host

type DNSApplier interface {
	// ApplyDNS installs the resident sandbox's VPC name plane atomically.
	// Idempotent, last-writer-wins by Generation; returns the generation now
	// in effect.
	ApplyDNS(apply DNSApply) (uint64, error)
}

type DNSApply struct {
	// Zones are the DNS zones the resident's resolver answers authoritatively
	// for (NXDOMAIN for unbound names within them).
	Zones []string
	// Bindings is the full desired binding set; it replaces the prior set
	// atomically. Their Reachable prefixes also feed the egress bridge's SSRF
	// carve-out.
	Bindings []vpcdns.Binding
	// Generation orders applies; a push older than the last applied one for
	// the sandbox is ignored. Independent of the egress plane's generation.
	Generation uint64
}

type EgressApplier interface {
	// ApplyEgress installs the resident sandbox's egress config atomically.
	// Idempotent, last-writer-wins by Generation; returns the generation now
	// in effect (the request's if applied, the newer retained one if the
	// request was stale).
	ApplyEgress(apply EgressApply) (uint64, error)
}

type EgressApply struct {
	// Services is the full desired set of per-Service egress planes for the
	// resident; it replaces the prior set atomically.
	Services []sandbox.ServiceEgress
	// InvocationID is stamped on egress connections for attribution.
	InvocationID string
	// Generation orders applies; a push older than the last applied one for
	// the sandbox is ignored.
	Generation uint64
}

type EgressState struct {
	// Services is the full set of per-Service egress planes for the resident.
	Services []sandbox.ServiceEgress
	// InvocationID is stamped on egress connections for attribution.
	InvocationID string
	// Generation is the config generation this state was applied at. It lives
	// here — not beside the caller — so the guard shares the state's exact
	// lifecycle: a recreated sandbox starts from a fresh zero-generation state
	// and can never report a generation whose config was dropped with the old
	// sandbox.
	Generation uint64

	// DNSZones and DNSBindings are the resident's VPC name plane (the
	// DNSConfig/ApplyDNS push): the zones its DNS listener answers
	// authoritatively for and the bindings workers may resolve — whose
	// Reachable prefixes also back the egress bridge's SSRF carve-out.
	// DNSGeneration orders name-plane applies independently of Generation:
	// the two planes have independent pushers (project apiserver vs infra
	// watch) with independent counters.
	DNSZones      []string
	DNSBindings   []vpcdns.Binding
	DNSGeneration uint64
}

type PlatformPullTLSFunc func(registryHost string) (*tls.Config, bool)

type PullCredentials = auth.Credential

type ResidentConfig struct {
	// Tenant is the project UUID this resident serves; empty for the
	// single-project topologies (apoxy dev, dedicated mode). It keys the
	// sandbox id and the inbound socket path via pkg/workerd/names, so the
	// gateway's per-project resident cluster dials the matching socket.
	Tenant string

	// StateDir is runsc's --root.
	StateDir string
	// RootDir is the host staging area for the generated dispatcher config.
	RootDir string
	// ImageBaseDir is where the stock workerd image is pulled and extracted.
	ImageBaseDir string

	// WorkerdImage is the stock upstream workerd OCI image the resident runs.
	// The dispatcher source is inlined into the config, so this image carries no
	// customer code — only the workerd binary.
	WorkerdImage string
	// ListenAddr is the dispatcher's http socket bind address (workerd syntax,
	// e.g. "*:8080"). Defaults to defaultResidentListenAddr.
	ListenAddr string
	// ControlHostAddr is the HOST loopback TCP address (e.g. "127.0.0.1:2024")
	// the manager's control HTTP server listens on. The clrk control forwarder
	// dials it for each connection the dispatcher opens to ControlForwardAddr.
	ControlHostAddr string
	// ControlForwardAddr is the in-sandbox TCP address the dispatcher dials for
	// the control channel; the clrk control forwarder routes it to
	// ControlHostAddr. Defaults to defaultControlForwardAddr.
	ControlForwardAddr string

	// OverlayNetnsPathFunc maps a tenant to the bind-mount path of that
	// project's VPC network namespace (where the VTEP TUN and overlay routes
	// live), or "" when the tenant has none. When it yields a path, the egress
	// bridge dials overlay (Apoxy VPC ULA) destinations from inside that
	// namespace. The path is opaque to this package — naming conventions
	// (e.g. /var/run/netns/vpc-<projectID>) belong to the embedder. nil (the
	// default) keeps the current behavior: all egress dials from the pod netns.
	OverlayNetnsPathFunc func(tenant string) string
}

type ResidentConfigInput struct {
	// SocketAddr is the address the dispatcher's http socket binds — where the
	// inbound forwarder (APO-694) delivers Envoy's requests. workerd syntax:
	// "*:8080", "127.0.0.1:8080", or "unix:/path.sock".
	SocketAddr string
	// ManagerAddr is the in-sandbox address of the manager service the dispatcher
	// fetches worker definitions from through the control forwarder.
	ManagerAddr string
}

type ResidentFactory struct {
	// contains filtered or unexported fields
}

type ResidentHost struct {
	// contains filtered or unexported fields
}

type ResidentInstance struct {
	SandboxID sandbox.SandboxID
	// InboundSocket is the host AF_UNIX path that fronts the dispatcher's http
	// socket via the inbound forwarder; the backplane's resident Envoy cluster
	// dials it. Empty until Running.
	InboundSocket string
	// SandboxIP is the in-Sentry container IP (diagnostics / isolation asserts).
	SandboxIP netip.Addr
}

type ResidentRuntime interface {
	// EnsureResident brings this tenant's resident up if it is not already, and
	// is idempotent: a second call while the resident is up returns the same
	// instance without recreating the sandbox.
	EnsureResident(ctx context.Context) (*ResidentInstance, error)
	// Stop drains and tears down the resident, including its staged config.
	Stop(ctx context.Context) error
}

type WorkerDefinition struct {
	CompatibilityDate  string                   `json:"compatibilityDate"`
	CompatibilityFlags []string                 `json:"compatibilityFlags,omitempty"`
	MainModule         string                   `json:"mainModule"`
	Modules            map[string]moduleContent `json:"modules"`
	Env                map[string]string        `json:"env,omitempty"`
}