@truefoundry/trueforge 0.2.0-rc.2 → 0.2.0-rc.4

package/dist/controller-main.js

@@ -16,6 +16,7 @@ var DEFAULT_POSTGRES_DB = "trueforge";
 var DEFAULT_POSTGRES_HOST = "localhost";
 var DEFAULT_POSTGRES_PORT = 5432;
 var DEFAULT_REDIS_URL = "redis://localhost:6379";
+var STANDALONE_TRUEFORGE_API_KEY = "trueforge-standalone";
 var DEFAULT_OIDC_USER_REFERENCE_CLAIM = "sub";
 var DEFAULT_OIDC_USER_DISPLAY_NAME_CLAIM = "name";
 var DEFAULT_OIDC_USER_ROLE_CLAIM = "groups";
@@ -85,6 +86,38 @@ function parseBoolean(options) {
   }
   throw new Error(`Environment variable ${envKey} must be "true" or "false", got "${raw}"`);
 }
+function parsePublicBaseUrl(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return "";
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw.trim());
+  } catch (error) {
+    throw new Error("PUBLIC_BASE_URL must be a valid URL", { cause: error });
+  }
+  if (parsed.search !== "" || parsed.hash !== "") {
+    throw new Error("PUBLIC_BASE_URL must not include a query or hash");
+  }
+  const segments = parsed.pathname.split("/").filter((part) => part.length > 0);
+  if (segments.some((part) => part === "." || part === "..")) {
+    throw new Error('PUBLIC_BASE_URL path must not contain "." or ".." segments');
+  }
+  const path3 = segments.length === 0 ? "" : `/${segments.join("/")}`;
+  return `${parsed.origin}${path3}`;
+}
+function parseTrueFoundrySandboxProvider(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return void 0;
+  }
+  const value = raw.trim();
+  if (value === "daytona" || value === "truefoundry") {
+    return value;
+  }
+  throw new Error(
+    `Environment variable TRUEFOUNDRY_SANDBOX_PROVIDER must be "daytona" or "truefoundry", got ${JSON.stringify(raw)}`
+  );
+}
 function parsePostgresSslMode(raw) {
   if (!raw) {
     return "";
@@ -296,8 +329,9 @@ var shared = {
     raw: getEnv("REDIS_REQUEST_REPLY_POLL_INTERVAL_MS"),
     defaultValue: 500
   }),
-  PUBLIC_BASE_URL: getEnv("PUBLIC_BASE_URL", { defaultValue: "" }) ?? "",
+  PUBLIC_BASE_URL: parsePublicBaseUrl(getEnv("PUBLIC_BASE_URL", { defaultValue: "" })),
   SERVER_URL: getEnv("SERVER_URL", { defaultValue: `http://localhost:${String(port)}` }) ?? `http://localhost:${String(port)}`,
+  TRUEFORGE_API_KEY: standalone ? getEnv("TRUEFORGE_API_KEY", { defaultValue: STANDALONE_TRUEFORGE_API_KEY }) ?? STANDALONE_TRUEFORGE_API_KEY : getEnv("TRUEFORGE_API_KEY", { required: true }) ?? "",
   TRUEFORGE_MTLS_ENABLED: parseBoolean({
     envKey: "TRUEFORGE_MTLS_ENABLED",
     raw: getEnv("TRUEFORGE_MTLS_ENABLED"),
@@ -333,6 +367,7 @@ var configuration = standalone ? {
   REDIS_URL: resolveRedisUrl(),
   OIDC: resolveOIDCConfig(),
   TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL: getEnv("TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL", { required: false }),
+  TRUEFOUNDRY_API_KEY: getEnv("TRUEFOUNDRY_API_KEY", { required: false }),
   TRUEFOUNDRY_SERVICEFOUNDRY_HTTP_TIMEOUT_MS: parsePositiveInt({
     envKey: "TRUEFOUNDRY_SERVICEFOUNDRY_HTTP_TIMEOUT_MS",
     raw: getEnv("TRUEFOUNDRY_SERVICEFOUNDRY_HTTP_TIMEOUT_MS"),
@@ -354,8 +389,12 @@ var configuration = standalone ? {
     raw: getEnv("TRUEFOUNDRY_SANDBOX_ENABLED"),
     defaultValue: false
   }),
+  TRUEFOUNDRY_SANDBOX_PROVIDER: parseTrueFoundrySandboxProvider(
+    getEnv("TRUEFOUNDRY_SANDBOX_PROVIDER", { required: false })
+  ),
   TRUEFOUNDRY_SANDBOX_API_KEY: getEnv("TRUEFOUNDRY_SANDBOX_API_KEY", { required: false }),
-  TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL: getEnv("TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL", { required: false })
+  TRUEFOUNDRY_SANDBOX_SERVER_URL: getEnv("TRUEFOUNDRY_SANDBOX_SERVER_URL", { required: false }),
+  TRUEFOUNDRY_SANDBOX_SETTINGS: getEnv("TRUEFOUNDRY_SANDBOX_SETTINGS", { required: false })
 };
 function isOidcConfigured(value) {
   return !value.STANDALONE && value.OIDC !== void 0;
@@ -369,19 +408,42 @@ if (isTrueFoundryModeEnabled(configuration)) {
       "TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL (TrueFoundry mode) and OIDC (SSO) cannot both be enabled at once."
     );
   }
+  if (configuration.TRUEFOUNDRY_API_KEY === void 0) {
+    throw new Error("TRUEFOUNDRY_API_KEY is required when TRUEFOUNDRY_SERVICEFOUNDRY_SERVER_URL is set.");
+  }
   if (configuration.TRUEFOUNDRY_SANDBOX_ENABLED) {
-    if (configuration.TRUEFOUNDRY_SANDBOX_API_KEY === void 0 || configuration.TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL === void 0) {
+    if (configuration.TRUEFOUNDRY_SANDBOX_PROVIDER === void 0) {
+      throw new Error(
+        'TRUEFOUNDRY_SANDBOX_ENABLED is true but TRUEFOUNDRY_SANDBOX_PROVIDER is not set. Set TRUEFOUNDRY_SANDBOX_PROVIDER to "daytona" or "truefoundry", or set TRUEFOUNDRY_SANDBOX_ENABLED=false.'
+      );
+    }
+    if (configuration.TRUEFOUNDRY_SANDBOX_SETTINGS === void 0) {
+      throw new Error(
+        "TRUEFOUNDRY_SANDBOX_ENABLED is true but TRUEFOUNDRY_SANDBOX_SETTINGS is not set. Provide a JSON settings object, or set TRUEFOUNDRY_SANDBOX_ENABLED=false."
+      );
+    }
+    try {
+      JSON.parse(configuration.TRUEFOUNDRY_SANDBOX_SETTINGS);
+    } catch (error) {
+      throw new Error("TRUEFOUNDRY_SANDBOX_SETTINGS must be valid JSON", { cause: error });
+    }
+    if (configuration.TRUEFOUNDRY_SANDBOX_PROVIDER === "daytona" && configuration.TRUEFOUNDRY_SANDBOX_API_KEY === void 0) {
+      throw new Error(
+        "TRUEFOUNDRY_SANDBOX_PROVIDER=daytona requires TRUEFOUNDRY_SANDBOX_API_KEY, or set TRUEFOUNDRY_SANDBOX_ENABLED=false."
+      );
+    }
+    if (configuration.TRUEFOUNDRY_SANDBOX_PROVIDER === "truefoundry" && configuration.TRUEFOUNDRY_SANDBOX_SERVER_URL === void 0) {
       throw new Error(
-        "TRUEFOUNDRY_SANDBOX_ENABLED is true but no sandbox provider is configured. Set TRUEFOUNDRY_SANDBOX_API_KEY + TRUEFOUNDRY_SANDBOX_SETTINGS_SERVER_URL, or set TRUEFOUNDRY_SANDBOX_ENABLED=false."
+        "TRUEFOUNDRY_SANDBOX_PROVIDER=truefoundry requires TRUEFOUNDRY_SANDBOX_SERVER_URL, or set TRUEFOUNDRY_SANDBOX_ENABLED=false."
       );
     }
   }
 }
+if (!configuration.STANDALONE && configuration.TRUEFORGE_API_KEY.trim() === "") {
+  throw new Error("TRUEFORGE_API_KEY must not be empty when STANDALONE=false.");
+}
 var config_default = configuration;
 
-// src/controller.ts
-import { TrueForge } from "@truefoundry/trueforge-sdk";
-
 // src/controller/Controller.ts
 var CONTROLLER_STOPPED = "controller-stopped";
 var Controller = class {
@@ -476,6 +538,9 @@ var Controller = class {
   }
 };
 
+// src/controller/scheduleDispatch.ts
+import { TrueForge } from "@truefoundry/trueforge-sdk";
+
 // src/db/scheduleStore.ts
 import { randomUUID } from "crypto";
 
@@ -554,14 +619,21 @@ var ScheduleRunSchema = z2.object({
   status: ScheduleRunStatusSchema,
   created_by_subject: CreatedBySubjectSchema,
   triggered_at: NullableIsoTimestamp,
+  reason: z2.string().nullable(),
   created_at: IsoTimestamp,
   updated_at: IsoTimestamp
 }).strict().openapi("ScheduleRun");
-var ListScheduleRunsResponseSchema = z2.object({ data: z2.array(ScheduleRunSchema) }).openapi("ListScheduleRunsResponse");
+var ListScheduleRunsResponseSchema = z2.object({
+  data: z2.array(ScheduleRunSchema),
+  pagination: TokenPaginationSchema
+}).openapi("ListScheduleRunsResponse");
 var CreateScheduleRunRequestSchema = z2.object({
   schedule_id: z2.string().min(1).max(64).describe("Immutable schedule identifier.")
 }).strict().describe("Trigger an immediate run for the given schedule. The task is taken from the schedule manifest.").openapi("CreateScheduleRunRequest");
 var CreateScheduleRunResponseSchema = z2.object({ data: ScheduleRunSchema }).openapi("CreateScheduleRunResponse");
+var ExecuteScheduleRunRequestSchema = z2.object({
+  schedule_run_id: z2.string().min(1).max(64).describe("Immutable schedule run identifier.")
+}).strict().openapi("ExecuteScheduleRunRequest");
 
 // src/db/scheduleStore.ts
 function cronRunName(scheduledFor) {
@@ -592,6 +664,71 @@ function shouldSyncPendingRun(previous, next) {
   return previous.status !== next.status || previous.manifest.cron !== next.manifest.cron || previous.manifest.timezone !== next.manifest.timezone;
 }
 
+// src/http/tls.ts
+import { readFileSync } from "fs";
+import { createServer as createHttpsServer } from "https";
+import { join } from "path";
+import { rootCertificates, TLSSocket } from "tls";
+import { Agent, fetch as undiciFetch } from "undici";
+var TLS_CERT_FILE = "tls.crt";
+var TLS_KEY_FILE = "tls.key";
+var TLS_CA_FILE = "ca.crt";
+function readTlsFile(input) {
+  const filePath = join(input.dir, input.fileName);
+  try {
+    return readFileSync(filePath, "utf8");
+  } catch (error) {
+    throw new Error(
+      `${input.enabledEnvKey} is true but ${filePath} could not be read. Check that the mTLS secret is mounted at the configured certs directory, or set ${input.enabledEnvKey}=false.`,
+      { cause: error }
+    );
+  }
+}
+function normalizeTlsUrl(input) {
+  if (!input.enabled) {
+    return input.url;
+  }
+  const parsed = new URL(input.url);
+  if (parsed.protocol === "http:") {
+    parsed.protocol = "https:";
+  }
+  return parsed.href;
+}
+function createTlsDispatcher(options) {
+  if (!options.enabled) {
+    return void 0;
+  }
+  const read = (fileName) => readTlsFile({ dir: options.dir, fileName, enabledEnvKey: options.enabledEnvKey });
+  return new Agent({
+    connect: {
+      // Appended to the default roots, not replacing them: passing `ca` alone would override Node's
+      // entire trust store for this dispatcher (breaks public HTTPS peers on the same agent).
+      ca: [...rootCertificates, read(TLS_CA_FILE)],
+      cert: read(TLS_CERT_FILE),
+      key: read(TLS_KEY_FILE)
+    }
+  });
+}
+function requestUrlFromFetchInput(input) {
+  if (typeof input === "string") {
+    return input;
+  }
+  if (input instanceof URL) {
+    return input.href;
+  }
+  return input.url;
+}
+function createTlsFetch(options) {
+  const dispatcher = createTlsDispatcher({
+    ...options,
+    enabledEnvKey: "TRUEFORGE_MTLS_ENABLED"
+  });
+  if (dispatcher === void 0) {
+    return void 0;
+  }
+  return (input, init) => undiciFetch(requestUrlFromFetchInput(input), { ...init, dispatcher });
+}
+
 // src/runtime/cron.ts
 import { CronExpressionParser } from "cron-parser";
 function nextTriggerAfter(input) {
@@ -609,30 +746,33 @@ function nextTriggerAfter(input) {
 
 // src/controller/scheduleDispatch.ts
 var DISPATCH_BATCH_LIMIT = 20;
+function scheduleRunFailureReason(error) {
+  return error instanceof Error && error.message.trim() !== "" ? error.message : "Schedule run failed";
+}
 var SCHEDULE_DISPATCH_INTERVAL_MS = 6e4;
 var SCHEDULE_DISPATCH_LOOP_NAME = "schedule-dispatch";
-function executeScheduledRun(client) {
-  return async ({ run, schedule }) => {
-    const { data: session } = await client.internal.sessions.getOrCreateByExternalId({
-      externalId: run.id,
-      agent: { name: schedule.agent_name },
-      source: { type: "schedule", id: schedule.id, runId: run.id }
-    });
-    const turns = await client.sessions.listTurns(session.id, { limit: 1 });
-    if (turns.data.length > 0) {
-      return;
-    }
-    await client.sessions.createTurn(session.id, {
-      input: [{ type: "user.message", content: schedule.manifest.task }],
-      previousTurnId: "none"
-    });
+function createHttpScheduleRunExecutor() {
+  const tls = {
+    enabled: config_default.TRUEFORGE_MTLS_ENABLED,
+    dir: config_default.TRUEFORGE_MTLS_CERTS_DIR
   };
+  const tlsFetch = createTlsFetch(tls);
+  const client = new TrueForge({
+    baseUrl: normalizeTlsUrl({ url: config_default.SERVER_URL, enabled: tls.enabled }),
+    token: config_default.TRUEFORGE_API_KEY,
+    timeoutInSeconds: 60,
+    ...tlsFetch === void 0 ? {} : { fetch: tlsFetch }
+  });
+  return (scheduleRunId) => client.internal.schedules.executeRun({ scheduleRunId });
 }
 async function finishScheduledRun(params) {
-  const { store, withTransaction, run, status, now: now2 } = params;
+  const { store, withTransaction, run, status, reason, now: now2 } = params;
   await withTransaction(async (txn) => {
     const latest = await store.getScheduleForUpdate({ tenant_id: run.tenant_id, id: run.schedule_id }, txn);
-    const updated = await store.updateRunStatus({ tenant_id: run.tenant_id, id: run.id, status }, txn);
+    const updated = await store.updateRunStatus(
+      { tenant_id: run.tenant_id, id: run.id, status, reason: reason ?? null },
+      txn
+    );
     if (updated === void 0) {
       return;
     }
@@ -697,6 +837,7 @@ async function dispatchScheduledRuns(params) {
           run,
           now: now2,
           status: "failed",
+          reason: scheduleRunFailureReason(error),
           withTransaction
         });
         failed += 1;
@@ -721,14 +862,15 @@ async function dispatchScheduledRuns(params) {
   return { dispatched, failed };
 }
 function scheduleDispatchLoop(params) {
-  const { scheduleStore, client, withTransaction, logger } = params;
+  const { scheduleStore, withTransaction, logger } = params;
+  const executeRun = createHttpScheduleRunExecutor();
   return {
     name: SCHEDULE_DISPATCH_LOOP_NAME,
     intervalMs: SCHEDULE_DISPATCH_INTERVAL_MS,
     async tick(signal) {
       const result = await dispatchScheduledRuns({
         store: scheduleStore,
-        onTriggered: executeScheduledRun(client),
+        onTriggered: (item) => executeRun(item.run.id),
         logger,
         withTransaction,
         signal
@@ -740,94 +882,17 @@ function scheduleDispatchLoop(params) {
   };
 }
 
-// src/http/tls.ts
-import { readFileSync } from "fs";
-import { createServer as createHttpsServer } from "https";
-import { join } from "path";
-import { rootCertificates, TLSSocket } from "tls";
-import { Agent, fetch as undiciFetch } from "undici";
-var TLS_CERT_FILE = "tls.crt";
-var TLS_KEY_FILE = "tls.key";
-var TLS_CA_FILE = "ca.crt";
-function readTlsFile(input) {
-  const filePath = join(input.dir, input.fileName);
-  try {
-    return readFileSync(filePath, "utf8");
-  } catch (error) {
-    throw new Error(
-      `${input.enabledEnvKey} is true but ${filePath} could not be read. Check that the mTLS secret is mounted at the configured certs directory, or set ${input.enabledEnvKey}=false.`,
-      { cause: error }
-    );
-  }
-}
-function normalizeTlsUrl(input) {
-  if (!input.enabled) {
-    return input.url;
-  }
-  const parsed = new URL(input.url);
-  if (parsed.protocol === "http:") {
-    parsed.protocol = "https:";
-  }
-  return parsed.href;
-}
-function createTlsDispatcher(options) {
-  if (!options.enabled) {
-    return void 0;
-  }
-  const read = (fileName) => readTlsFile({ dir: options.dir, fileName, enabledEnvKey: options.enabledEnvKey });
-  return new Agent({
-    connect: {
-      // Appended to the default roots, not replacing them: passing `ca` alone would override Node's
-      // entire trust store for this dispatcher (breaks public HTTPS peers on the same agent).
-      ca: [...rootCertificates, read(TLS_CA_FILE)],
-      cert: read(TLS_CERT_FILE),
-      key: read(TLS_KEY_FILE)
-    }
-  });
-}
-function requestUrlFromFetchInput(input) {
-  if (typeof input === "string") {
-    return input;
-  }
-  if (input instanceof URL) {
-    return input.href;
-  }
-  return input.url;
-}
-function createTlsFetch(options) {
-  const dispatcher = createTlsDispatcher({
-    ...options,
-    enabledEnvKey: "TRUEFORGE_MTLS_ENABLED"
-  });
-  if (dispatcher === void 0) {
-    return void 0;
-  }
-  return (input, init) => undiciFetch(requestUrlFromFetchInput(input), { ...init, dispatcher });
-}
-
 // src/controller.ts
-function createScheduleApiClient(params) {
-  const baseUrl = normalizeTlsUrl({ url: params.baseUrl, enabled: params.tls.enabled });
-  const fetchImpl = createTlsFetch(params.tls);
-  return new TrueForge({
-    baseUrl,
-    auth: false,
-    ...fetchImpl !== void 0 ? { fetch: fetchImpl } : {}
-  });
-}
 function createController(params) {
-  const { scheduleStore, withTransaction, logger, baseUrl } = params;
-  const tls = params.tls ?? { enabled: false, dir: "" };
   return new Controller({
     loops: [
       scheduleDispatchLoop({
-        scheduleStore,
-        client: createScheduleApiClient({ baseUrl, tls }),
-        withTransaction,
-        logger
+        scheduleStore: params.scheduleStore,
+        withTransaction: params.withTransaction,
+        logger: params.logger
       })
     ],
-    logger
+    logger: params.logger
   });
 }
 function runController(params) {
@@ -912,6 +977,7 @@ import {
   decodeOffsetPageToken,
   paginateOffsetRows
 } from "@truefoundry/trueforge-core/agent-session/store/OffsetPageToken";
+import { sql as sql3 } from "kysely";
 
 // src/utils/id.ts
 import { ulid } from "ulid";
@@ -967,6 +1033,7 @@ function toRunRecord(row) {
     status: row.status,
     created_by_subject: CreatedBySubjectSchema2.parse(row.created_by_subject),
     triggered_at: row.triggered_at === null ? null : row.triggered_at.toISOString(),
+    reason: row.reason,
     created_at: row.created_at.toISOString(),
     updated_at: row.updated_at.toISOString()
   };
@@ -1086,16 +1153,31 @@ var PostgresScheduleStore = class {
     const { data, pagination } = paginateOffsetRows(rows, input.limit, offset);
     return { data: data.map(toScheduleRecord), pagination };
   }
+  async getOwnedIds(input, transaction) {
+    if (input.ids.length === 0) {
+      return [];
+    }
+    const db = transaction ?? this.#db;
+    const rows = await db.selectFrom("schedule").select("id").where("tenant_id", "=", input.tenant_id).where("id", "in", [...input.ids]).where(sql3`created_by_subject->>'subject_id'`, "=", input.subject_id).execute();
+    return rows.map((row) => row.id);
+  }
   async listRuns(input, transaction) {
+    const offset = decodeOffsetPageToken(input.page_token);
     const db = transaction ?? this.#db;
-    const rows = await db.selectFrom("schedule_run").selectAll().where("tenant_id", "=", input.tenant_id).where("schedule_id", "=", input.schedule_id).orderBy("scheduled_for", "desc").orderBy("id").execute();
-    return rows.map(toRunRecord);
+    const rows = await db.selectFrom("schedule_run").selectAll().where("tenant_id", "=", input.tenant_id).where("schedule_id", "=", input.schedule_id).orderBy("scheduled_for", "desc").orderBy("id").limit(input.limit + 1).offset(offset).execute();
+    const { data, pagination } = paginateOffsetRows(rows, input.limit, offset);
+    return { data: data.map(toRunRecord), pagination };
   }
   async getRun(input, transaction) {
     const db = transaction ?? this.#db;
     const row = await db.selectFrom("schedule_run").selectAll().where("tenant_id", "=", input.tenant_id).where("id", "=", input.id).executeTakeFirst();
     return row === void 0 ? void 0 : toRunRecord(row);
   }
+  async getRunById(input, transaction) {
+    const db = transaction ?? this.#db;
+    const row = await db.selectFrom("schedule_run").selectAll().where("id", "=", input.id).executeTakeFirst();
+    return row === void 0 ? void 0 : toRunRecord(row);
+  }
   async getScheduledRunFor(input, transaction) {
     const db = transaction ?? this.#db;
     const row = await db.selectFrom("schedule_run").selectAll().where("tenant_id", "=", input.tenant_id).where("schedule_id", "=", input.schedule_id).where("status", "=", "scheduled").executeTakeFirst();
@@ -1113,6 +1195,7 @@ var PostgresScheduleStore = class {
         status: input.status,
         created_by_subject: json(input.created_by_subject),
         triggered_at: input.triggered_at ?? null,
+        reason: input.reason ?? null,
         created_at: now(),
         updated_at: now()
       }).returningAll().executeTakeFirstOrThrow();
@@ -1126,7 +1209,9 @@ var PostgresScheduleStore = class {
   }
   async updateRunStatus(input, transaction) {
     const db = transaction ?? this.#db;
-    const patch = input.status === "triggered" ? { status: input.status, triggered_at: now(), updated_at: now() } : { status: input.status, updated_at: now() };
+    const timestamp = now();
+    const reason = input.status === "failed" ? input.reason ?? null : null;
+    const patch = input.status === "triggered" ? { status: input.status, triggered_at: timestamp, reason, updated_at: timestamp } : { status: input.status, reason, updated_at: timestamp };
     const row = await db.updateTable("schedule_run").set(patch).where("tenant_id", "=", input.tenant_id).where("id", "=", input.id).returningAll().executeTakeFirst();
     return row === void 0 ? void 0 : toRunRecord(row);
   }
@@ -1247,20 +1332,14 @@ try {
     statementTimeoutMs: config_default.POSTGRES_STATEMENT_TIMEOUT_MS,
     idleInTransactionSessionTimeoutMs: config_default.POSTGRES_IDLE_IN_TRANSACTION_SESSION_TIMEOUT_MS
   });
-  const mtls = {
-    enabled: config_default.TRUEFORGE_MTLS_ENABLED,
-    dir: config_default.TRUEFORGE_MTLS_CERTS_DIR
-  };
   logger.info("Controller starting", {
     serverUrl: config_default.SERVER_URL,
-    mTlsEnabled: mtls.enabled
+    mTlsEnabled: config_default.TRUEFORGE_MTLS_ENABLED
   });
   runController({
     scheduleStore: new PostgresScheduleStore(db),
     withTransaction: (callback) => db.transaction().execute(callback),
     logger,
-    baseUrl: config_default.SERVER_URL,
-    tls: mtls,
     gracefulTimeoutSeconds: config_default.GRACEFUL_TIMEOUT_SECONDS,
     onStopped: () => db.destroy()
   });