: string;
+    readonly workspaceDir: string;
+}): Promise<BackupRestoreResult>;
+//# sourceMappingURL=backup-restore-operation.d.ts.map

package/dist/backup/backup-restore-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore-operation.d.ts","sourceRoot":"","sources":["../../src/backup/backup-restore-operation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAqCjF,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsB/B"}

package/dist/backup/backup-restore-operation.js

@@ -0,0 +1,53 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+async function copyExtractedDirectoryContents(sourceDirectory, targetDirectory) {
+    try {
+        await fs.access(sourceDirectory);
+    }
+    catch {
+        return;
+    }
+    const entries = await fs.readdir(sourceDirectory);
+    await Promise.all(entries.map(async (entryName) => {
+        await execFileAsync('cp', [
+            '-a',
+            path.join(sourceDirectory, entryName),
+            path.join(targetDirectory, entryName),
+        ]);
+    }));
+}
+async function readZoneIdFromManifest(extractDirectory) {
+    const manifestPath = path.join(extractDirectory, 'manifest.json');
+    try {
+        const rawManifest = await fs.readFile(manifestPath, 'utf8');
+        const manifest = JSON.parse(rawManifest);
+        return manifest.zoneId ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+export async function restoreEncryptedBackup(options) {
+    const decryptedTarPath = `${options.backupPath}.decrypted.tar`;
+    await options.encryption.decrypt(options.backupPath, decryptedTarPath);
+    const extractDirectory = await fs.mkdtemp(path.join(os.tmpdir(), 'backup-extract-'));
+    try {
+        await execFileAsync('tar', ['xf', decryptedTarPath, '-C', extractDirectory]);
+        await copyExtractedDirectoryContents(path.join(extractDirectory, 'state'), options.stateDir);
+        await copyExtractedDirectoryContents(path.join(extractDirectory, 'workspace'), options.workspaceDir);
+        return {
+            stateDir: options.stateDir,
+            workspaceDir: options.workspaceDir,
+            zoneId: await readZoneIdFromManifest(extractDirectory),
+        };
+    }
+    finally {
+        await fs.rm(extractDirectory, { recursive: true, force: true });
+        await fs.unlink(decryptedTarPath);
+    }
+}
+//# sourceMappingURL=backup-restore-operation.js.map

package/dist/backup/backup-restore-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore-operation.js","sourceRoot":"","sources":["../../src/backup/backup-restore-operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,KAAK,UAAU,8BAA8B,CAC5C,eAAuB,EACvB,eAAuB;IAEvB,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,OAAO,CAAC,GAAG,CAChB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC/B,MAAM,aAAa,CAAC,IAAI,EAAE;YACzB,IAAI;YACJ,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC;SACrC,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,gBAAwB;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiC,CAAC;QACzE,OAAO,QAAQ,CAAC,MAAM,IAAI,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C;IACA,MAAM,gBAAgB,GAAG,GAAG,OAAO,CAAC,UAAU,gBAAgB,CAAC;IAC/D,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAEvE,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC;QACJ,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC7E,MAAM,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7F,MAAM,8BAA8B,CACnC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EACxC,OAAO,CAAC,YAAY,CACpB,CAAC;QAEF,OAAO;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,sBAAsB,CAAC,gBAAgB,CAAC;SACtD,CAAC;IACH,CAAC;YAAS,CAAC;QACV,MAAM,EAAE,CAAC,EAAE,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;AACF,CAAC"}

package/dist/build/docker-image-builder.d.ts

@@ -0,0 +1,9 @@
+export interface DockerImageBuilderDependencies {
+    readonly executeCommand?: (command: string, args: readonly string[]) => Promise<void>;
+}
+export interface BuildDockerImageOptions {
+    readonly dockerfilePath: string;
+    readonly imageTag: string;
+}
+export declare function buildDockerImage(options: BuildDockerImageOptions, dependencies?: DockerImageBuilderDependencies): Promise<void>;
+//# sourceMappingURL=docker-image-builder.d.ts.map

package/dist/build/docker-image-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-image-builder.d.ts","sourceRoot":"","sources":["../../src/build/docker-image-builder.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AASD,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,8BAAmC,GAC/C,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/build/docker-image-builder.js

@@ -0,0 +1,24 @@
+import path from 'node:path';
+import { execa } from 'execa';
+async function executeDockerCommand(command, arguments_) {
+    await execa(command, arguments_, { stdio: 'inherit' });
+}
+export async function buildDockerImage(options, dependencies = {}) {
+    const executeCommand = dependencies.executeCommand ?? executeDockerCommand;
+    const resolvedDockerfilePath = path.resolve(options.dockerfilePath);
+    const contextDirectory = path.dirname(resolvedDockerfilePath);
+    try {
+        await executeCommand('docker', [
+            'build',
+            '-f',
+            resolvedDockerfilePath,
+            '-t',
+            options.imageTag,
+            contextDirectory,
+        ]);
+    }
+    catch (error) {
+        throw new Error(`Docker build failed for ${options.imageTag}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
+//# sourceMappingURL=docker-image-builder.js.map

package/dist/build/docker-image-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-image-builder.js","sourceRoot":"","sources":["../../src/build/docker-image-builder.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAW9B,KAAK,UAAU,oBAAoB,CAClC,OAAe,EACf,UAA6B;IAE7B,MAAM,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAgC,EAChC,eAA+C,EAAE;IAEjD,MAAM,cAAc,GAAG,YAAY,CAAC,cAAc,IAAI,oBAAoB,CAAC;IAC3E,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE9D,IAAI,CAAC;QACJ,MAAM,cAAc,CAAC,QAAQ,EAAE;YAC9B,OAAO;YACP,IAAI;YACJ,sBAAsB;YACtB,IAAI;YACJ,OAAO,CAAC,QAAQ;YAChB,gBAAgB;SAChB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,2BAA2B,OAAO,CAAC,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxG,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC"}

package/dist/build/gondolin-image-builder.d.ts

@@ -0,0 +1,12 @@
+import { type BuildConfig, type BuildImageOptions, type BuildImageResult } from '@shravansunder/agent-vm-gondolin-core';
+export interface GondolinImageBuilderDependencies {
+    readonly buildImage?: (options: BuildImageOptions) => Promise<BuildImageResult>;
+    readonly loadBuildConfig?: (buildConfigPath: string) => Promise<BuildConfig>;
+}
+export declare function buildGondolinImage(options: {
+    readonly buildConfigPath: string;
+    readonly cacheDir: string;
+    readonly fullReset?: boolean;
+}, dependencies?: GondolinImageBuilderDependencies): Promise<BuildImageResult>;
+export declare function computeFingerprintFromConfigPath(buildConfigPath: string, dependencies?: Pick<GondolinImageBuilderDependencies, 'loadBuildConfig'>): Promise<string>;
+//# sourceMappingURL=gondolin-image-builder.d.ts.map

package/dist/build/gondolin-image-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-image-builder.d.ts","sourceRoot":"","sources":["../../src/build/gondolin-image-builder.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,uCAAuC,CAAC;AAE/C,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChF,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7E;AAMD,wBAAsB,kBAAkB,CACvC,OAAO,EAAE;IACR,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC7B,EACD,YAAY,GAAE,gCAAqC,GACjD,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED,wBAAsB,gCAAgC,CACrD,eAAe,EAAE,MAAM,EACvB,YAAY,GAAE,IAAI,CAAC,gCAAgC,EAAE,iBAAiB,CAAM,GAC1E,OAAO,CAAC,MAAM,CAAC,CAGjB"}

package/dist/build/gondolin-image-builder.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildImage as buildImageFromCore, computeBuildFingerprint, } from '@shravansunder/agent-vm-gondolin-core';
+async function loadBuildConfigFromJson(buildConfigPath) {
+    return JSON.parse(await fs.readFile(buildConfigPath, 'utf8'));
+}
+export async function buildGondolinImage(options, dependencies = {}) {
+    const loadBuildConfig = dependencies.loadBuildConfig ?? loadBuildConfigFromJson;
+    const buildImage = dependencies.buildImage ?? buildImageFromCore;
+    const configDirectory = path.dirname(path.resolve(options.buildConfigPath));
+    const buildConfig = await loadBuildConfig(options.buildConfigPath);
+    return await buildImage({
+        buildConfig,
+        cacheDir: options.cacheDir,
+        configDir: configDirectory,
+        ...(options.fullReset !== undefined ? { fullReset: options.fullReset } : {}),
+    });
+}
+export async function computeFingerprintFromConfigPath(buildConfigPath, dependencies = {}) {
+    const loadBuildConfig = dependencies.loadBuildConfig ?? loadBuildConfigFromJson;
+    return computeBuildFingerprint(await loadBuildConfig(buildConfigPath));
+}
+//# sourceMappingURL=gondolin-image-builder.js.map

package/dist/build/gondolin-image-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-image-builder.js","sourceRoot":"","sources":["../../src/build/gondolin-image-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACN,UAAU,IAAI,kBAAkB,EAChC,uBAAuB,GAIvB,MAAM,uCAAuC,CAAC;AAO/C,KAAK,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAgB,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAIC,EACD,eAAiD,EAAE;IAEnD,MAAM,eAAe,GAAG,YAAY,CAAC,eAAe,IAAI,uBAAuB,CAAC;IAChF,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,IAAI,kBAAkB,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAEnE,OAAO,MAAM,UAAU,CAAC;QACvB,WAAW;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,eAAe;QAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACrD,eAAuB,EACvB,eAA0E,EAAE;IAE5E,MAAM,eAAe,GAAG,YAAY,CAAC,eAAe,IAAI,uBAAuB,CAAC;IAChF,OAAO,uBAAuB,CAAC,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/build/stale-image-cleaner.d.ts

@@ -0,0 +1,15 @@
+export interface StaleImageEntry {
+    readonly absolutePath: string;
+    readonly imageType: 'gateway' | 'tool';
+    readonly name: string;
+    readonly sizeBytes: number;
+}
+export declare function findStaleImageDirectories(options: {
+    readonly cacheDir: string;
+    readonly currentFingerprints: {
+        readonly gateway: string;
+        readonly tool: string;
+    };
+}): readonly StaleImageEntry[];
+export declare function deleteStaleImageDirectories(entries: readonly StaleImageEntry[]): void;
+//# sourceMappingURL=stale-image-cleaner.d.ts.map

package/dist/build/stale-image-cleaner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-image-cleaner.d.ts","sourceRoot":"","sources":["../../src/build/stale-image-cleaner.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAoBD,wBAAgB,yBAAyB,CAAC,OAAO,EAAE;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF,GAAG,SAAS,eAAe,EAAE,CA2B7B;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,GAAG,IAAI,CAIrF"}

package/dist/build/stale-image-cleaner.js

@@ -0,0 +1,46 @@
+import fs from 'node:fs';
+import path from 'node:path';
+function getDirectorySizeBytes(directoryPath) {
+    let totalSizeBytes = 0;
+    try {
+        for (const entry of fs.readdirSync(directoryPath, { withFileTypes: true })) {
+            if (!entry.isFile()) {
+                continue;
+            }
+            totalSizeBytes += fs.statSync(path.join(directoryPath, entry.name)).size;
+        }
+    }
+    catch {
+        return 0;
+    }
+    return totalSizeBytes;
+}
+export function findStaleImageDirectories(options) {
+    const staleEntries = [];
+    for (const imageType of ['gateway', 'tool']) {
+        const typeDirectory = path.join(options.cacheDir, 'images', imageType);
+        if (!fs.existsSync(typeDirectory)) {
+            continue;
+        }
+        const currentFingerprint = options.currentFingerprints[imageType];
+        for (const entry of fs.readdirSync(typeDirectory, { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.name === currentFingerprint) {
+                continue;
+            }
+            const absolutePath = path.join(typeDirectory, entry.name);
+            staleEntries.push({
+                absolutePath,
+                imageType,
+                name: entry.name,
+                sizeBytes: getDirectorySizeBytes(absolutePath),
+            });
+        }
+    }
+    return staleEntries;
+}
+export function deleteStaleImageDirectories(entries) {
+    for (const entry of entries) {
+        fs.rmSync(entry.absolutePath, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=stale-image-cleaner.js.map

package/dist/build/stale-image-cleaner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-image-cleaner.js","sourceRoot":"","sources":["../../src/build/stale-image-cleaner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,SAAS,qBAAqB,CAAC,aAAqB;IACnD,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,CAAC;QACJ,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,SAAS;YACV,CAAC;YAED,cAAc,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC;IACV,CAAC;IAED,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAGzC;IACA,MAAM,YAAY,GAAsB,EAAE,CAAC;IAE3C,KAAK,MAAM,SAAS,IAAI,CAAC,SAAS,EAAE,MAAM,CAAU,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,SAAS;QACV,CAAC;QAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAElE,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC/D,SAAS;YACV,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1D,YAAY,CAAC,IAAI,CAAC;gBACjB,YAAY;gBACZ,SAAS;gBACT,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,qBAAqB,CAAC,YAAY,CAAC;aAC9C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAmC;IAC9E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACF,CAAC"}

package/dist/cli/agent-vm-cli-support.d.ts

@@ -0,0 +1,68 @@
+import type { SecretResolver } from '@shravansunder/agent-vm-gondolin-core';
+import { createOpCliSecretResolver, resolveServiceAccountToken } from '@shravansunder/agent-vm-gondolin-core';
+import { createAgeBackupEncryption } from '../backup/backup-encryption.js';
+import { createZoneBackupManager } from '../backup/backup-manager.js';
+import { loadSystemConfig, type SystemConfig } from '../config/system-config.js';
+import type { ControllerRuntimeDependencies } from '../controller/controller-runtime-types.js';
+import { createControllerClient } from '../controller/http/controller-client.js';
+import { startGatewayZone } from '../gateway/gateway-zone-orchestrator.js';
+import { buildControllerStatus } from '../operations/controller-status.js';
+import { runControllerDoctor } from '../operations/doctor.js';
+import { runBuildCommand } from './build-command.js';
+import { runCacheCommand } from './cache-commands.js';
+import { type GatewayType, type ScaffoldAgentVmProjectResult } from './init-command.js';
+export interface CliDependencies {
+    readonly buildControllerStatus: typeof buildControllerStatus;
+    readonly createAgeBackupEncryption: typeof createAgeBackupEncryption;
+    readonly createControllerClient: typeof createControllerClient;
+    readonly createSecretResolver: typeof createOpCliSecretResolver;
+    readonly createZoneBackupManager: typeof createZoneBackupManager;
+    readonly getCurrentWorkingDirectory?: () => string;
+    readonly isGatewayImageCached?: (systemConfig: SystemConfig) => Promise<boolean>;
+    readonly loadSystemConfig: typeof loadSystemConfig;
+    readonly runBuildCommand?: typeof runBuildCommand;
+    readonly runCacheCommand?: typeof runCacheCommand;
+    readonly runCommand?: (command: string, arguments_: readonly string[]) => Promise<{
+        readonly exitCode: number;
+        readonly stderr: string;
+        readonly stdout: string;
+    }>;
+    readonly runInteractiveProcess?: (command: string, arguments_: readonly string[]) => Promise<void>;
+    readonly resolveServiceAccountToken: typeof resolveServiceAccountToken;
+    readonly runControllerDoctor: typeof runControllerDoctor;
+    readonly promptAndStoreServiceAccountToken?: () => Promise<boolean>;
+    readonly scaffoldAgentVmProject?: (options: {
+        readonly gatewayType: GatewayType;
+        readonly targetDir: string;
+        readonly zoneId: string;
+    }) => Promise<ScaffoldAgentVmProjectResult>;
+    readonly startControllerRuntime: (options: {
+        readonly systemConfig: SystemConfig;
+        readonly zoneId: string;
+    }, runtimeDependencies?: ControllerRuntimeDependencies) => Promise<{
+        readonly controllerPort: number;
+        readonly gateway: {
+            readonly ingress: {
+                readonly host: string;
+                readonly port: number;
+            };
+            readonly vm: {
+                readonly id: string;
+            };
+        };
+    }>;
+    readonly startGatewayZone: typeof startGatewayZone;
+}
+export interface CliIo {
+    readonly stderr: Pick<NodeJS.WriteStream, 'write'>;
+    readonly stdout: Pick<NodeJS.WriteStream, 'write'>;
+}
+export declare const defaultCliDependencies: CliDependencies;
+export declare function writeJson(io: CliIo, value: unknown): void;
+export declare function resolveConfigPath(argv: readonly string[]): string;
+export declare function readZoneFlag(argv: readonly string[]): string | undefined;
+export declare function resolveControllerBaseUrl(systemConfig: SystemConfig): string;
+export declare function findZone(systemConfig: SystemConfig, zoneId: string): SystemConfig['zones'][number];
+export declare function requireZone(systemConfig: SystemConfig, zoneFlag: string | undefined): SystemConfig['zones'][number];
+export declare function createResolverFromSystemConfig(systemConfig: SystemConfig, dependencies: Pick<CliDependencies, 'createSecretResolver' | 'resolveServiceAccountToken'>): Promise<SecretResolver>;
+//# sourceMappingURL=agent-vm-cli-support.d.ts.map