@shravansunder/agent-vm 0.0.1

package/dist/controller/leases/lease-manager.d.ts

@@ -0,0 +1,57 @@
+import type { ManagedVm } from '@shravansunder/agent-vm-gondolin-core';
+import type { TcpPool } from './tcp-pool.js';
+export interface ToolProfile {
+    readonly cpus: number;
+    readonly memory: string;
+    readonly workspaceRoot: string;
+}
+export interface Lease {
+    readonly cleanWorkspace?: () => Promise<void>;
+    readonly createdAt: number;
+    readonly id: string;
+    readonly lastUsedAt: number;
+    readonly profileId: string;
+    readonly scopeKey: string;
+    readonly sshAccess: {
+        readonly command?: string;
+        readonly host: string;
+        readonly identityFile?: string;
+        readonly port: number;
+        readonly user?: string;
+    };
+    readonly tcpSlot: number;
+    readonly vm: ManagedVm;
+    readonly zoneId: string;
+}
+export interface LeaseManager {
+    createLease(options: {
+        readonly agentWorkspaceDir: string;
+        readonly profile: ToolProfile;
+        readonly profileId: string;
+        readonly scopeKey: string;
+        readonly workspaceDir: string;
+        readonly zoneId: string;
+    }): Promise<Lease>;
+    getLease(leaseId: string): Lease | undefined;
+    listLeases(): Lease[];
+    releaseLease(leaseId: string): Promise<void>;
+}
+export declare function createLeaseManager(options: {
+    readonly cleanWorkspace?: (leaseOptions: {
+        readonly profile: ToolProfile;
+        readonly tcpSlot: number;
+        readonly zoneId: string;
+    }) => Promise<void>;
+    readonly createManagedVm: (leaseOptions: {
+        readonly agentWorkspaceDir: string;
+        readonly profile: ToolProfile;
+        readonly profileId: string;
+        readonly scopeKey: string;
+        readonly tcpSlot: number;
+        readonly workspaceDir: string;
+        readonly zoneId: string;
+    }) => Promise<ManagedVm>;
+    readonly now: () => number;
+    readonly tcpPool: TcpPool;
+}): LeaseManager;
+//# sourceMappingURL=lease-manager.d.ts.map

package/dist/controller/leases/lease-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-manager.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/lease-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,KAAK;IACrB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC5B,WAAW,CAAC,OAAO,EAAE;QACpB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7C,UAAU,IAAI,KAAK,EAAE,CAAC;IACtB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE;QACxC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,QAAQ,CAAC,eAAe,EAAE,CAAC,YAAY,EAAE;QACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B,GAAG,YAAY,CAmFf"}

package/dist/controller/leases/lease-manager.js

@@ -0,0 +1,83 @@
+export function createLeaseManager(options) {
+    const leases = new Map();
+    return {
+        async createLease(leaseOptions) {
+            const tcpSlot = options.tcpPool.allocate();
+            try {
+                const vm = await options.createManagedVm({
+                    ...leaseOptions,
+                    tcpSlot,
+                });
+                try {
+                    const sshAccess = await vm.enableSsh({
+                        listenPort: options.tcpPool.portForSlot(tcpSlot),
+                    });
+                    const createdAt = options.now();
+                    const lease = {
+                        ...(options.cleanWorkspace
+                            ? {
+                                cleanWorkspace: async () => await options.cleanWorkspace?.({
+                                    profile: leaseOptions.profile,
+                                    tcpSlot,
+                                    zoneId: leaseOptions.zoneId,
+                                }),
+                            }
+                            : {}),
+                        createdAt,
+                        id: `${leaseOptions.zoneId}-${leaseOptions.scopeKey}-${createdAt}`,
+                        lastUsedAt: createdAt,
+                        profileId: leaseOptions.profileId,
+                        scopeKey: leaseOptions.scopeKey,
+                        sshAccess,
+                        tcpSlot,
+                        vm,
+                        zoneId: leaseOptions.zoneId,
+                    };
+                    leases.set(lease.id, lease);
+                    return lease;
+                }
+                catch (error) {
+                    await vm.close().catch(() => { });
+                    throw error;
+                }
+            }
+            catch (error) {
+                options.tcpPool.release(tcpSlot);
+                throw error;
+            }
+        },
+        getLease(leaseId) {
+            return leases.get(leaseId);
+        },
+        listLeases() {
+            return [...leases.values()];
+        },
+        async releaseLease(leaseId) {
+            const lease = leases.get(leaseId);
+            if (!lease) {
+                return;
+            }
+            let releaseError;
+            try {
+                await lease.vm.close();
+            }
+            catch (error) {
+                releaseError = error instanceof Error ? error : new Error(String(error));
+            }
+            try {
+                await lease.cleanWorkspace?.();
+            }
+            catch (error) {
+                if (!releaseError) {
+                    releaseError = error instanceof Error ? error : new Error(String(error));
+                }
+            }
+            leases.delete(leaseId);
+            options.tcpPool.release(lease.tcpSlot);
+            if (releaseError) {
+                throw releaseError;
+            }
+        },
+    };
+}
+//# sourceMappingURL=lease-manager.js.map

package/dist/controller/leases/lease-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-manager.js","sourceRoot":"","sources":["../../../src/controller/leases/lease-manager.ts"],"names":[],"mappings":"AA2CA,MAAM,UAAU,kBAAkB,CAAC,OAiBlC;IACA,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IAExC,OAAO;QACN,KAAK,CAAC,WAAW,CAAC,YAAY;YAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACJ,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;oBACxC,GAAG,YAAY;oBACf,OAAO;iBACP,CAAC,CAAC;gBACH,IAAI,CAAC;oBACJ,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC;wBACpC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;qBAChD,CAAC,CAAC;oBACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;oBAChC,MAAM,KAAK,GAAU;wBACpB,GAAG,CAAC,OAAO,CAAC,cAAc;4BACzB,CAAC,CAAC;gCACA,cAAc,EAAE,KAAK,IAAI,EAAE,CAC1B,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC;oCAC9B,OAAO,EAAE,YAAY,CAAC,OAAO;oCAC7B,OAAO;oCACP,MAAM,EAAE,YAAY,CAAC,MAAM;iCAC3B,CAAC;6BACH;4BACF,CAAC,CAAC,EAAE,CAAC;wBACN,SAAS;wBACT,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,QAAQ,IAAI,SAAS,EAAE;wBAClE,UAAU,EAAE,SAAS;wBACrB,SAAS,EAAE,YAAY,CAAC,SAAS;wBACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,SAAS;wBACT,OAAO;wBACP,EAAE;wBACF,MAAM,EAAE,YAAY,CAAC,MAAM;qBAC3B,CAAC;oBACF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;oBAC5B,OAAO,KAAK,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACjC,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QACD,QAAQ,CAAC,OAAe;YACvB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QACD,UAAU;YACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,OAAe;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO;YACR,CAAC;YAED,IAAI,YAA+B,CAAC;YACpC,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1E,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,EAAE,CAAC;oBACnB,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1E,CAAC;YACF,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEvC,IAAI,YAAY,EAAE,CAAC;gBAClB,MAAM,YAAY,CAAC;YACpB,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/controller/leases/tcp-pool.d.ts

@@ -0,0 +1,11 @@
+export interface TcpPool {
+    allocate(): number;
+    getAllMappings(): Record<string, string>;
+    portForSlot(slot: number): number;
+    release(slot: number): void;
+}
+export declare function createTcpPool(options: {
+    readonly basePort: number;
+    readonly size: number;
+}): TcpPool;
+//# sourceMappingURL=tcp-pool.d.ts.map

package/dist/controller/leases/tcp-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-pool.d.ts","sourceRoot":"","sources":["../../../src/controller/leases/tcp-pool.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,OAAO;IACvB,QAAQ,IAAI,MAAM,CAAC;IACnB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CA4BV"}

package/dist/controller/leases/tcp-pool.js

@@ -0,0 +1,26 @@
+export function createTcpPool(options) {
+    const allocatedSlots = new Set();
+    return {
+        allocate() {
+            for (let slot = 0; slot < options.size; slot += 1) {
+                if (!allocatedSlots.has(slot)) {
+                    allocatedSlots.add(slot);
+                    return slot;
+                }
+            }
+            throw new Error('No TCP slots available');
+        },
+        getAllMappings() {
+            return Object.fromEntries([...allocatedSlots]
+                .toSorted((leftSlot, rightSlot) => leftSlot - rightSlot)
+                .map((slot) => [`tool-${slot}.vm.host:22`, `127.0.0.1:${options.basePort + slot}`]));
+        },
+        portForSlot(slot) {
+            return options.basePort + slot;
+        },
+        release(slot) {
+            allocatedSlots.delete(slot);
+        },
+    };
+}
+//# sourceMappingURL=tcp-pool.js.map

package/dist/controller/leases/tcp-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tcp-pool.js","sourceRoot":"","sources":["../../../src/controller/leases/tcp-pool.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,aAAa,CAAC,OAG7B;IACA,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO;QACN,QAAQ;YACP,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACzB,OAAO,IAAI,CAAC;gBACb,CAAC;YACF,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QACD,cAAc;YACb,OAAO,MAAM,CAAC,WAAW,CACxB,CAAC,GAAG,cAAc,CAAC;iBACjB,QAAQ,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,GAAG,SAAS,CAAC;iBACvD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,aAAa,EAAE,aAAa,OAAO,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC,CACpF,CAAC;QACH,CAAC;QACD,WAAW,CAAC,IAAY;YACvB,OAAO,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,IAAY;YACnB,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/gateway/credential-manager.d.ts

@@ -0,0 +1,8 @@
+import type { SecretResolver } from '@shravansunder/agent-vm-gondolin-core';
+import type { SystemConfig } from '../config/system-config.js';
+export declare function resolveZoneSecrets(options: {
+    readonly systemConfig: SystemConfig;
+    readonly zoneId: string;
+    readonly secretResolver: SecretResolver;
+}): Promise<Record<string, string>>;
+//# sourceMappingURL=credential-manager.d.ts.map

package/dist/gateway/credential-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-manager.d.ts","sourceRoot":"","sources":["../../src/gateway/credential-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAa,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AA0B/D,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IACjD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACxC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA+BlC"}

package/dist/gateway/credential-manager.js

@@ -0,0 +1,46 @@
+function buildSuggestedSecretRef(zoneId, secretName) {
+    switch (secretName) {
+        case 'DISCORD_BOT_TOKEN':
+            return `op://agent-vm/${zoneId}-discord/bot-token`;
+        case 'PERPLEXITY_API_KEY':
+            return `op://agent-vm/${zoneId}-perplexity/credential`;
+        case 'OPENCLAW_GATEWAY_TOKEN':
+            return `op://agent-vm/${zoneId}-gateway-auth/password`;
+        case 'OPENAI_API_KEY':
+            return `op://agent-vm/${zoneId}-openai/credential`;
+        case 'ANTHROPIC_API_KEY':
+            return `op://agent-vm/${zoneId}-anthropic/credential`;
+        default:
+            return `op://agent-vm/${zoneId}-${secretName.toLowerCase().replace(/_/gu, '-')}/credential`;
+    }
+}
+function findZone(systemConfig, zoneId) {
+    return systemConfig.zones.find((zone) => zone.id === zoneId);
+}
+export async function resolveZoneSecrets(options) {
+    const zone = findZone(options.systemConfig, options.zoneId);
+    if (!zone) {
+        throw new Error(`Unknown zone '${options.zoneId}'.`);
+    }
+    const resolvedSecrets = {};
+    for (const [secretName, secretConfig] of Object.entries(zone.secrets)) {
+        if (!secretConfig.ref) {
+            throw new Error(`Zone '${zone.id}' secret '${secretName}' is missing 'ref'. Add an explicit 1Password reference such as '${buildSuggestedSecretRef(zone.id, secretName)}'.`);
+        }
+        try {
+            const secretRef = {
+                ref: secretConfig.ref,
+                source: secretConfig.source,
+            };
+            // Sequential resolution gives the user exact secret context on failure.
+            // oxlint-disable-next-line eslint/no-await-in-loop
+            resolvedSecrets[secretName] = await options.secretResolver.resolve(secretRef);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Failed to resolve secret '${secretName}' for zone '${zone.id}' from '${secretConfig.ref}': ${message}`, { cause: error });
+        }
+    }
+    return resolvedSecrets;
+}
+//# sourceMappingURL=credential-manager.js.map

package/dist/gateway/credential-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../src/gateway/credential-manager.ts"],"names":[],"mappings":"AAIA,SAAS,uBAAuB,CAAC,MAAc,EAAE,UAAkB;IAClE,QAAQ,UAAU,EAAE,CAAC;QACpB,KAAK,mBAAmB;YACvB,OAAO,iBAAiB,MAAM,oBAAoB,CAAC;QACpD,KAAK,oBAAoB;YACxB,OAAO,iBAAiB,MAAM,wBAAwB,CAAC;QACxD,KAAK,wBAAwB;YAC5B,OAAO,iBAAiB,MAAM,wBAAwB,CAAC;QACxD,KAAK,gBAAgB;YACpB,OAAO,iBAAiB,MAAM,oBAAoB,CAAC;QACpD,KAAK,mBAAmB;YACvB,OAAO,iBAAiB,MAAM,uBAAuB,CAAC;QACvD;YACC,OAAO,iBAAiB,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC;IAC9F,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAChB,YAA0B,EAC1B,MAAc;IAEd,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAIxC;IACA,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,SAAS,IAAI,CAAC,EAAE,aAAa,UAAU,oEAAoE,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAC3J,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,SAAS,GAAc;gBAC5B,GAAG,EAAE,YAAY,CAAC,GAAG;gBACrB,MAAM,EAAE,YAAY,CAAC,MAAM;aAC3B,CAAC;YACF,wEAAwE;YACxE,mDAAmD;YACnD,eAAe,CAAC,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,KAAK,CACd,6BAA6B,UAAU,eAAe,IAAI,CAAC,EAAE,WAAW,YAAY,CAAC,GAAG,MAAM,OAAO,EAAE,EACvG,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,eAAe,CAAC;AACxB,CAAC"}

package/dist/gateway/gateway-image-builder.d.ts

@@ -0,0 +1,13 @@
+import type { BuildImageResult } from '@shravansunder/agent-vm-gondolin-core';
+import { type GondolinImageBuilderDependencies } from '../build/gondolin-image-builder.js';
+import type { GatewayBuildImageOptions } from './gateway-zone-support.js';
+export interface GatewayImageBuilderDependencies {
+    readonly buildImage?: (options: GatewayBuildImageOptions) => Promise<BuildImageResult>;
+    readonly buildGondolinImage?: GondolinImageBuilderDependencies['buildImage'];
+    readonly loadBuildConfig?: GondolinImageBuilderDependencies['loadBuildConfig'];
+}
+export declare function buildGatewayImage(options: {
+    readonly buildConfigPath: string;
+    readonly cacheDir: string;
+}, dependencies?: GatewayImageBuilderDependencies): Promise<BuildImageResult>;
+//# sourceMappingURL=gateway-image-builder.d.ts.map

package/dist/gateway/gateway-image-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-image-builder.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-image-builder.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAe,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE3F,OAAO,EAEN,KAAK,gCAAgC,EACrC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,CAAC,YAAY,CAAC,CAAC;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,gCAAgC,CAAC,iBAAiB,CAAC,CAAC;CAC/E;AAMD,wBAAsB,iBAAiB,CACtC,OAAO,EAAE;IACR,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B,EACD,YAAY,GAAE,+BAAoC,GAChD,OAAO,CAAC,gBAAgB,CAAC,CAa3B"}

package/dist/gateway/gateway-image-builder.js

@@ -0,0 +1,19 @@
+import fs from 'node:fs/promises';
+import { buildGondolinImage as buildGondolinImageDefault, } from '../build/gondolin-image-builder.js';
+async function loadBuildConfigFromJson(buildConfigPath) {
+    return JSON.parse(await fs.readFile(buildConfigPath, 'utf8'));
+}
+export async function buildGatewayImage(options, dependencies = {}) {
+    if (dependencies.buildImage) {
+        const loadBuildConfig = dependencies.loadBuildConfig ?? loadBuildConfigFromJson;
+        return await dependencies.buildImage({
+            buildConfig: await loadBuildConfig(options.buildConfigPath),
+            cacheDir: options.cacheDir,
+        });
+    }
+    return await buildGondolinImageDefault(options, {
+        ...(dependencies.buildGondolinImage ? { buildImage: dependencies.buildGondolinImage } : {}),
+        ...(dependencies.loadBuildConfig ? { loadBuildConfig: dependencies.loadBuildConfig } : {}),
+    });
+}
+//# sourceMappingURL=gateway-image-builder.js.map

package/dist/gateway/gateway-image-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-image-builder.js","sourceRoot":"","sources":["../../src/gateway/gateway-image-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAIlC,OAAO,EACN,kBAAkB,IAAI,yBAAyB,GAE/C,MAAM,oCAAoC,CAAC;AAS5C,KAAK,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAgB,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAGC,EACD,eAAgD,EAAE;IAElD,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,eAAe,GAAG,YAAY,CAAC,eAAe,IAAI,uBAAuB,CAAC;QAChF,OAAO,MAAM,YAAY,CAAC,UAAU,CAAC;YACpC,WAAW,EAAE,MAAM,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC;YAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,yBAAyB,CAAC,OAAO,EAAE;QAC/C,GAAG,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;AACJ,CAAC"}

package/dist/gateway/gateway-lifecycle-loader.d.ts

@@ -0,0 +1,3 @@
+import type { GatewayLifecycle, GatewayZoneConfig } from '@shravansunder/agent-vm-gateway-interface';
+export declare function loadGatewayLifecycle(type: GatewayZoneConfig['gateway']['type']): GatewayLifecycle;
+//# sourceMappingURL=gateway-lifecycle-loader.d.ts.map

package/dist/gateway/gateway-lifecycle-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-lifecycle-loader.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-lifecycle-loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,gBAAgB,EAChB,iBAAiB,EACjB,MAAM,2CAA2C,CAAC;AASnD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAEjG"}

package/dist/gateway/gateway-lifecycle-loader.js

@@ -0,0 +1,10 @@
+import { openclawLifecycle } from '@shravansunder/agent-vm-openclaw-gateway';
+import { workerLifecycle } from '@shravansunder/agent-vm-worker-gateway';
+const lifecycleByType = {
+    coding: workerLifecycle,
+    openclaw: openclawLifecycle,
+};
+export function loadGatewayLifecycle(type) {
+    return lifecycleByType[type];
+}
+//# sourceMappingURL=gateway-lifecycle-loader.js.map

package/dist/gateway/gateway-lifecycle-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-lifecycle-loader.js","sourceRoot":"","sources":["../../src/gateway/gateway-lifecycle-loader.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,MAAM,eAAe,GAAG;IACvB,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,iBAAiB;CACgB,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,IAA0C;IAC9E,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/gateway/gateway-zone-orchestrator.d.ts

@@ -0,0 +1,10 @@
+import type { GatewayLifecycle, GatewayZoneConfig } from '@shravansunder/agent-vm-gateway-interface';
+import { type ManagedVm } from '@shravansunder/agent-vm-gondolin-core';
+import { type GatewayImageBuilderDependencies } from './gateway-image-builder.js';
+import { type GatewayManagedVmFactoryOptions, type GatewayZoneStartResult, type StartGatewayZoneOptions } from './gateway-zone-support.js';
+export interface GatewayManagerDependencies extends GatewayImageBuilderDependencies {
+    readonly createManagedVm?: (options: GatewayManagedVmFactoryOptions) => Promise<ManagedVm>;
+    readonly loadGatewayLifecycle?: (type: GatewayZoneConfig['gateway']['type']) => GatewayLifecycle;
+}
+export declare function startGatewayZone(options: StartGatewayZoneOptions, dependencies?: GatewayManagerDependencies): Promise<GatewayZoneStartResult>;
+//# sourceMappingURL=gateway-zone-orchestrator.d.ts.map

package/dist/gateway/gateway-zone-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-zone-orchestrator.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-zone-orchestrator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEX,gBAAgB,EAChB,iBAAiB,EACjB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAEN,KAAK,SAAS,EACd,MAAM,uCAAuC,CAAC;AAI/C,OAAO,EAEN,KAAK,+BAA+B,EACpC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAEN,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,0BAA2B,SAAQ,+BAA+B;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,8BAA8B,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3F,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,gBAAgB,CAAC;CACjG;AAmCD,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,0BAA+B,GAC3C,OAAO,CAAC,sBAAsB,CAAC,CAyFjC"}

package/dist/gateway/gateway-zone-orchestrator.js

@@ -0,0 +1,92 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createManagedVm as createManagedVmFromCore, } from '@shravansunder/agent-vm-gondolin-core';
+import { runTaskWithResult } from '../shared/run-task.js';
+import { resolveZoneSecrets } from './credential-manager.js';
+import { buildGatewayImage, } from './gateway-image-builder.js';
+import { loadGatewayLifecycle } from './gateway-lifecycle-loader.js';
+import { findGatewayZone, } from './gateway-zone-support.js';
+async function waitForHealth(managedVm, healthCheck, attempt = 0, maxAttempts = 30, lastObservation = 'none') {
+    if (attempt >= maxAttempts) {
+        throw new Error(`Gateway readiness check failed after ${maxAttempts} attempts. Last observation: ${lastObservation}.`);
+    }
+    const healthCommand = healthCheck.type === 'http'
+        ? `curl -sS -o /dev/null -w "%{http_code}" --max-time 2 http://127.0.0.1:${healthCheck.port}${healthCheck.path} 2>/dev/null || echo 000`
+        : healthCheck.command;
+    const result = await managedVm.exec(healthCommand);
+    const currentObservation = healthCheck.type === 'http'
+        ? `http ${result.stdout.trim() || '(empty)'}`
+        : `exit ${result.exitCode}`;
+    if ((healthCheck.type === 'http' && result.stdout.trim().startsWith('2')) ||
+        (healthCheck.type === 'command' && result.exitCode === 0)) {
+        return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    await waitForHealth(managedVm, healthCheck, attempt + 1, maxAttempts, currentObservation);
+}
+export async function startGatewayZone(options, dependencies = {}) {
+    const runTaskStep = options.runTask ?? (async (_title, fn) => await fn());
+    const zone = findGatewayZone(options.systemConfig, options.zoneId);
+    const lifecycle = (dependencies.loadGatewayLifecycle ?? loadGatewayLifecycle)(zone.gateway.type);
+    const resolvedSecrets = await runTaskWithResult(runTaskStep, 'Resolving zone secrets', async () => await resolveZoneSecrets({
+        systemConfig: options.systemConfig,
+        zoneId: zone.id,
+        secretResolver: options.secretResolver,
+    }));
+    const image = await runTaskWithResult(runTaskStep, 'Building gateway image', async () => await buildGatewayImage({
+        buildConfigPath: options.systemConfig.images.gateway.buildConfig,
+        cacheDir: path.join(options.systemConfig.cacheDir, 'images', 'gateway'),
+    }, {
+        ...(dependencies.buildImage ? { buildImage: dependencies.buildImage } : {}),
+        ...(dependencies.loadBuildConfig
+            ? { loadBuildConfig: dependencies.loadBuildConfig }
+            : {}),
+    }));
+    await fs.mkdir(zone.gateway.stateDir, { recursive: true });
+    await fs.mkdir(zone.gateway.workspaceDir, { recursive: true });
+    await runTaskStep('Preparing host state', async () => {
+        await lifecycle.prepareHostState?.(zone, options.secretResolver);
+    });
+    const vmSpec = lifecycle.buildVmSpec(zone, resolvedSecrets, options.systemConfig.host.controllerPort, options.systemConfig.tcpPool);
+    const processSpec = lifecycle.buildProcessSpec(zone, resolvedSecrets);
+    const createManagedVm = dependencies.createManagedVm ?? createManagedVmFromCore;
+    const managedVm = await runTaskWithResult(runTaskStep, 'Booting gateway VM', async () => await createManagedVm({
+        allowedHosts: vmSpec.allowedHosts,
+        cpus: zone.gateway.cpus,
+        env: vmSpec.environment,
+        imagePath: image.imagePath,
+        memory: zone.gateway.memory,
+        rootfsMode: vmSpec.rootfsMode,
+        secrets: vmSpec.mediatedSecrets,
+        sessionLabel: vmSpec.sessionLabel,
+        tcpHosts: vmSpec.tcpHosts,
+        vfsMounts: vmSpec.vfsMounts,
+    }));
+    await runTaskStep('Configuring gateway', async () => {
+        await managedVm.exec(processSpec.bootstrapCommand);
+    });
+    await runTaskStep('Starting gateway', async () => {
+        await managedVm.exec(processSpec.startCommand);
+    });
+    await runTaskStep('Waiting for readiness', async () => {
+        await waitForHealth(managedVm, processSpec.healthCheck);
+    });
+    managedVm.setIngressRoutes([
+        {
+            port: processSpec.guestListenPort,
+            prefix: '/',
+            stripPrefix: true,
+        },
+    ]);
+    const ingress = await managedVm.enableIngress({
+        listenPort: zone.gateway.port,
+    });
+    return {
+        image,
+        ingress,
+        processSpec,
+        vm: managedVm,
+        zone,
+    };
+}
+//# sourceMappingURL=gateway-zone-orchestrator.js.map

package/dist/gateway/gateway-zone-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-zone-orchestrator.js","sourceRoot":"","sources":["../../src/gateway/gateway-zone-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B,OAAO,EACN,eAAe,IAAI,uBAAuB,GAE1C,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACN,iBAAiB,GAEjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACN,eAAe,GAIf,MAAM,2BAA2B,CAAC;AAOnC,KAAK,UAAU,aAAa,CAC3B,SAAoB,EACpB,WAA+B,EAC/B,UAAkB,CAAC,EACnB,cAAsB,EAAE,EACxB,kBAA0B,MAAM;IAEhC,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACd,wCAAwC,WAAW,gCAAgC,eAAe,GAAG,CACrG,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAClB,WAAW,CAAC,IAAI,KAAK,MAAM;QAC1B,CAAC,CAAC,yEAAyE,WAAW,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,0BAA0B;QACxI,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,kBAAkB,GACvB,WAAW,CAAC,IAAI,KAAK,MAAM;QAC1B,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE;QAC7C,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC9B,IACC,CAAC,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,EACxD,CAAC;QACF,OAAO;IACR,CAAC;IAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAgC,EAChC,eAA2C,EAAE;IAE7C,MAAM,WAAW,GAChB,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,MAAc,EAAE,EAAuB,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC,oBAAoB,IAAI,oBAAoB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC9C,WAAW,EACX,wBAAwB,EACxB,KAAK,IAAI,EAAE,CACV,MAAM,kBAAkB,CAAC;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,cAAc,EAAE,OAAO,CAAC,cAAc;KACtC,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,wBAAwB,EACxB,KAAK,IAAI,EAAE,CACV,MAAM,iBAAiB,CACtB;QACC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW;QAChE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;KACvE,EACD;QACC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,YAAY,CAAC,eAAe;YAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,eAAe,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;KACN,CACD,CACF,CAAC;IACF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,WAAW,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CACnC,IAAI,EACJ,eAAe,EACf,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EACxC,OAAO,CAAC,YAAY,CAAC,OAAO,CAC5B,CAAC;IACF,MAAM,WAAW,GAAG,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,YAAY,CAAC,eAAe,IAAI,uBAAuB,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACxC,WAAW,EACX,oBAAoB,EACpB,KAAK,IAAI,EAAE,CACV,MAAM,eAAe,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QACvB,GAAG,EAAE,MAAM,CAAC,WAAW;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,eAAe;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CACH,CAAC;IACF,MAAM,WAAW,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,gBAAgB,CAAC;QAC1B;YACC,IAAI,EAAE,WAAW,CAAC,eAAe;YACjC,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,IAAI;SACjB;KACD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC;QAC7C,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;KAC7B,CAAC,CAAC;IAEH,OAAO;QACN,KAAK;QACL,OAAO;QACP,WAAW;QACX,EAAE,EAAE,SAAS;QACb,IAAI;KACJ,CAAC;AACH,CAAC"}

package/dist/gateway/gateway-zone-support.d.ts

@@ -0,0 +1,49 @@
+import type { GatewayProcessSpec } from '@shravansunder/agent-vm-gateway-interface';
+import type { SystemConfig } from '../config/system-config.js';
+import type { RunTaskFn } from '../shared/run-task.js';
+export type GatewayZone = SystemConfig['zones'][number];
+export interface StartGatewayZoneOptions {
+    readonly runTask?: RunTaskFn;
+    readonly secretResolver: import('@shravansunder/agent-vm-gondolin-core').SecretResolver;
+    readonly systemConfig: SystemConfig;
+    readonly zoneId: string;
+}
+export interface GatewayZoneStartResult {
+    readonly image: import('@shravansunder/agent-vm-gondolin-core').BuildImageResult;
+    readonly ingress: {
+        readonly host: string;
+        readonly port: number;
+    };
+    readonly processSpec: GatewayProcessSpec;
+    readonly vm: import('@shravansunder/agent-vm-gondolin-core').ManagedVm;
+    readonly zone: GatewayZone;
+}
+export interface GatewayBuildImageOptions {
+    readonly buildConfig: unknown;
+    readonly cacheDir: string;
+    readonly fullReset?: boolean;
+}
+export interface GatewayManagedVmFactoryOptions {
+    readonly allowedHosts: readonly string[];
+    readonly cpus: number;
+    readonly env?: Record<string, string>;
+    readonly imagePath: string;
+    readonly memory: string;
+    readonly rootfsMode: 'readonly' | 'memory' | 'cow';
+    readonly secrets: Record<string, {
+        readonly hosts: readonly string[];
+        readonly value: string;
+    }>;
+    readonly sessionLabel?: string;
+    readonly tcpHosts?: Record<string, string>;
+    readonly vfsMounts: Record<string, {
+        readonly kind: 'realfs' | 'realfs-readonly' | 'memory' | 'shadow';
+        readonly hostPath?: string;
+        readonly shadowConfig?: {
+            readonly deny: readonly string[];
+            readonly tmpfs: readonly string[];
+        };
+    }>;
+}
+export declare function findGatewayZone(systemConfig: SystemConfig, zoneId: string): GatewayZone;
+//# sourceMappingURL=gateway-zone-support.d.ts.map

package/dist/gateway/gateway-zone-support.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-zone-support.d.ts","sourceRoot":"","sources":["../../src/gateway/gateway-zone-support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,uCAAuC,EAAE,cAAc,CAAC;IACxF,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,KAAK,EAAE,OAAO,uCAAuC,EAAE,gBAAgB,CAAC;IACjF,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,EAAE,EAAE,OAAO,uCAAuC,EAAE,SAAS,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CACvB,MAAM,EACN;QACC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACvB,CACD,CAAC;IACF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CACzB,MAAM,EACN;QACC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE;YACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;YACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;SAClC,CAAC;KACF,CACD,CAAC;CACF;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAOvF"}

package/dist/gateway/gateway-zone-support.js

@@ -0,0 +1,8 @@
+export function findGatewayZone(systemConfig, zoneId) {
+    const zone = systemConfig.zones.find((candidateZone) => candidateZone.id === zoneId);
+    if (!zone) {
+        throw new Error(`Unknown zone '${zoneId}'.`);
+    }
+    return zone;
+}
+//# sourceMappingURL=gateway-zone-support.js.map

package/dist/gateway/gateway-zone-support.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-zone-support.js","sourceRoot":"","sources":["../../src/gateway/gateway-zone-support.ts"],"names":[],"mappings":"AA4DA,MAAM,UAAU,eAAe,CAAC,YAA0B,EAAE,MAAc;IACzE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/gateway-api-client/gateway-api-client.d.ts

@@ -0,0 +1,34 @@
+export interface GatewayToolInvocation {
+    readonly tool: string;
+    readonly args: Record<string, unknown>;
+    readonly sessionKey?: string;
+    readonly dryRun?: boolean;
+}
+/**
+ * Liveness probe response from `/health` or `/healthz`.
+ * Gateway returns `{ ok: true, status: "live" }` when the process is alive.
+ */
+export interface GatewayLivenessResponse {
+    readonly ok: boolean;
+    readonly status: 'live';
+}
+/**
+ * Readiness probe response from `/readyz`.
+ * Authenticated callers also receive `failing` and `uptimeMs` detail fields.
+ */
+export interface GatewayReadinessResponse {
+    readonly ready: boolean;
+    readonly failing?: readonly string[];
+    readonly uptimeMs?: number;
+}
+export interface GatewayApiClient {
+    /** Check gateway readiness via the `/readyz` probe endpoint. */
+    getGatewayStatus(): Promise<GatewayReadinessResponse>;
+    invokeTool(invocation: GatewayToolInvocation): Promise<unknown>;
+}
+export declare function createGatewayApiClient(options: {
+    readonly gatewayUrl: string;
+    readonly token: string;
+    readonly fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+}): GatewayApiClient;
+//# sourceMappingURL=gateway-api-client.d.ts.map

package/dist/gateway-api-client/gateway-api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-api-client.d.ts","sourceRoot":"","sources":["../../src/gateway-api-client/gateway-api-client.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAChC,gEAAgE;IAChE,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtD,UAAU,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC9F,GAAG,gBAAgB,CA4BnB"}

package/dist/gateway-api-client/gateway-api-client.js

@@ -0,0 +1,29 @@
+export function createGatewayApiClient(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const baseUrl = options.gatewayUrl.replace(/\/$/u, '');
+    return {
+        getGatewayStatus: async () => {
+            const response = await fetchImpl(`${baseUrl}/readyz`, {
+                headers: {
+                    authorization: `Bearer ${options.token}`,
+                },
+            });
+            return (await response.json());
+        },
+        invokeTool: async (invocation) => {
+            const response = await fetchImpl(`${baseUrl}/tools/invoke`, {
+                body: JSON.stringify(invocation),
+                headers: {
+                    authorization: `Bearer ${options.token}`,
+                    'content-type': 'application/json',
+                },
+                method: 'POST',
+            });
+            if (!response.ok) {
+                throw new Error(`Gateway API returned status ${response.status}`);
+            }
+            return await response.json();
+        },
+    };
+}
+//# sourceMappingURL=gateway-api-client.js.map

package/dist/gateway-api-client/gateway-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-api-client.js","sourceRoot":"","sources":["../../src/gateway-api-client/gateway-api-client.ts"],"names":[],"mappings":"AAgCA,MAAM,UAAU,sBAAsB,CAAC,OAItC;IACA,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvD,OAAO;QACN,gBAAgB,EAAE,KAAK,IAAuC,EAAE;YAC/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,SAAS,EAAE;gBACrD,OAAO,EAAE;oBACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;iBACxC;aACD,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;QAC5D,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,UAAiC,EAAoB,EAAE;YACzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,eAAe,EAAE;gBAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;gBAChC,OAAO,EAAE;oBACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBAClC;gBACD,MAAM,EAAE,MAAM;aACd,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;KACD,CAAC;AACH,CAAC"}