@geminixiang/mikan 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/sandbox/gondolin-gateway.js

@@ -0,0 +1,400 @@
+import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { hostname } from "node:os";
+import { TLSSocket, createServer as createTlsServer } from "node:tls";
+import * as log from "../log.js";
+import { gondolinFleet } from "./gondolin-fleet.js";
+import { gondolinJoin } from "./gondolin-join.js";
+import { GondolinRemoteConnection, GondolinWorkerUnreachableError, createSessionFrameParser, encodeSessionMessage, } from "./gondolin-remote.js";
+const RPC_TIMEOUT_MS = 150_000;
+const TUNNEL_TIMEOUT_MS = 15_000;
+/**
+ * Splits a byte stream into u32be-length-prefixed JSON frames, preserving any
+ * bytes after the point where the consumer stops parsing (a tunnel connection
+ * switches protocols after its preamble frame).
+ */
+function createControlFrameReader(onFrame) {
+    let buffer = Buffer.alloc(0);
+    let stopped = false;
+    return {
+        push(chunk) {
+            if (stopped)
+                return;
+            buffer = Buffer.concat([buffer, chunk]);
+            for (;;) {
+                // onFrame may call stop() synchronously (a tunnel switching protocols)
+                if (stopped || buffer.length < 4)
+                    return;
+                const length = buffer.readUInt32BE(0);
+                if (buffer.length < 4 + length)
+                    return;
+                const payload = buffer.subarray(4, 4 + length);
+                buffer = buffer.subarray(4 + length);
+                let frame;
+                try {
+                    frame = JSON.parse(payload.toString("utf8"));
+                }
+                catch {
+                    continue; // skip malformed frames
+                }
+                onFrame(frame, buffer);
+            }
+        },
+        stop() {
+            stopped = true;
+        },
+    };
+}
+function encodeControlFrame(frame) {
+    return encodeSessionMessage(frame);
+}
+function defaultIsAuthorized(socket) {
+    return socket instanceof TLSSocket && socket.authorized;
+}
+/**
+ * The host side of dial-home workers: one mTLS listener that accepts worker
+ * control channels (register/ping/RPC responses) and per-command dial-back
+ * tunnels, keeps the registry of connected workers, and attaches each one to
+ * the fleet as a regular worker connection. Placement, leases, fencing, and
+ * failover are unchanged — this only reverses who dials whom.
+ */
+class GondolinWorkerGateway {
+    constructor() {
+        this.overrides = {};
+        this.workers = new Map();
+        this.pendingTunnels = new Map();
+    }
+    configure(settings, overrides) {
+        this.stop();
+        this.settings = settings;
+        this.overrides = overrides ?? {};
+    }
+    isConfigured() {
+        return this.settings !== undefined;
+    }
+    /** Registered workers and their liveness (admin/observability surface). */
+    list() {
+        return Array.from(this.workers.values()).map((worker) => ({
+            name: worker.info.name,
+            connected: !worker.socket.destroyed,
+            activeRuntimes: worker.activeRuntimes,
+            workspaceError: worker.workspaceError,
+            info: worker.info,
+        }));
+    }
+    /**
+     * Start the listener. Without explicit certificate settings the gateway
+     * provisions its own: a private worker CA plus a server certificate signed
+     * by it (required for join's CA pinning to also authenticate the host).
+     */
+    async start() {
+        if (!this.settings || this.server)
+            return;
+        const settings = this.settings;
+        if (!settings.workspaceRoot) {
+            // dial-home workers inherit workspaceRoot from here; without it every
+            // runtime is rejected with "escapes the workspace root"
+            throw new Error("gondolin gateway requires workspaceRoot (the worker-side shared workspace path); " +
+                "set sandbox.gondolin.remote.gateway.workspaceRoot");
+        }
+        let material;
+        if (settings.certFile && settings.keyFile && settings.clientCaFile) {
+            material = {
+                certFile: settings.certFile,
+                keyFile: settings.keyFile,
+                clientCaFile: settings.clientCaFile,
+            };
+        }
+        else {
+            if (!gondolinJoin.isConfigured()) {
+                throw new Error("gondolin gateway auto-init requires the join service to be configured");
+            }
+            const issued = await gondolinJoin.ensureServerCert(settings.hostnames ?? [hostname()]);
+            material = { ...issued, clientCaFile: gondolinJoin.paths().caFile };
+        }
+        const factory = this.overrides.createServer ??
+            ((onConnection) => createTlsServer({
+                cert: readFileSync(material.certFile),
+                key: readFileSync(material.keyFile),
+                ca: readFileSync(material.clientCaFile),
+                requestCert: true,
+                // unauthenticated connections may only send a join frame; the
+                // per-frame authorization gate enforces that below
+                rejectUnauthorized: false,
+                minVersion: "TLSv1.3",
+            }, onConnection));
+        this.server = factory((socket) => this.handleConnection(socket));
+        this.server.listen(this.settings.port, () => {
+            log.logInfo(`Gondolin worker gateway listening on :${this.settings?.port}`);
+        });
+    }
+    stop() {
+        for (const worker of this.workers.values()) {
+            worker.socket.destroy();
+            for (const pending of worker.pendingRpc.values())
+                clearTimeout(pending.timer);
+        }
+        this.workers.clear();
+        for (const pending of this.pendingTunnels.values())
+            clearTimeout(pending.timer);
+        this.pendingTunnels.clear();
+        this.server?.close();
+        this.server = undefined;
+    }
+    /** Routes one inbound connection by its first frame: control or tunnel. */
+    handleConnection(socket) {
+        socket.setNoDelay(true);
+        let routed = false;
+        const authorized = (this.overrides.isAuthorized ?? defaultIsAuthorized)(socket);
+        const reader = createControlFrameReader((frame, leftover) => {
+            if (!routed) {
+                routed = true;
+                if (frame.type === "join") {
+                    void this.handleJoin(socket, frame);
+                }
+                else if (!authorized) {
+                    // everything except join requires a CA-signed client certificate
+                    socket.destroy();
+                }
+                else if (frame.type === "register" && frame.name) {
+                    this.acceptControlChannel(socket, frame, reader);
+                }
+                else if (frame.type === "tunnel" && frame.nonce) {
+                    reader.stop();
+                    socket.removeAllListeners("data");
+                    this.acceptTunnel(socket, frame.nonce, leftover);
+                }
+                else {
+                    socket.destroy();
+                }
+                return;
+            }
+            this.handleControlFrame(socket, frame);
+        });
+        socket.on("data", (chunk) => reader.push(chunk));
+        socket.on("error", () => socket.destroy());
+    }
+    acceptControlChannel(socket, registration, _reader) {
+        const name = registration.name;
+        const previous = this.workers.get(name);
+        if (previous && !previous.socket.destroyed) {
+            log.logInfo(`Gondolin worker '${name}' re-registered; superseding previous connection`);
+            previous.socket.destroy();
+        }
+        const worker = {
+            info: registration,
+            socket,
+            connectedAt: Date.now(),
+            lastSeen: Date.now(),
+            activeRuntimes: registration.runtimes?.length ?? 0,
+            pendingRpc: new Map(),
+            nextRpcId: 1,
+        };
+        this.workers.set(name, worker);
+        const surviving = registration.runtimes?.length ?? 0;
+        log.logInfo(`Gondolin worker joined: ${name} (${registration.os}/${registration.arch}, ` +
+            `${registration.accelerator}, ${registration.cpus} cpus, ` +
+            `cap ${registration.maxRuntimes ?? "∞"}, ${surviving} runtimes surviving)`);
+        const overrides = this.settings?.workers?.[name];
+        gondolinFleet.attachWorker({
+            name,
+            url: `dialhome://${name}`,
+            workspaceRoot: this.settings?.workspaceRoot,
+            maxRuntimes: overrides?.maxRuntimes ?? registration.maxRuntimes,
+            draining: overrides?.draining,
+        }, (connectionOverrides) => new GondolinRemoteConnection({ name, url: `dialhome://${name}`, workspaceRoot: this.settings?.workspaceRoot }, {
+            ...connectionOverrides,
+            ...(this.overrides.leaseTtlSeconds !== undefined
+                ? { leaseTtlSeconds: this.overrides.leaseTtlSeconds }
+                : {}),
+            request: (method, path, body, headers) => this.rpc(name, method, path, body, headers),
+            tunnel: (path, headers, callbacks) => this.openTunnel(name, path, headers, callbacks),
+        }));
+        this.applyWorkspaceHealth(worker, registration.workspaceError);
+        // a worker that reconnected may carry runtimes whose placements moved
+        void gondolinFleet.reconcile();
+        socket.on("close", () => {
+            const current = this.workers.get(name);
+            if (current !== worker)
+                return; // superseded
+            for (const pending of worker.pendingRpc.values())
+                clearTimeout(pending.timer);
+            worker.pendingRpc.clear();
+            log.logWarning(`Gondolin worker disconnected: ${name} (placements fence until lease expiry)`);
+            gondolinFleet.detachWorker(name);
+            this.workers.delete(name);
+        });
+    }
+    handleControlFrame(socket, frame) {
+        const worker = this.workerBySocket(socket);
+        if (!worker)
+            return;
+        worker.lastSeen = Date.now();
+        if (frame.type === "ping") {
+            if (typeof frame.activeRuntimes === "number") {
+                worker.activeRuntimes = frame.activeRuntimes;
+            }
+            // omitted on healthy pings (Go omitempty), so absence means recovered
+            this.applyWorkspaceHealth(worker, frame.workspaceError);
+            socket.write(encodeControlFrame({ type: "pong" }));
+            return;
+        }
+        if (frame.type === "response" && typeof frame.id === "number") {
+            const pending = worker.pendingRpc.get(frame.id);
+            if (!pending)
+                return;
+            worker.pendingRpc.delete(frame.id);
+            clearTimeout(pending.timer);
+            pending.resolve(frame);
+        }
+    }
+    /**
+     * Track shared-workspace health from register/ping frames and push it into
+     * the fleet, logging only the transitions. A worker whose NFS mount died
+     * keeps its control channel alive — this is what turns that silent state
+     * into refused placements and fail-fast execs.
+     */
+    applyWorkspaceHealth(worker, error) {
+        const next = error || undefined;
+        if (next === worker.workspaceError) {
+            gondolinFleet.setWorkspaceHealth(worker.info.name, next); // attach may have reset it
+            return;
+        }
+        if (next) {
+            log.logWarning(`Gondolin worker '${worker.info.name}' workspace is unusable: ${next} — new placements disabled until it recovers`);
+        }
+        else {
+            log.logInfo(`Gondolin worker '${worker.info.name}' workspace recovered`);
+        }
+        worker.workspaceError = next;
+        gondolinFleet.setWorkspaceHealth(worker.info.name, next);
+    }
+    /** RPC to a worker over its control channel (the reverse of HTTPS requests). */
+    rpc(name, method, path, body, headers) {
+        const worker = this.workers.get(name);
+        if (!worker || worker.socket.destroyed) {
+            return Promise.reject(new GondolinWorkerUnreachableError(`worker '${name}' is not connected`));
+        }
+        const id = worker.nextRpcId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                worker.pendingRpc.delete(id);
+                reject(new GondolinWorkerUnreachableError(`RPC to worker '${name}' timed out (${method} ${path})`));
+            }, this.overrides.rpcTimeoutMs ?? RPC_TIMEOUT_MS);
+            timer.unref?.();
+            worker.pendingRpc.set(id, {
+                timer,
+                resolve: (frame) => resolve({
+                    status: frame.status ?? 0,
+                    json: (frame.body ?? {}),
+                }),
+            });
+            worker.socket.write(encodeControlFrame({ type: "request", id, method, path, body, headers }));
+        });
+    }
+    /** Ask the worker to dial back a data connection for one session tunnel. */
+    openTunnel(name, path, headers, callbacks) {
+        const worker = this.workers.get(name);
+        if (!worker || worker.socket.destroyed) {
+            const error = new Error(`worker '${name}' is not connected`);
+            error.code = "ECONNREFUSED"; // nothing executed — safe to recreate
+            return Promise.reject(error);
+        }
+        const sessionId = path.split("/")[3];
+        const nonce = randomBytes(16).toString("hex");
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pendingTunnels.delete(nonce);
+                const error = new Error(`worker '${name}' did not dial back a tunnel`);
+                error.code = "ECONNREFUSED";
+                reject(error);
+            }, this.overrides.tunnelTimeoutMs ?? TUNNEL_TIMEOUT_MS);
+            timer.unref?.();
+            this.pendingTunnels.set(nonce, {
+                timer,
+                resolve: ({ socket, leftover }) => {
+                    let closed = false;
+                    const parse = createSessionFrameParser(callbacks);
+                    if (leftover.length > 0)
+                        parse(leftover);
+                    socket.on("data", parse);
+                    socket.on("error", (error) => {
+                        if (closed)
+                            return;
+                        closed = true;
+                        callbacks.onClose(error);
+                    });
+                    socket.on("close", () => {
+                        if (closed)
+                            return;
+                        closed = true;
+                        callbacks.onClose();
+                    });
+                    resolve({
+                        send: (message) => {
+                            if (!closed)
+                                socket.write(encodeSessionMessage(message));
+                        },
+                        close: () => {
+                            if (closed)
+                                return;
+                            closed = true;
+                            socket.destroy();
+                        },
+                    });
+                },
+            });
+            worker.socket.write(encodeControlFrame({ type: "open-tunnel", nonce, sessionId, headers }));
+        });
+    }
+    /**
+     * One-time token → CA-signed client certificate. The only operation an
+     * unauthenticated connection may perform; the connection closes after the
+     * response either way.
+     */
+    async handleJoin(socket, frame) {
+        const refuse = (message) => {
+            log.logWarning(`Gondolin worker join refused: ${message}`);
+            socket.end(encodeControlFrame({ type: "join-error", message }));
+        };
+        if (!gondolinJoin.isConfigured()) {
+            refuse("join is not enabled on this gateway");
+            return;
+        }
+        if (!frame.token || !frame.csr || !frame.name) {
+            refuse("join requires token, csr, and name");
+            return;
+        }
+        if (!gondolinJoin.consumeToken(frame.token)) {
+            refuse(`invalid or expired join token (worker '${frame.name}')`);
+            return;
+        }
+        try {
+            const signed = await gondolinJoin.signCsr(frame.csr);
+            log.logInfo(`Gondolin worker '${frame.name}' joined: client certificate issued`);
+            socket.end(encodeControlFrame({ type: "join-ok", cert: signed.certPem, ca: signed.caPem }));
+        }
+        catch (err) {
+            refuse(`certificate issuance failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    acceptTunnel(socket, nonce, leftover) {
+        const pending = this.pendingTunnels.get(nonce);
+        if (!pending) {
+            socket.destroy();
+            return;
+        }
+        this.pendingTunnels.delete(nonce);
+        clearTimeout(pending.timer);
+        pending.resolve({ socket, leftover: Buffer.from(leftover) });
+    }
+    workerBySocket(socket) {
+        for (const worker of this.workers.values()) {
+            if (worker.socket === socket)
+                return worker;
+        }
+        return undefined;
+    }
+}
+export const gondolinGateway = new GondolinWorkerGateway();
+//# sourceMappingURL=gondolin-gateway.js.map

package/dist/sandbox/gondolin-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-gateway.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAG9B,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAwCjC;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAwD;IAIxF,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACxC,SAAS,CAAC;gBACR,uEAAuE;gBACvE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBACzC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;oBAAE,OAAO;gBACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;gBAC/C,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;gBACrC,IAAI,KAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,wBAAwB;gBACpC,CAAC;gBACD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAYD,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,YAAY,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB;IAA3B;QAEU,cAAS,GAAqB,EAAE,CAAC;QAExB,YAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9C,mBAAc,GAAG,IAAI,GAAG,EAGtC,CAAC;IAwXN,CAAC;IAtXC,SAAS,CAAC,QAAkC,EAAE,SAA4B;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;IACrC,CAAC;IAED,2EAA2E;IAC3E,IAAI;QAOF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC5B,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,QAAqE,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACnE,QAAQ,GAAG;gBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvF,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,SAAS,CAAC,YAAY;YAC3B,CAAC,CAAC,YAAsC,EAAE,EAAE,CAC1C,eAAe,CACb;gBACE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnC,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACvC,WAAW,EAAE,IAAI;gBACjB,8DAA8D;gBAC9D,mDAAmD;gBACnD,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,SAAS;aACtB,EACD,YAAY,CACb,CAAC,CAAC;QACP,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,yCAAyC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI;QACF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE;gBAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,2EAA2E;IACnE,gBAAgB,CAAC,MAAc;QACrC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,CAAC,UAAU,EAAE,CAAC;oBACvB,iEAAiE;oBACjE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACnD,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAClD,MAAM,CAAC,IAAI,EAAE,CAAC;oBACd,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAClC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,oBAAoB,CAC1B,MAAc,EACd,YAA0B,EAC1B,OAA6B;QAE7B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAc,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,kDAAkD,CAAC,CAAC;YACxF,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAqB;YAC/B,IAAI,EAAE,YAAY;YAClB,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;YAClD,UAAU,EAAE,IAAI,GAAG,EAAE;YACrB,SAAS,EAAE,CAAC;SACb,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,OAAO,CACT,2BAA2B,IAAI,KAAK,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,IAAI,IAAI;YAC1E,GAAG,YAAY,CAAC,WAAW,KAAK,YAAY,CAAC,IAAI,SAAS;YAC1D,OAAO,YAAY,CAAC,WAAW,IAAI,GAAG,KAAK,SAAS,sBAAsB,CAC7E,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,aAAa,CAAC,YAAY,CACxB;YACE,IAAI;YACJ,GAAG,EAAE,cAAc,IAAI,EAAE;YACzB,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa;YAC3C,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI,YAAY,CAAC,WAAW;YAC/D,QAAQ,EAAE,SAAS,EAAE,QAAQ;SAC9B,EACD,CAAC,mBAAmB,EAAE,EAAE,CACtB,IAAI,wBAAwB,CAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,EAChF;YACE,GAAG,mBAAmB;YACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YACrF,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;SACtF,CACF,CACJ,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QAC/D,sEAAsE;QACtE,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;QAE/B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,MAAM;gBAAE,OAAO,CAAC,aAAa;YAC7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE;gBAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9E,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,CAAC,iCAAiC,IAAI,wCAAwC,CAAC,CAAC;YAC9F,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,MAAc,EAAE,KAAmB;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;YAC/C,CAAC;YACD,sEAAsE;YACtE,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,MAAwB,EAAE,KAAyB;QAC9E,MAAM,IAAI,GAAG,KAAK,IAAI,SAAS,CAAC;QAChC,IAAI,IAAI,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,2BAA2B;YACrF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CACZ,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,4BAA4B,IAAI,8CAA8C,CACnH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,gFAAgF;IACxE,GAAG,CACT,IAAY,EACZ,MAAc,EACd,IAAY,EACZ,IAAa,EACb,OAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,8BAA8B,CAAC,WAAW,IAAI,oBAAoB,CAAC,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7B,MAAM,CACJ,IAAI,8BAA8B,CAChC,kBAAkB,IAAI,gBAAgB,MAAM,IAAI,IAAI,GAAG,CACxD,CACF,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;YAClD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACxB,KAAK;gBACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,OAAO,CAAC;oBACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;oBACzB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACpD,CAAC;aACL,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IACpE,UAAU,CAChB,IAAY,EACZ,IAAY,EACZ,OAA+B,EAC/B,SAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAA0B,CAAC;YACtF,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,sCAAsC;YACnE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,WAAW,IAAI,8BAA8B,CACrB,CAAC;gBAC3B,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC;gBAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,IAAI,iBAAiB,CAAC,CAAC;YACxD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC7B,KAAK;gBACL,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;oBAChC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;oBAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;wBAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACzC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;wBAClC,IAAI,MAAM;4BAAE,OAAO;wBACnB,MAAM,GAAG,IAAI,CAAC;wBACd,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC3B,CAAC,CAAC,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;wBACtB,IAAI,MAAM;4BAAE,OAAO;wBACnB,MAAM,GAAG,IAAI,CAAC;wBACd,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,CAAC,CAAC,CAAC;oBACH,OAAO,CAAC;wBACN,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;4BAChB,IAAI,CAAC,MAAM;gCAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;wBAC3D,CAAC;wBACD,KAAK,EAAE,GAAG,EAAE;4BACV,IAAI,MAAM;gCAAE,OAAO;4BACnB,MAAM,GAAG,IAAI,CAAC;4BACd,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAmB;QAC1D,MAAM,MAAM,GAAG,CAAC,OAAe,EAAQ,EAAE;YACvC,GAAG,CAAC,UAAU,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,qCAAqC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,oCAAoC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,0CAA0C,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,CAAC,IAAI,qCAAqC,CAAC,CAAC;YACjF,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,QAAgB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,qBAAqB,EAAE,CAAC","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport type { Server, Socket } from \"node:net\";\nimport { hostname } from \"node:os\";\nimport { TLSSocket, createServer as createTlsServer } from \"node:tls\";\nimport * as log from \"../log.js\";\nimport type { GondolinGatewaySettings } from \"../types.js\";\nimport { gondolinFleet } from \"./gondolin-fleet.js\";\nimport { gondolinJoin } from \"./gondolin-join.js\";\nimport {\n  GondolinRemoteConnection,\n  GondolinWorkerUnreachableError,\n  createSessionFrameParser,\n  encodeSessionMessage,\n} from \"./gondolin-remote.js\";\nimport type { SessionClient, SessionClientCallbacks } from \"./gondolin-worker-client.js\";\n\nconst RPC_TIMEOUT_MS = 150_000;\nconst TUNNEL_TIMEOUT_MS = 15_000;\n\n/** What a worker announces when it dials home (mirrors the Go register frame). */\ninterface GondolinWorkerRegistration {\n  name: string;\n  os?: string;\n  arch?: string;\n  accelerator?: string;\n  cpus?: number;\n  memoryBytes?: number;\n  maxRuntimes?: number;\n  protocolVersion?: number;\n  runtimes?: Array<{ sessionId: string; instanceId: string }>;\n  /** Non-empty when the worker's shared workspace failed its usability probe. */\n  workspaceError?: string;\n}\n\ninterface ControlFrame extends GondolinWorkerRegistration {\n  type: string;\n  id?: number;\n  status?: number;\n  body?: unknown;\n  nonce?: string;\n  activeRuntimes?: number;\n  /** join exchange */\n  token?: string;\n  csr?: string;\n}\n\ninterface RegisteredWorker {\n  info: GondolinWorkerRegistration;\n  socket: Socket;\n  connectedAt: number;\n  lastSeen: number;\n  activeRuntimes: number;\n  workspaceError?: string;\n  pendingRpc: Map<number, { resolve: (frame: ControlFrame) => void; timer: NodeJS.Timeout }>;\n  nextRpcId: number;\n}\n\n/**\n * Splits a byte stream into u32be-length-prefixed JSON frames, preserving any\n * bytes after the point where the consumer stops parsing (a tunnel connection\n * switches protocols after its preamble frame).\n */\nfunction createControlFrameReader(onFrame: (frame: ControlFrame, leftover: Buffer) => void): {\n  push: (chunk: Buffer) => void;\n  stop: () => void;\n} {\n  let buffer = Buffer.alloc(0);\n  let stopped = false;\n  return {\n    push(chunk: Buffer) {\n      if (stopped) return;\n      buffer = Buffer.concat([buffer, chunk]);\n      for (;;) {\n        // onFrame may call stop() synchronously (a tunnel switching protocols)\n        if (stopped || buffer.length < 4) return;\n        const length = buffer.readUInt32BE(0);\n        if (buffer.length < 4 + length) return;\n        const payload = buffer.subarray(4, 4 + length);\n        buffer = buffer.subarray(4 + length);\n        let frame: ControlFrame;\n        try {\n          frame = JSON.parse(payload.toString(\"utf8\")) as ControlFrame;\n        } catch {\n          continue; // skip malformed frames\n        }\n        onFrame(frame, buffer);\n      }\n    },\n    stop() {\n      stopped = true;\n    },\n  };\n}\n\nfunction encodeControlFrame(frame: object): Buffer {\n  return encodeSessionMessage(frame);\n}\n\ninterface GatewayOverrides {\n  /** Server factory (tests substitute a plain net.Server). */\n  createServer?: (onConnection: (socket: Socket) => void) => Server;\n  /** mTLS verification result for a socket (tests substitute outcomes). */\n  isAuthorized?: (socket: Socket) => boolean;\n  leaseTtlSeconds?: number;\n  rpcTimeoutMs?: number;\n  tunnelTimeoutMs?: number;\n}\n\nfunction defaultIsAuthorized(socket: Socket): boolean {\n  return socket instanceof TLSSocket && socket.authorized;\n}\n\n/**\n * The host side of dial-home workers: one mTLS listener that accepts worker\n * control channels (register/ping/RPC responses) and per-command dial-back\n * tunnels, keeps the registry of connected workers, and attaches each one to\n * the fleet as a regular worker connection. Placement, leases, fencing, and\n * failover are unchanged — this only reverses who dials whom.\n */\nclass GondolinWorkerGateway {\n  private settings?: GondolinGatewaySettings;\n  private overrides: GatewayOverrides = {};\n  private server?: Server;\n  private readonly workers = new Map<string, RegisteredWorker>();\n  private readonly pendingTunnels = new Map<\n    string,\n    { resolve: (value: { socket: Socket; leftover: Buffer }) => void; timer: NodeJS.Timeout }\n  >();\n\n  configure(settings?: GondolinGatewaySettings, overrides?: GatewayOverrides): void {\n    this.stop();\n    this.settings = settings;\n    this.overrides = overrides ?? {};\n  }\n\n  isConfigured(): boolean {\n    return this.settings !== undefined;\n  }\n\n  /** Registered workers and their liveness (admin/observability surface). */\n  list(): Array<{\n    name: string;\n    connected: boolean;\n    activeRuntimes: number;\n    workspaceError?: string;\n    info: GondolinWorkerRegistration;\n  }> {\n    return Array.from(this.workers.values()).map((worker) => ({\n      name: worker.info.name,\n      connected: !worker.socket.destroyed,\n      activeRuntimes: worker.activeRuntimes,\n      workspaceError: worker.workspaceError,\n      info: worker.info,\n    }));\n  }\n\n  /**\n   * Start the listener. Without explicit certificate settings the gateway\n   * provisions its own: a private worker CA plus a server certificate signed\n   * by it (required for join's CA pinning to also authenticate the host).\n   */\n  async start(): Promise<void> {\n    if (!this.settings || this.server) return;\n    const settings = this.settings;\n    if (!settings.workspaceRoot) {\n      // dial-home workers inherit workspaceRoot from here; without it every\n      // runtime is rejected with \"escapes the workspace root\"\n      throw new Error(\n        \"gondolin gateway requires workspaceRoot (the worker-side shared workspace path); \" +\n          \"set sandbox.gondolin.remote.gateway.workspaceRoot\",\n      );\n    }\n    let material: { certFile: string; keyFile: string; clientCaFile: string };\n    if (settings.certFile && settings.keyFile && settings.clientCaFile) {\n      material = {\n        certFile: settings.certFile,\n        keyFile: settings.keyFile,\n        clientCaFile: settings.clientCaFile,\n      };\n    } else {\n      if (!gondolinJoin.isConfigured()) {\n        throw new Error(\"gondolin gateway auto-init requires the join service to be configured\");\n      }\n      const issued = await gondolinJoin.ensureServerCert(settings.hostnames ?? [hostname()]);\n      material = { ...issued, clientCaFile: gondolinJoin.paths().caFile };\n    }\n    const factory =\n      this.overrides.createServer ??\n      ((onConnection: (socket: Socket) => void) =>\n        createTlsServer(\n          {\n            cert: readFileSync(material.certFile),\n            key: readFileSync(material.keyFile),\n            ca: readFileSync(material.clientCaFile),\n            requestCert: true,\n            // unauthenticated connections may only send a join frame; the\n            // per-frame authorization gate enforces that below\n            rejectUnauthorized: false,\n            minVersion: \"TLSv1.3\",\n          },\n          onConnection,\n        ));\n    this.server = factory((socket) => this.handleConnection(socket));\n    this.server.listen(this.settings.port, () => {\n      log.logInfo(`Gondolin worker gateway listening on :${this.settings?.port}`);\n    });\n  }\n\n  stop(): void {\n    for (const worker of this.workers.values()) {\n      worker.socket.destroy();\n      for (const pending of worker.pendingRpc.values()) clearTimeout(pending.timer);\n    }\n    this.workers.clear();\n    for (const pending of this.pendingTunnels.values()) clearTimeout(pending.timer);\n    this.pendingTunnels.clear();\n    this.server?.close();\n    this.server = undefined;\n  }\n\n  /** Routes one inbound connection by its first frame: control or tunnel. */\n  private handleConnection(socket: Socket): void {\n    socket.setNoDelay(true);\n    let routed = false;\n    const authorized = (this.overrides.isAuthorized ?? defaultIsAuthorized)(socket);\n    const reader = createControlFrameReader((frame, leftover) => {\n      if (!routed) {\n        routed = true;\n        if (frame.type === \"join\") {\n          void this.handleJoin(socket, frame);\n        } else if (!authorized) {\n          // everything except join requires a CA-signed client certificate\n          socket.destroy();\n        } else if (frame.type === \"register\" && frame.name) {\n          this.acceptControlChannel(socket, frame, reader);\n        } else if (frame.type === \"tunnel\" && frame.nonce) {\n          reader.stop();\n          socket.removeAllListeners(\"data\");\n          this.acceptTunnel(socket, frame.nonce, leftover);\n        } else {\n          socket.destroy();\n        }\n        return;\n      }\n      this.handleControlFrame(socket, frame);\n    });\n    socket.on(\"data\", (chunk: Buffer) => reader.push(chunk));\n    socket.on(\"error\", () => socket.destroy());\n  }\n\n  private acceptControlChannel(\n    socket: Socket,\n    registration: ControlFrame,\n    _reader: { stop: () => void },\n  ): void {\n    const name = registration.name as string;\n    const previous = this.workers.get(name);\n    if (previous && !previous.socket.destroyed) {\n      log.logInfo(`Gondolin worker '${name}' re-registered; superseding previous connection`);\n      previous.socket.destroy();\n    }\n    const worker: RegisteredWorker = {\n      info: registration,\n      socket,\n      connectedAt: Date.now(),\n      lastSeen: Date.now(),\n      activeRuntimes: registration.runtimes?.length ?? 0,\n      pendingRpc: new Map(),\n      nextRpcId: 1,\n    };\n    this.workers.set(name, worker);\n    const surviving = registration.runtimes?.length ?? 0;\n    log.logInfo(\n      `Gondolin worker joined: ${name} (${registration.os}/${registration.arch}, ` +\n        `${registration.accelerator}, ${registration.cpus} cpus, ` +\n        `cap ${registration.maxRuntimes ?? \"∞\"}, ${surviving} runtimes surviving)`,\n    );\n\n    const overrides = this.settings?.workers?.[name];\n    gondolinFleet.attachWorker(\n      {\n        name,\n        url: `dialhome://${name}`,\n        workspaceRoot: this.settings?.workspaceRoot,\n        maxRuntimes: overrides?.maxRuntimes ?? registration.maxRuntimes,\n        draining: overrides?.draining,\n      },\n      (connectionOverrides) =>\n        new GondolinRemoteConnection(\n          { name, url: `dialhome://${name}`, workspaceRoot: this.settings?.workspaceRoot },\n          {\n            ...connectionOverrides,\n            ...(this.overrides.leaseTtlSeconds !== undefined\n              ? { leaseTtlSeconds: this.overrides.leaseTtlSeconds }\n              : {}),\n            request: (method, path, body, headers) => this.rpc(name, method, path, body, headers),\n            tunnel: (path, headers, callbacks) => this.openTunnel(name, path, headers, callbacks),\n          },\n        ),\n    );\n    this.applyWorkspaceHealth(worker, registration.workspaceError);\n    // a worker that reconnected may carry runtimes whose placements moved\n    void gondolinFleet.reconcile();\n\n    socket.on(\"close\", () => {\n      const current = this.workers.get(name);\n      if (current !== worker) return; // superseded\n      for (const pending of worker.pendingRpc.values()) clearTimeout(pending.timer);\n      worker.pendingRpc.clear();\n      log.logWarning(`Gondolin worker disconnected: ${name} (placements fence until lease expiry)`);\n      gondolinFleet.detachWorker(name);\n      this.workers.delete(name);\n    });\n  }\n\n  private handleControlFrame(socket: Socket, frame: ControlFrame): void {\n    const worker = this.workerBySocket(socket);\n    if (!worker) return;\n    worker.lastSeen = Date.now();\n    if (frame.type === \"ping\") {\n      if (typeof frame.activeRuntimes === \"number\") {\n        worker.activeRuntimes = frame.activeRuntimes;\n      }\n      // omitted on healthy pings (Go omitempty), so absence means recovered\n      this.applyWorkspaceHealth(worker, frame.workspaceError);\n      socket.write(encodeControlFrame({ type: \"pong\" }));\n      return;\n    }\n    if (frame.type === \"response\" && typeof frame.id === \"number\") {\n      const pending = worker.pendingRpc.get(frame.id);\n      if (!pending) return;\n      worker.pendingRpc.delete(frame.id);\n      clearTimeout(pending.timer);\n      pending.resolve(frame);\n    }\n  }\n\n  /**\n   * Track shared-workspace health from register/ping frames and push it into\n   * the fleet, logging only the transitions. A worker whose NFS mount died\n   * keeps its control channel alive — this is what turns that silent state\n   * into refused placements and fail-fast execs.\n   */\n  private applyWorkspaceHealth(worker: RegisteredWorker, error: string | undefined): void {\n    const next = error || undefined;\n    if (next === worker.workspaceError) {\n      gondolinFleet.setWorkspaceHealth(worker.info.name, next); // attach may have reset it\n      return;\n    }\n    if (next) {\n      log.logWarning(\n        `Gondolin worker '${worker.info.name}' workspace is unusable: ${next} — new placements disabled until it recovers`,\n      );\n    } else {\n      log.logInfo(`Gondolin worker '${worker.info.name}' workspace recovered`);\n    }\n    worker.workspaceError = next;\n    gondolinFleet.setWorkspaceHealth(worker.info.name, next);\n  }\n\n  /** RPC to a worker over its control channel (the reverse of HTTPS requests). */\n  private rpc(\n    name: string,\n    method: string,\n    path: string,\n    body?: object,\n    headers?: Record<string, string>,\n  ): Promise<{ status: number; json: Record<string, unknown> }> {\n    const worker = this.workers.get(name);\n    if (!worker || worker.socket.destroyed) {\n      return Promise.reject(\n        new GondolinWorkerUnreachableError(`worker '${name}' is not connected`),\n      );\n    }\n    const id = worker.nextRpcId++;\n    return new Promise((resolve, reject) => {\n      const timer = setTimeout(() => {\n        worker.pendingRpc.delete(id);\n        reject(\n          new GondolinWorkerUnreachableError(\n            `RPC to worker '${name}' timed out (${method} ${path})`,\n          ),\n        );\n      }, this.overrides.rpcTimeoutMs ?? RPC_TIMEOUT_MS);\n      timer.unref?.();\n      worker.pendingRpc.set(id, {\n        timer,\n        resolve: (frame) =>\n          resolve({\n            status: frame.status ?? 0,\n            json: (frame.body ?? {}) as Record<string, unknown>,\n          }),\n      });\n      worker.socket.write(encodeControlFrame({ type: \"request\", id, method, path, body, headers }));\n    });\n  }\n\n  /** Ask the worker to dial back a data connection for one session tunnel. */\n  private openTunnel(\n    name: string,\n    path: string,\n    headers: Record<string, string>,\n    callbacks: SessionClientCallbacks,\n  ): Promise<SessionClient> {\n    const worker = this.workers.get(name);\n    if (!worker || worker.socket.destroyed) {\n      const error = new Error(`worker '${name}' is not connected`) as NodeJS.ErrnoException;\n      error.code = \"ECONNREFUSED\"; // nothing executed — safe to recreate\n      return Promise.reject(error);\n    }\n    const sessionId = path.split(\"/\")[3];\n    const nonce = randomBytes(16).toString(\"hex\");\n    return new Promise((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.pendingTunnels.delete(nonce);\n        const error = new Error(\n          `worker '${name}' did not dial back a tunnel`,\n        ) as NodeJS.ErrnoException;\n        error.code = \"ECONNREFUSED\";\n        reject(error);\n      }, this.overrides.tunnelTimeoutMs ?? TUNNEL_TIMEOUT_MS);\n      timer.unref?.();\n      this.pendingTunnels.set(nonce, {\n        timer,\n        resolve: ({ socket, leftover }) => {\n          let closed = false;\n          const parse = createSessionFrameParser(callbacks);\n          if (leftover.length > 0) parse(leftover);\n          socket.on(\"data\", parse);\n          socket.on(\"error\", (error: Error) => {\n            if (closed) return;\n            closed = true;\n            callbacks.onClose(error);\n          });\n          socket.on(\"close\", () => {\n            if (closed) return;\n            closed = true;\n            callbacks.onClose();\n          });\n          resolve({\n            send: (message) => {\n              if (!closed) socket.write(encodeSessionMessage(message));\n            },\n            close: () => {\n              if (closed) return;\n              closed = true;\n              socket.destroy();\n            },\n          });\n        },\n      });\n      worker.socket.write(encodeControlFrame({ type: \"open-tunnel\", nonce, sessionId, headers }));\n    });\n  }\n\n  /**\n   * One-time token → CA-signed client certificate. The only operation an\n   * unauthenticated connection may perform; the connection closes after the\n   * response either way.\n   */\n  private async handleJoin(socket: Socket, frame: ControlFrame): Promise<void> {\n    const refuse = (message: string): void => {\n      log.logWarning(`Gondolin worker join refused: ${message}`);\n      socket.end(encodeControlFrame({ type: \"join-error\", message }));\n    };\n    if (!gondolinJoin.isConfigured()) {\n      refuse(\"join is not enabled on this gateway\");\n      return;\n    }\n    if (!frame.token || !frame.csr || !frame.name) {\n      refuse(\"join requires token, csr, and name\");\n      return;\n    }\n    if (!gondolinJoin.consumeToken(frame.token)) {\n      refuse(`invalid or expired join token (worker '${frame.name}')`);\n      return;\n    }\n    try {\n      const signed = await gondolinJoin.signCsr(frame.csr);\n      log.logInfo(`Gondolin worker '${frame.name}' joined: client certificate issued`);\n      socket.end(encodeControlFrame({ type: \"join-ok\", cert: signed.certPem, ca: signed.caPem }));\n    } catch (err) {\n      refuse(`certificate issuance failed: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  private acceptTunnel(socket: Socket, nonce: string, leftover: Buffer): void {\n    const pending = this.pendingTunnels.get(nonce);\n    if (!pending) {\n      socket.destroy();\n      return;\n    }\n    this.pendingTunnels.delete(nonce);\n    clearTimeout(pending.timer);\n    pending.resolve({ socket, leftover: Buffer.from(leftover) });\n  }\n\n  private workerBySocket(socket: Socket): RegisteredWorker | undefined {\n    for (const worker of this.workers.values()) {\n      if (worker.socket === socket) return worker;\n    }\n    return undefined;\n  }\n}\n\nexport const gondolinGateway = new GondolinWorkerGateway();\n"]}

package/dist/sandbox/gondolin-inventory.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Durable record of one Gondolin runtime. Written beside the state dir (never
+ * inside the workspace) by whichever process owns the VM — the worker process
+ * hosting it — so a crash that skips every exit hook still leaves enough
+ * behind to adopt the runtime back or stop its orphaned VM runner.
+ */
+export interface GondolinRuntimeRecord {
+    /** Gondolin session id (`vm.id`); also names the record file. */
+    sessionId: string;
+    /** mikan session key (vault key) the runtime was created for. */
+    instanceId: string;
+    /** Process that owns the runtime (the worker process). */
+    ownerPid: number;
+    /** Host pid of the active VM runner process (QEMU/krun), if started. */
+    runnerPid: number | null;
+    createdAt: string;
+    /** Session IPC socket for adopting the runtime from a new mikan process. */
+    socketPath?: string;
+    /** Desired-runtime fingerprint the VM was created from. */
+    fingerprint?: string;
+}
+interface GondolinInventoryOverrides {
+    execFile?: (cmd: string, args: string[]) => Promise<string>;
+    kill?: (pid: number, signal: NodeJS.Signals | 0) => void;
+    gcSessions?: () => Promise<number>;
+    killWaitMs?: number;
+    killPollIntervalMs?: number;
+}
+declare class GondolinRuntimeInventory {
+    private dir?;
+    private execFileImpl;
+    private killImpl;
+    private gcSessionsImpl;
+    private killWaitMs;
+    private killPollIntervalMs;
+    private readonly liveRecords;
+    configure(dir?: string, overrides?: GondolinInventoryOverrides): void;
+    record(entry: {
+        sessionId: string;
+        instanceId: string;
+        runnerPid: number | null;
+        socketPath?: string;
+        fingerprint?: string;
+    }): void;
+    /** Re-persist a runtime whose runner pid changed (late boot, runner restart). */
+    refresh(sessionId: string, runnerPid: number | null): void;
+    release(sessionId: string): void;
+    /**
+     * Newest worker-owned record for a session key whose owner is still alive —
+     * a candidate for adoption instead of spawning a fresh worker. Records left
+     * by dead owners are reaped on the spot.
+     */
+    findAdoptable(instanceId: string): Promise<GondolinRuntimeRecord | undefined>;
+    /** Reap one session's record if its owner is gone (e.g. after force-killing a worker). */
+    reapSession(sessionId: string): Promise<void>;
+    /** Worker-owned records with live owners (runtimes surviving from a previous mikan). */
+    listWorkerRecords(): GondolinRuntimeRecord[];
+    /**
+     * mikan liveness signal for workers: a worker whose heartbeat goes stale
+     * knows every mikan that could adopt it is gone and shuts itself down.
+     */
+    touchHeartbeat(): void;
+    heartbeatPath(): string | undefined;
+    directory(): string | undefined;
+    /**
+     * Startup reconciliation: stop VM runners orphaned by a previous owner
+     * process that died without cleanup, drop stale records, and let Gondolin
+     * collect its own stale session registry entries. Runtimes whose owner is
+     * still alive (workers surviving a mikan restart) are left for adoption.
+     * Idempotent — a second run finds an empty inventory.
+     */
+    reconcile(): Promise<void>;
+    /**
+     * Reap one dead-owner record: stop its orphaned runner if it is still the
+     * process we launched, then drop the record (kept only while the runner
+     * refuses to die, so the next reconcile retries).
+     */
+    reapRecord(record: GondolinRuntimeRecord, path?: string): Promise<"killed" | "gone" | "reused" | "alive">;
+    private readRecords;
+    private stopOrphan;
+    private signal;
+    isPidAlive(pid: number): boolean;
+    private waitForExit;
+    private write;
+    private recordPath;
+}
+export declare const gondolinInventory: GondolinRuntimeInventory;
+export {};
+//# sourceMappingURL=gondolin-inventory.d.ts.map

package/dist/sandbox/gondolin-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-inventory.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-inventory.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,KAAK,IAAI,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAqBD,cAAM,wBAAwB;IAC5B,OAAO,CAAC,GAAG,CAAC,CAAS;IACrB,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,QAAQ,CACY;IAC5B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,kBAAkB,CAAO;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4C;IAExE,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAQpE;IAED,MAAM,CAAC,KAAK,EAAE;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CASP;IAED,iFAAiF;IACjF,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAKzD;IAED,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAW/B;IAED;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAWlF;IAED,0FAA0F;IACpF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMlD;IAED,wFAAwF;IACxF,iBAAiB,IAAI,qBAAqB,EAAE,CAI3C;IAED;;;OAGG;IACH,cAAc,IAAI,IAAI,CAWrB;IAED,aAAa,IAAI,MAAM,GAAG,SAAS,CAElC;IAED,SAAS,IAAI,MAAM,GAAG,SAAS,CAE9B;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CA8B/B;IAED;;;;OAIG;IACG,UAAU,CACd,MAAM,EAAE,qBAAqB,EAC7B,IAAI,SAAoC,GACvC,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAUjD;IAED,OAAO,CAAC,WAAW;YA4BL,UAAU;IA6BxB,OAAO,CAAC,MAAM;IAQd,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO/B;YAEa,WAAW;IASzB,OAAO,CAAC,KAAK;IAab,OAAO,CAAC,UAAU;CAGnB;AAED,eAAO,MAAM,iBAAiB,0BAAiC,CAAC"}