host

type BuildInput struct {
	// Manifest is the bundle's BundleManifest (modules + compat + assets).
	Manifest computev1alpha1.BundleManifest
	// Config is the revision's serving config (runtime overrides, bindings, env).
	Config computev1alpha1.ServiceConfigSpec
	// Socket is the listening socket workerd binds.
	Socket SocketSpec
	// AssetsDir is the in-jail absolute path the assets layer extracted to.
	// Used only when Manifest.AssetsPrefix is set.
	AssetsDir string
	// Secrets maps binding names (Binding.Name, for bindings of type secret)
	// to their resolved values. The caller resolves them from the referenced
	// SecretStores; rendering fails on a secret binding with no entry here.
	Secrets map[string]string
}

type Config struct {
	// StateDir is runsc's --root (one subdirectory per sandbox).
	StateDir string
	// RootDir is the host staging area for generated config and per-sandbox
	// netconfig.
	RootDir string
	// ImageBaseDir is where OCI bundle images are pulled and extracted.
	ImageBaseDir string
}

type DNSApplier interface {
	// ApplyDNS installs the resident sandbox's VPC name plane atomically.
	// Idempotent, last-writer-wins by Generation; returns the generation now
	// in effect.
	ApplyDNS(apply DNSApply) (uint64, error)
}

type DNSApply struct {
	// Zones are the DNS zones the resident's resolver answers authoritatively
	// for (NXDOMAIN for unbound names within them).
	Zones []string
	// Bindings is the full desired binding set; it replaces the prior set
	// atomically. Their Reachable prefixes also feed the egress bridge's SSRF
	// carve-out.
	Bindings []vpcdns.Binding
	// Generation orders applies; a push older than the last applied one for
	// the sandbox is ignored. Independent of the egress plane's generation.
	Generation uint64
}

type EgressApplier interface {
	// ApplyEgress installs the resident sandbox's egress config atomically.
	// Idempotent, last-writer-wins by Generation; returns the generation now
	// in effect (the request's if applied, the newer retained one if the
	// request was stale).
	ApplyEgress(apply EgressApply) (uint64, error)
}

type EgressApply struct {
	// Services is the full desired set of per-Service egress planes for the
	// resident; it replaces the prior set atomically.
	Services []sandbox.ServiceEgress
	// InvocationID is stamped on egress connections for attribution.
	InvocationID string
	// Generation orders applies; a push older than the last applied one for
	// the sandbox is ignored.
	Generation uint64
}

type EgressState struct {
	// Services is the full set of per-Service egress planes for the resident.
	Services []sandbox.ServiceEgress
	// InvocationID is stamped on egress connections for attribution.
	InvocationID string
	// Generation is the config generation this state was applied at. It lives
	// here — not beside the caller — so the guard shares the state's exact
	// lifecycle: a recreated sandbox starts from a fresh zero-generation state
	// and can never report a generation whose config was dropped with the old
	// sandbox.
	Generation uint64

	// DNSZones and DNSBindings are the resident's VPC name plane (the
	// DNSConfig/ApplyDNS push): the zones its DNS listener answers
	// authoritatively for and the bindings workers may resolve — whose
	// Reachable prefixes also back the egress bridge's SSRF carve-out.
	// DNSGeneration orders name-plane applies independently of Generation:
	// the two planes have independent pushers (project apiserver vs infra
	// watch) with independent counters.
	DNSZones      []string
	DNSBindings   []vpcdns.Binding
	DNSGeneration uint64
}

type PlatformPullTLSFunc func(registryHost string) (*tls.Config, bool)

type PullCredentials = auth.Credential

type Resident struct {
	Tenant    string
	Revision  string
	SandboxID sandbox.SandboxID
	Socket    SocketSpec
	Phase     sandbox.SandboxPhase
	// SandboxIP is the in-Sentry container IP the workerd socket binds on.
	// There is no host route to it — reaching the worker goes through
	// InboundSocket — but it is surfaced here for per-tenant isolation
	// assertions and for the lifecycle owner (APO-796).
	SandboxIP netip.Addr

	// InboundSocket is the host AF_UNIX socket path that fronts the in-Sentry
	// worker via the APO-694 ingress forwarder. An Envoy upstream cluster
	// (APO-628) — or the acceptance test — dials this to reach the worker's
	// fetch handler. Set once the resident is Running; empty if the socket
	// is non-HTTP.
	InboundSocket string
}

type ResidentConfig struct {
	// Tenant is the project UUID this resident serves; empty for the
	// single-project topologies (apoxy dev, dedicated mode). It keys the
	// sandbox id and the inbound socket path via pkg/workerd/names, so the
	// gateway's per-project resident cluster dials the matching socket.
	Tenant string

	// StateDir is runsc's --root.
	StateDir string
	// RootDir is the host staging area for the generated dispatcher config.
	RootDir string
	// ImageBaseDir is where the stock workerd image is pulled and extracted.
	ImageBaseDir string

	// WorkerdImage is the stock upstream workerd OCI image the resident runs.
	// The dispatcher source is inlined into the config, so this image carries no
	// customer code — only the workerd binary.
	WorkerdImage string
	// ListenAddr is the dispatcher's http socket bind address (workerd syntax,
	// e.g. "*:8080"). Defaults to defaultResidentListenAddr.
	ListenAddr string
	// ControlHostAddr is the HOST loopback TCP address (e.g. "127.0.0.1:2024")
	// the manager's control HTTP server listens on. The clrk control forwarder
	// dials it for each connection the dispatcher opens to ControlForwardAddr.
	ControlHostAddr string
	// ControlForwardAddr is the in-sandbox TCP address the dispatcher dials for
	// the control channel; the clrk control forwarder routes it to
	// ControlHostAddr. Defaults to defaultControlForwardAddr.
	ControlForwardAddr string

	// OverlayNetnsPathFunc maps a tenant to the bind-mount path of that
	// project's VPC network namespace (where the VTEP TUN and overlay routes
	// live), or "" when the tenant has none. When it yields a path, the egress
	// bridge dials overlay (Apoxy VPC ULA) destinations from inside that
	// namespace. The path is opaque to this package — naming conventions
	// (e.g. /var/run/netns/vpc-<projectID>) belong to the embedder. nil (the
	// default) keeps the current behavior: all egress dials from the pod netns.
	OverlayNetnsPathFunc func(tenant string) string
}

type ResidentConfigInput struct {
	// SocketAddr is the address the dispatcher's http socket binds — where the
	// inbound forwarder (APO-694) delivers Envoy's requests. workerd syntax:
	// "*:8080", "127.0.0.1:8080", or "unix:/path.sock".
	SocketAddr string
	// ManagerAddr is the address of the external manager service the dispatcher
	// fetches worker definitions from (the control channel). Typically a donated
	// AF_UNIX socket, e.g. "unix:/run/workerd-host/control.sock".
	ManagerAddr string
}

type ResidentFactory struct {
	// contains filtered or unexported fields
}

type ResidentHost struct {
	// contains filtered or unexported fields
}

type ResidentInstance struct {
	SandboxID sandbox.SandboxID
	// InboundSocket is the host AF_UNIX path that fronts the dispatcher's http
	// socket via the inbound forwarder; the backplane's resident Envoy cluster
	// dials it. Empty until Running.
	InboundSocket string
	// SandboxIP is the in-Sentry container IP (diagnostics / isolation asserts).
	SandboxIP netip.Addr
}

type ResidentRef struct {
	// Tenant is the isolation slot; one live workerd per tenant.
	Tenant string
	// Revision is the ServiceRevision name — the reload key.
	Revision string
	// Bundle is the digest-pinned OCI artifact to run.
	Bundle computev1alpha1.BundleRef
	// Config is the serving config (runtime overrides, bindings, env, mode).
	Config computev1alpha1.ServiceConfigSpec
	// Socket is the listening socket workerd binds.
	Socket SocketSpec
}

type ResidentRuntime interface {
	// EnsureResident brings this tenant's resident up if it is not already, and
	// is idempotent: a second call while the resident is up returns the same
	// instance without recreating the sandbox.
	EnsureResident(ctx context.Context) (*ResidentInstance, error)
	// Stop drains and tears down the resident, including its staged config.
	Stop(ctx context.Context) error
}

type Runtime struct {
	// contains filtered or unexported fields
}

type SocketKind int

type SocketSpec struct {
	Kind SocketKind
	// Addr is the listen address in workerd syntax: "*:8080" or
	// "127.0.0.1:8080" for TCP, or "unix:/path/to.sock" for a UDS.
	Addr string
}

type WorkerDefinition struct {
	CompatibilityDate  string                   `json:"compatibilityDate"`
	CompatibilityFlags []string                 `json:"compatibilityFlags,omitempty"`
	MainModule         string                   `json:"mainModule"`
	Modules            map[string]moduleContent `json:"modules"`
	Env                map[string]string        `json:"env,omitempty"`
}