@a-company/gnomon 0.0.0-stage → 8.0.2

package/dist/transport/gnomon-web.js

@@ -0,0 +1,688 @@
+#!/usr/bin/env node
+
+// src/transport/gnomon-web.ts
+import { Socket } from "node:net";
+
+// src/kernel/web/protocol.ts
+var WEB_CONN_MESSAGE = "conn";
+var WS_MAX_FRAME_BYTES = 4 * 1024 * 1024;
+var CHANNEL_MAX_RECORD_BYTES = 8 * 1024 * 1024;
+var HTTP_MAX_BODY_BYTES = 64 * 1024;
+var WS_PRE_AUTH_MAX_FRAME_BYTES = 16 * 1024;
+var WS_MAX_SOCKET_BUFFER = 8 * 1024 * 1024;
+var WS_WRITE_HIGH_WATER = 1024 * 1024;
+var WS_WRITE_LOW_WATER = 256 * 1024;
+function encodeRecord(r) {
+  return `${JSON.stringify(r)}
+`;
+}
+function flattenHeaders(h) {
+  const out = {};
+  for (const [k, v] of Object.entries(h)) {
+    if (v === void 0) continue;
+    out[k.toLowerCase()] = Array.isArray(v) ? v.join(", ") : v;
+  }
+  return out;
+}
+var MAX_HEADER_VALUE = 16 * 1024;
+var MAX_PATH = 8 * 1024;
+
+// src/version.ts
+var GNOMON_VERSION = "8.0.2";
+
+// src/transport/web-child.ts
+import * as http from "node:http";
+
+// src/kernel/socket/framing.ts
+var MAX_FRAME_BYTES = 4 * 1024 * 1024;
+var NL = 10;
+var CR = 13;
+var utf8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: false });
+function decodeLine(line) {
+  let end = line.length;
+  if (end > 0 && line[end - 1] === CR) end--;
+  const body = line.subarray(0, end);
+  let text;
+  try {
+    text = utf8.decode(body);
+  } catch {
+    return { kind: "malformed", reason: "utf8" };
+  }
+  if (text.trim() === "") return null;
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return { kind: "malformed", reason: "json" };
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", reason: "not-object" };
+  }
+  return { kind: "frame", value };
+}
+var NdjsonDecoder = class {
+  maxFrameBytes;
+  pending = [];
+  pendingLen = 0;
+  discarding = false;
+  discarded = 0;
+  constructor(maxFrameBytes = MAX_FRAME_BYTES) {
+    if (!Number.isInteger(maxFrameBytes) || maxFrameBytes < 1) throw new RangeError("maxFrameBytes must be a positive integer");
+    this.maxFrameBytes = maxFrameBytes;
+  }
+  /** Change the inbound limit (e.g. 16 KiB pre-auth, raised after auth). Applies to the next bytes. */
+  setMaxFrameBytes(n) {
+    if (!Number.isInteger(n) || n < 1) throw new RangeError("maxFrameBytes must be a positive integer");
+    this.maxFrameBytes = n;
+  }
+  /** Bytes buffered toward the current (incomplete) frame; never exceeds maxFrameBytes. */
+  get pendingBytes() {
+    return this.pendingLen;
+  }
+  push(chunk) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+    const out = [];
+    let offset = 0;
+    while (offset <= buf.length) {
+      const idx = buf.indexOf(NL, offset);
+      if (idx === -1) {
+        const rest = buf.subarray(offset);
+        if (rest.length === 0) break;
+        if (this.discarding) {
+          this.discarded += rest.length;
+        } else if (this.pendingLen + rest.length > this.maxFrameBytes) {
+          this.discarding = true;
+          this.discarded = this.pendingLen + rest.length;
+          this.pending = [];
+          this.pendingLen = 0;
+        } else {
+          this.pending.push(Buffer.from(rest));
+          this.pendingLen += rest.length;
+        }
+        break;
+      }
+      const seg = buf.subarray(offset, idx);
+      offset = idx + 1;
+      if (this.discarding) {
+        out.push({ kind: "oversize", bytes: this.discarded + seg.length });
+        this.discarding = false;
+        this.discarded = 0;
+        continue;
+      }
+      const lineLen = this.pendingLen + seg.length;
+      if (lineLen > this.maxFrameBytes) {
+        this.pending = [];
+        this.pendingLen = 0;
+        out.push({ kind: "oversize", bytes: lineLen });
+        continue;
+      }
+      const line = this.pendingLen === 0 ? seg : Buffer.concat([...this.pending, seg], lineLen);
+      this.pending = [];
+      this.pendingLen = 0;
+      const item = decodeLine(line);
+      if (item) out.push(item);
+    }
+    return out;
+  }
+  /** The stream ended: report an unterminated partial frame, if any. */
+  end() {
+    const bytes = this.discarding ? this.discarded : this.pendingLen;
+    const had = this.discarding || this.pendingLen > 0;
+    this.pending = [];
+    this.pendingLen = 0;
+    this.discarding = false;
+    this.discarded = 0;
+    return had ? [{ kind: "truncated", bytes }] : [];
+  }
+};
+
+// src/kernel/web/bundle.ts
+import { createHash } from "node:crypto";
+import { chmodSync, lstatSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+var BUNDLE_TREE_DOMAIN = "gnomon-bundle-tree:v1";
+var MAX_BUNDLE_FILES = 1e4;
+var MAX_BUNDLE_BYTES = 64 * 1024 * 1024;
+var SAFE_PATH = /^[A-Za-z0-9._@+-]+(\/[A-Za-z0-9._@+-]+)*$/;
+var BundleError = class extends Error {
+  constructor(why) {
+    super(`gnomon-web bundle: ${why}`);
+    this.why = why;
+    this.name = "BundleError";
+  }
+  why;
+};
+function treeHashOf(files) {
+  const names = [...files.keys()].sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+  const h = createHash("sha256").update(`${BUNDLE_TREE_DOMAIN}
+`);
+  for (const n of names) {
+    if (!SAFE_PATH.test(n) || n.split("/").some((s) => s === "." || s === "..")) throw new BundleError(`unsafe path ${JSON.stringify(n)}`);
+    h.update(`${n}\0${createHash("sha256").update(files.get(n)).digest("hex")}
+`);
+  }
+  return `sha256:${h.digest("hex")}`;
+}
+function hashBundleDir(dir) {
+  const files = /* @__PURE__ */ new Map();
+  let total = 0;
+  const visit = (abs, rel) => {
+    for (const name of readdirSync(abs).sort()) {
+      const full = path.join(abs, name);
+      const r = rel ? `${rel}/${name}` : name;
+      const st = lstatSync(full);
+      if (st.isSymbolicLink()) throw new BundleError(`symlink in bundle: ${r}`);
+      if (st.isDirectory()) visit(full, r);
+      else if (st.isFile()) {
+        if (files.size >= MAX_BUNDLE_FILES) throw new BundleError(`more than ${MAX_BUNDLE_FILES} files`);
+        const bytes = readFileSync(full);
+        total += bytes.length;
+        if (total > MAX_BUNDLE_BYTES) throw new BundleError(`more than ${MAX_BUNDLE_BYTES} bytes`);
+        files.set(r, bytes);
+      } else throw new BundleError(`not a regular file: ${r}`);
+    }
+  };
+  const root = lstatSync(dir);
+  if (!root.isDirectory()) throw new BundleError("bundle root is not a directory");
+  visit(dir, "");
+  if (!files.has("index.html")) throw new BundleError("bundle has no index.html");
+  return { hash: treeHashOf(files), files };
+}
+var PLACEHOLDER_FILES = Object.freeze({
+  "index.html": '<!doctype html>\n<html lang="en">\n<head>\n<meta charset="utf-8">\n<title>Gnomon</title>\n<script src="/app.js" defer></script>\n</head>\n<body>\n<main id="gnomon"><p>Gnomon: the GUI arrives with M1.10. This is the pinned placeholder bundle.</p></main>\n</body>\n</html>\n',
+  // §11.2 rule 2: the fragment is cleared before any other script runs (the real read-and-clear is the M1.10 SPA's).
+  // /diag and /blob/<sha> are POST with the GUI token in X-Gnomon-Token and referrerPolicy 'same-origin' (under the
+  // page's no-referrer policy a POST would carry Origin: null and fail the rule-3 origin lock).
+  "app.js": "'use strict';\nif (location.hash) history.replaceState(null, '', location.pathname + location.search);\nglobalThis.gnomonPost = (path, token, body) => fetch(path, { method: 'POST', referrerPolicy: 'same-origin', headers: { 'X-Gnomon-Token': token }, body });\n"
+});
+
+// src/transport/ws-codec.ts
+import { createHash as createHash2 } from "node:crypto";
+var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var OP = Object.freeze({ CONT: 0, TEXT: 1, BINARY: 2, CLOSE: 8, PING: 9, PONG: 10 });
+var CLOSE_CODES = Object.freeze({
+  NORMAL: 1e3,
+  GOING_AWAY: 1001,
+  PROTOCOL: 1002,
+  UNSUPPORTED_DATA: 1003,
+  NO_STATUS: 1005,
+  ABNORMAL: 1006,
+  INVALID_PAYLOAD: 1007,
+  POLICY: 1008,
+  TOO_BIG: 1009,
+  TRY_AGAIN_LATER: 1013
+});
+function validCloseCode(c) {
+  return c >= 1e3 && c <= 1003 || c >= 1007 && c <= 1014 || c >= 3e3 && c <= 4999;
+}
+function acceptKey(key) {
+  return createHash2("sha1").update(key + WS_GUID).digest("base64");
+}
+var utf82 = new TextDecoder("utf-8", { fatal: true });
+function isUtf8(b) {
+  try {
+    utf82.decode(b);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var FrameDecoder = class {
+  #chunks = [];
+  #len = 0;
+  #head = null;
+  #done = false;
+  #max;
+  constructor(maxPayload) {
+    this.#max = maxPayload;
+  }
+  get done() {
+    return this.#done;
+  }
+  get maxPayload() {
+    return this.#max;
+  }
+  /** Change the payload cap for the frames that follow (16 KiB pre-auth, raised on authentication). */
+  setMaxPayload(n) {
+    this.#max = n;
+  }
+  #peek(n) {
+    if (this.#chunks[0].length >= n) return this.#chunks[0];
+    const parts = [];
+    let got = 0;
+    for (const c of this.#chunks) {
+      parts.push(c);
+      got += c.length;
+      if (got >= n) break;
+    }
+    return Buffer.concat(parts, got);
+  }
+  #take(n) {
+    const parts = [];
+    let got = 0;
+    while (got < n) {
+      const c = this.#chunks[0];
+      const want = n - got;
+      if (c.length <= want) {
+        parts.push(c);
+        got += c.length;
+        this.#chunks.shift();
+      } else {
+        parts.push(c.subarray(0, want));
+        this.#chunks[0] = c.subarray(want);
+        got += want;
+      }
+    }
+    this.#len -= n;
+    return parts.length === 1 ? parts[0] : Buffer.concat(parts, n);
+  }
+  /** Parse (and validate) the next frame header; null = need more bytes; a fail event = refused. */
+  #parseHead() {
+    const b = this.#peek(Math.min(this.#len, 14));
+    if (b.length < 2) return null;
+    const fin = (b[0] & 128) !== 0;
+    const rsv = b[0] & 112;
+    const op = b[0] & 15;
+    const masked = (b[1] & 128) !== 0;
+    const len7 = b[1] & 127;
+    const fail = (code, why) => ({ kind: "fail", code, why });
+    if (rsv !== 0) return fail(CLOSE_CODES.PROTOCOL, "rsv-bits");
+    const control = op >= 8;
+    if (![OP.CONT, OP.TEXT, OP.BINARY, OP.CLOSE, OP.PING, OP.PONG].includes(op)) return fail(CLOSE_CODES.PROTOCOL, "reserved-opcode");
+    if (control && (!fin || len7 > 125)) return fail(CLOSE_CODES.PROTOCOL, "bad-control-frame");
+    if (op === OP.BINARY) return fail(CLOSE_CODES.UNSUPPORTED_DATA, "binary-frame");
+    if (op === OP.CONT || op === OP.TEXT && !fin) return fail(CLOSE_CODES.TOO_BIG, "fragmented");
+    if (!masked) return fail(CLOSE_CODES.PROTOCOL, "unmasked");
+    let off = 2;
+    let len = len7;
+    if (len7 === 126) {
+      if (b.length < 4) return null;
+      len = b.readUInt16BE(2);
+      off = 4;
+    } else if (len7 === 127) {
+      if (b.length < 10) return null;
+      const hi = b.readUInt32BE(2);
+      if (hi & 2147483648) return fail(CLOSE_CODES.PROTOCOL, "length-msb");
+      if (hi !== 0) return fail(CLOSE_CODES.TOO_BIG, "oversize");
+      len = b.readUInt32BE(6);
+      off = 10;
+    }
+    if (len > this.#max) return fail(CLOSE_CODES.TOO_BIG, "oversize");
+    return { op, off: off + 4, len };
+  }
+  push(chunk) {
+    if (this.#done) return [];
+    if (chunk.length) {
+      this.#chunks.push(Buffer.from(chunk));
+      this.#len += chunk.length;
+    }
+    const out = [];
+    const fail = (code, why) => {
+      this.#done = true;
+      this.#chunks = [];
+      this.#len = 0;
+      out.push({ kind: "fail", code, why });
+      return out;
+    };
+    for (; ; ) {
+      if (!this.#head) {
+        if (this.#len < 2) return out;
+        const h = this.#parseHead();
+        if (h === null) return out;
+        if ("kind" in h) {
+          const f = h;
+          return fail(f.code, f.why);
+        }
+        this.#head = h;
+      }
+      const { op, off, len } = this.#head;
+      if (this.#len < off + len) return out;
+      const frame = this.#take(off + len);
+      this.#head = null;
+      const mask = frame.subarray(off - 4, off);
+      const payload = Buffer.from(frame.subarray(off, off + len));
+      for (let i = 0; i < payload.length; i++) payload[i] ^= mask[i & 3];
+      if (op === OP.TEXT) {
+        if (!isUtf8(payload)) return fail(CLOSE_CODES.INVALID_PAYLOAD, "invalid-utf8");
+        out.push({ kind: "text", data: payload });
+      } else if (op === OP.PING) out.push({ kind: "ping", data: payload });
+      else if (op === OP.PONG) out.push({ kind: "pong", data: payload });
+      else {
+        if (payload.length === 1) return fail(CLOSE_CODES.PROTOCOL, "close-payload");
+        if (payload.length === 0) {
+          this.#done = true;
+          out.push({ kind: "close", code: null, reason: Buffer.alloc(0) });
+          return out;
+        }
+        const code = payload.readUInt16BE(0);
+        if (!validCloseCode(code)) return fail(CLOSE_CODES.PROTOCOL, "close-code");
+        const reason = payload.subarray(2);
+        if (!isUtf8(reason)) return fail(CLOSE_CODES.INVALID_PAYLOAD, "close-reason-utf8");
+        this.#done = true;
+        out.push({ kind: "close", code, reason });
+        return out;
+      }
+    }
+  }
+};
+function encodeWsFrame(op, payload = Buffer.alloc(0)) {
+  const n = payload.length;
+  let head;
+  if (n < 126) {
+    head = Buffer.from([128 | op, n]);
+  } else if (n < 65536) {
+    head = Buffer.alloc(4);
+    head[0] = 128 | op;
+    head[1] = 126;
+    head.writeUInt16BE(n, 2);
+  } else {
+    head = Buffer.alloc(10);
+    head[0] = 128 | op;
+    head[1] = 127;
+    head.writeUInt32BE(Math.floor(n / 2 ** 32), 2);
+    head.writeUInt32BE(n >>> 0, 6);
+  }
+  return Buffer.concat([head, payload]);
+}
+function closeFrame(code) {
+  if (code === null) return encodeWsFrame(OP.CLOSE);
+  const p = Buffer.alloc(2);
+  p.writeUInt16BE(code, 0);
+  return encodeWsFrame(OP.CLOSE, p);
+}
+
+// src/transport/web-child.ts
+var KERNEL_ANSWER_TIMEOUT_MS = 1e4;
+var HEADERS_TIMEOUT_MS = 1e4;
+var REQUEST_TIMEOUT_MS = 3e4;
+var STATUS_TEXT = { 400: "Bad Request", 403: "Forbidden", 404: "Not Found", 421: "Misdirected Request", 426: "Upgrade Required", 503: "Service Unavailable" };
+function runWebChild(io) {
+  const decoder = new NdjsonDecoder(CHANNEL_MAX_RECORD_BYTES);
+  let config = null;
+  let bundle = null;
+  let server = null;
+  let nextRid = 1;
+  const pendingHttp = /* @__PURE__ */ new Map();
+  const pendingUpgrade = /* @__PURE__ */ new Map();
+  const ws = /* @__PURE__ */ new Map();
+  let ended = false;
+  const emit = (r) => {
+    if (!ended) io.output.write(encodeRecord(r));
+  };
+  const finish = (code) => {
+    if (ended) return;
+    for (const c of ws.values()) c.socket.destroy();
+    for (const p of pendingUpgrade.values()) p.socket.destroy();
+    server?.close();
+    ended = true;
+    io.exit(code);
+  };
+  const fatal = (why) => {
+    emit({ t: "fatal", why });
+    finish(1);
+  };
+  const reportClosed = (rid, code, why) => {
+    const c = ws.get(rid);
+    if (!c || c.reported) return;
+    c.reported = true;
+    if (c.timer) clearInterval(c.timer);
+    ws.delete(rid);
+    emit({ t: "closed", rid, code, why });
+  };
+  const closeWs = (rid, code, why) => {
+    const c = ws.get(rid);
+    if (!c) return;
+    if (!c.closing) {
+      c.closing = true;
+      c.socket.write(closeFrame(code));
+    }
+    c.socket.end();
+    setTimeout(() => c.socket.destroy(), 1e3).unref();
+    reportClosed(rid, code, why);
+  };
+  const rawRefuse = (socket, status, headers) => {
+    const lines = [`HTTP/1.1 ${status} ${STATUS_TEXT[status] ?? "Error"}`, "Content-Length: 0", "Connection: close"];
+    for (const [k, v] of Object.entries({ ...config.defaultHeaders, ...headers })) lines.push(`${k}: ${v}`);
+    socket.end(`${lines.join("\r\n")}\r
+\r
+`);
+  };
+  const onRequest = (req, res) => {
+    const rid = nextRid++;
+    const max = config.maxBodyBytes;
+    const chunks = [];
+    let size = 0;
+    let over = false;
+    req.on("data", (c) => {
+      if (over) return;
+      size += c.length;
+      if (size > max) {
+        over = true;
+        chunks.length = 0;
+      } else chunks.push(c);
+    });
+    req.on("end", () => {
+      const timer = setTimeout(() => {
+        pendingHttp.delete(rid);
+        res.writeHead(503, { ...config.defaultHeaders, "content-length": "0" }).end();
+      }, config.answerTimeoutMs ?? KERNEL_ANSWER_TIMEOUT_MS);
+      timer.unref();
+      pendingHttp.set(rid, { res, method: req.method ?? "GET", timer });
+      const body = chunks.length ? Buffer.concat(chunks).toString("base64") : void 0;
+      emit({ t: "http", rid, method: req.method ?? "", path: req.url ?? "", headers: flattenHeaders(req.headers), ...body ? { body } : {}, ...over ? { bodyOver: true } : {} });
+    });
+    req.on("error", () => res.destroy());
+  };
+  const onUpgrade = (req, socket, head) => {
+    const rid = nextRid++;
+    socket.on("error", () => socket.destroy());
+    const timer = setTimeout(() => {
+      pendingUpgrade.delete(rid);
+      rawRefuse(socket, 503, {});
+    }, config.answerTimeoutMs ?? KERNEL_ANSWER_TIMEOUT_MS);
+    timer.unref();
+    pendingUpgrade.set(rid, { socket, head: Buffer.from(head), key: String(req.headers["sec-websocket-key"] ?? ""), timer });
+    socket.on("close", () => {
+      const p = pendingUpgrade.get(rid);
+      if (p) {
+        clearTimeout(p.timer);
+        pendingUpgrade.delete(rid);
+      }
+    });
+    emit({ t: "upgrade", rid, method: req.method ?? "", path: req.url ?? "", headers: flattenHeaders(req.headers) });
+  };
+  const accept = (rid) => {
+    const p = pendingUpgrade.get(rid);
+    if (!p) return;
+    clearTimeout(p.timer);
+    pendingUpgrade.delete(rid);
+    const { socket } = p;
+    socket.write(`HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${acceptKey(p.key)}\r
+\r
+`);
+    const c = { socket, pressured: false, decoder: new FrameDecoder(config.preAuthMaxFrameBytes), missed: 0, timer: null, reported: false, closing: false };
+    const low = Math.max(Math.min(config.writeLowWater ?? config.writeHighWater, config.writeHighWater), socket.writableHighWaterMark ?? 0);
+    socket.on("drain", () => {
+      if (c.pressured && (socket.writableLength ?? 0) <= low) {
+        c.pressured = false;
+        emit({ t: "drain", rid });
+      }
+    });
+    ws.set(rid, c);
+    c.timer = setInterval(() => {
+      if (c.missed >= config.missedPongs) return closeWs(rid, CLOSE_CODES.GOING_AWAY, "missed-pongs");
+      c.missed++;
+      socket.write(encodeWsFrame(OP.PING));
+    }, config.pingMs);
+    c.timer.unref();
+    const onData = (chunk) => {
+      for (const e of c.decoder.push(chunk)) {
+        if (e.kind === "text") emit({ t: "frame", rid, data: e.data.toString("base64") });
+        else if (e.kind === "ping") socket.write(encodeWsFrame(OP.PONG, e.data));
+        else if (e.kind === "pong") c.missed = 0;
+        else if (e.kind === "close") {
+          if (!c.closing) {
+            c.closing = true;
+            socket.write(closeFrame(e.code));
+          }
+          socket.end();
+          reportClosed(rid, e.code ?? CLOSE_CODES.NO_STATUS, "peer-close");
+        } else closeWs(rid, e.code, e.why);
+      }
+    };
+    socket.on("data", onData);
+    socket.on("close", () => reportClosed(rid, CLOSE_CODES.ABNORMAL, "socket-closed"));
+    socket.on("end", () => {
+      socket.destroy();
+      reportClosed(rid, CLOSE_CODES.ABNORMAL, "peer-ended");
+    });
+    if (p.head.length) onData(p.head);
+  };
+  const onKernel = (r) => {
+    switch (r.t) {
+      case "config":
+        return;
+      // only the first record configures
+      case "respond": {
+        const h = pendingHttp.get(r.rid);
+        if (h) {
+          clearTimeout(h.timer);
+          pendingHttp.delete(r.rid);
+          const body = r.body ? Buffer.from(r.body, "base64") : Buffer.alloc(0);
+          h.res.writeHead(r.status, { ...r.headers, "content-length": String(body.length) });
+          h.res.end(h.method === "HEAD" ? void 0 : body);
+          return;
+        }
+        const u = pendingUpgrade.get(r.rid);
+        if (u) {
+          clearTimeout(u.timer);
+          pendingUpgrade.delete(r.rid);
+          rawRefuse(u.socket, r.status, r.headers);
+        }
+        return;
+      }
+      case "static": {
+        const h = pendingHttp.get(r.rid);
+        if (!h) return;
+        clearTimeout(h.timer);
+        pendingHttp.delete(r.rid);
+        const bytes = bundle.files.get(r.file);
+        if (!bytes) {
+          h.res.writeHead(404, { ...config.defaultHeaders, ...r.headers, "content-length": "0" }).end();
+          return;
+        }
+        h.res.writeHead(200, { ...r.headers, "content-length": String(bytes.length) });
+        h.res.end(h.method === "HEAD" ? void 0 : bytes);
+        return;
+      }
+      case "accept":
+        return accept(r.rid);
+      case "send": {
+        const c = ws.get(r.rid);
+        if (!c || c.closing) return;
+        c.socket.write(encodeWsFrame(OP.TEXT, Buffer.from(r.data, "base64")));
+        const queued = c.socket.writableLength ?? 0;
+        if (queued > config.maxSocketBuffer) return closeWs(r.rid, CLOSE_CODES.POLICY, "backpressure");
+        if (!c.pressured && queued > config.writeHighWater) {
+          c.pressured = true;
+          emit({ t: "pressure", rid: r.rid, bytes: queued });
+        }
+        return;
+      }
+      case "limit": {
+        const c = ws.get(r.rid);
+        if (c) c.decoder.setMaxPayload(Math.min(r.maxFrameBytes, config.maxFrameBytes));
+        return;
+      }
+      case "close": {
+        if (ws.has(r.rid)) return closeWs(r.rid, r.code, "kernel-close");
+        const u = pendingUpgrade.get(r.rid);
+        if (u) {
+          clearTimeout(u.timer);
+          pendingUpgrade.delete(r.rid);
+          u.socket.destroy();
+        }
+        return;
+      }
+      case "shutdown":
+        return finish(0);
+    }
+  };
+  const start = (cfg) => {
+    config = cfg;
+    try {
+      bundle = hashBundleDir(cfg.bundleDir);
+    } catch (err) {
+      return fatal(`bundle: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const s = http.createServer({ maxHeaderSize: 16 * 1024 }, onRequest);
+    server = s;
+    s.headersTimeout = cfg.headersTimeoutMs ?? HEADERS_TIMEOUT_MS;
+    s.requestTimeout = cfg.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
+    s.on("request", (req, res) => {
+      const sock = req.socket;
+      arm(sock, s.requestTimeout);
+      req.on("end", () => disarm(sock));
+      res.on("finish", () => {
+        if (!sock.destroyed) arm(sock, s.headersTimeout);
+      });
+    });
+    s.on("upgrade", (_req, socket) => disarm(socket));
+    s.on("upgrade", onUpgrade);
+    s.on("clientError", (_err, socket) => socket.destroy());
+    emit({ t: "ready", bundleHash: bundle.hash, files: bundle.files.size });
+  };
+  const deadlines = /* @__PURE__ */ new WeakMap();
+  const disarm = (socket) => {
+    const t = deadlines.get(socket);
+    if (t) clearTimeout(t);
+    deadlines.delete(socket);
+  };
+  const arm = (socket, ms) => {
+    disarm(socket);
+    const t = setTimeout(() => {
+      deadlines.delete(socket);
+      socket.destroy();
+    }, ms);
+    t.unref();
+    deadlines.set(socket, t);
+  };
+  io.onSocket((socket) => {
+    if (ended || server === null) return void socket.destroy();
+    arm(socket, server.headersTimeout);
+    socket.once("close", () => disarm(socket));
+    server.emit("connection", socket);
+  });
+  io.input.on("data", (chunk) => {
+    for (const item of decoder.push(chunk)) {
+      if (item.kind !== "frame") return fatal(`channel: ${item.kind}`);
+      const r = item.value;
+      if (config === null) {
+        if (r.t !== "config") return fatal("channel: the first record must be config");
+        start(r);
+      } else onKernel(r);
+    }
+  });
+  io.input.on("end", () => finish(0));
+}
+
+// src/transport/gnomon-web.ts
+if (process.argv.includes("--version")) {
+  process.stdout.write(`gnomon-web ${GNOMON_VERSION}
+`);
+} else {
+  runWebChild({
+    input: process.stdin,
+    output: process.stdout,
+    exit: (code) => process.exit(code),
+    // The IPC channel carries only the connected sockets the kernel accepted (§15.5); anything else is dropped.
+    onSocket: (accept) => void process.on("message", (m, handle) => {
+      if (m === WEB_CONN_MESSAGE && handle instanceof Socket) accept(handle);
+      else if (handle && typeof handle.destroy === "function") handle.destroy();
+      else if (handle && typeof handle.close === "function") handle.close();
+    })
+  });
+}