@geminixiang/mikan 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/sandbox/gondolin-join.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-join.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-join.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAS7B,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,KAAK,CAChB,CAAC,KAAK,EAAE,EAAE,CACR,QAAQ,CAAC,KAAK,CAAC;YACf,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAC5B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;YACpC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACtC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB;IAAzB;QAEU,aAAQ,GAAsD,aAAa,CAAC;QAC5E,QAAG,GAAiB,IAAI,CAAC,GAAG,CAAC;QAC7B,oBAAe,GAAG,iBAAiB,CAAC;IAuP9C,CAAC;IArPC,SAAS,CACP,GAAY,EACZ,SAIC;QAED,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,SAAS,EAAE,QAAQ,IAAI,aAAa,CAAC;QACrD,IAAI,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,SAAS,EAAE,eAAe,IAAI,iBAAiB,CAAC;IACzE,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IAChC,CAAC;IAED,KAAK;QAMH,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;YAClC,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;YACvC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,QAAQ;QACZ,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QACxD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,KAAK;YACL,OAAO;YACP,SAAS;YACT,IAAI;YACJ,UAAU;YACV,yBAAyB;YACzB,SAAS;YACT,SAAS;YACT,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM,CAAC,OAAO,CAAC;YACf,QAAQ;YACR,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,iCAAiC,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,SAAmB;QACxC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;iBAC5C,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,QAAQ;iBACpB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;iBAC3E,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACzF,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAC;QACtD,aAAa,CAAC,OAAO,EAAE,kBAAkB,QAAQ,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,KAAK;YACL,SAAS;YACT,IAAI;YACJ,UAAU;YACV,yBAAyB;YACzB,SAAS;YACT,aAAa;YACb,MAAM;YACN,OAAO;YACP,QAAQ;YACR,OAAO;YACP,mBAAmB;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,MAAM;YACN,MAAM;YACN,KAAK;YACL,OAAO;YACP,KAAK;YACL,MAAM;YACN,QAAQ;YACR,SAAS;YACT,iBAAiB;YACjB,OAAO;YACP,MAAM,CAAC,gBAAgB,CAAC;YACxB,UAAU;YACV,OAAO;YACP,MAAM;YACN,cAAc;SACf,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,GAAG,CAAC,OAAO,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,aAAa;QACX,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,OAAO,UAAU,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAED,gEAAgE;IAChE,YAAY,CAAC,KAAa;QACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1F,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,MAAM,IAAI,CAAC,OAAO,CAAC;gBACjB,MAAM;gBACN,MAAM;gBACN,KAAK;gBACL,OAAO;gBACP,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,SAAS;gBACT,iBAAiB;gBACjB,OAAO;gBACP,MAAM,CAAC,gBAAgB,CAAC;gBACxB,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACvC,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC;aACpC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,SAAmB;QACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;;gBAClF,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,CAAC,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACxG,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IAEO,UAAU;QAChB,IAAI,KAAK,GAAsB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,oBAAoB,CACjC,IAAI,CAAC,UAAU,EAAE,EACjB,YAAY,EACZ,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,MAAM,EAAE,CACpD,CAAC;YACF,KAAK,GAAG,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,qCAAqC,EACrC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAEO,WAAW,CAAC,MAAyB;QAC3C,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC;QAC1C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { X509Certificate, createHash, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport * as log from \"../log.js\";\nimport { isRecord, readJsonFileIfExists } from \"../utils/file-guards.js\";\n\nconst execFileAsync = promisify(execFile);\n\nconst TOKEN_TTL_SECONDS = 15 * 60;\nconst CA_DAYS = 3650;\nconst SERVER_CERT_DAYS = 825;\nconst WORKER_CERT_DAYS = 365;\n\ninterface JoinTokenRecord {\n  id: string;\n  secretHash: string;\n  expiresAt: number;\n  usedAt?: number;\n}\n\nfunction isTokenTable(value: unknown): value is { tokens: JoinTokenRecord[] } {\n  return (\n    isRecord(value) &&\n    Array.isArray(value.tokens) &&\n    value.tokens.every(\n      (entry) =>\n        isRecord(entry) &&\n        typeof entry.id === \"string\" &&\n        typeof entry.secretHash === \"string\" &&\n        typeof entry.expiresAt === \"number\",\n    )\n  );\n}\n\nfunction sha256Hex(data: string | Buffer): string {\n  return createHash(\"sha256\").update(data).digest(\"hex\");\n}\n\n/**\n * Certificate provisioning and join-token authority for dial-home workers.\n *\n * Owns a private CA under the state dir (`gondolin-gateway/`), auto-issues the\n * gateway's own server certificate from it, and exchanges one-time join\n * tokens for CA-signed worker client certificates — the kubeadm-style\n * bootstrap that replaces hand-provisioned mTLS material. All X.509 issuance\n * shells out to openssl (Node can parse but not issue certificates).\n */\nclass GondolinJoinService {\n  private dir?: string;\n  private execImpl: (cmd: string, args: string[]) => Promise<unknown> = execFileAsync;\n  private now: () => number = Date.now;\n  private tokenTtlSeconds = TOKEN_TTL_SECONDS;\n\n  configure(\n    dir?: string,\n    overrides?: {\n      execFile?: (cmd: string, args: string[]) => Promise<unknown>;\n      now?: () => number;\n      tokenTtlSeconds?: number;\n    },\n  ): void {\n    this.dir = dir;\n    this.execImpl = overrides?.execFile ?? execFileAsync;\n    this.now = overrides?.now ?? Date.now;\n    this.tokenTtlSeconds = overrides?.tokenTtlSeconds ?? TOKEN_TTL_SECONDS;\n  }\n\n  isConfigured(): boolean {\n    return this.dir !== undefined;\n  }\n\n  paths(): {\n    caFile: string;\n    caKeyFile: string;\n    serverCertFile: string;\n    serverKeyFile: string;\n  } {\n    const dir = this.requireDir();\n    return {\n      caFile: join(dir, \"ca.pem\"),\n      caKeyFile: join(dir, \"ca-key.pem\"),\n      serverCertFile: join(dir, \"server.pem\"),\n      serverKeyFile: join(dir, \"server-key.pem\"),\n    };\n  }\n\n  /** Create the worker CA on first use; idempotent afterwards. */\n  async ensureCa(): Promise<void> {\n    const { caFile, caKeyFile } = this.paths();\n    if (existsSync(caFile) && existsSync(caKeyFile)) return;\n    mkdirSync(this.requireDir(), { recursive: true, mode: 0o700 });\n    await this.openssl([\n      \"req\",\n      \"-x509\",\n      \"-newkey\",\n      \"ec\",\n      \"-pkeyopt\",\n      \"ec_paramgen_curve:P-256\",\n      \"-keyout\",\n      caKeyFile,\n      \"-out\",\n      caFile,\n      \"-days\",\n      String(CA_DAYS),\n      \"-nodes\",\n      \"-subj\",\n      \"/CN=mikan-worker-ca\",\n    ]);\n    log.logInfo(`Gondolin worker CA created at ${caFile} (pin ${this.caFingerprint()})`);\n  }\n\n  /**\n   * Issue the gateway's server certificate from the worker CA so joining\n   * workers can verify the host against the pinned CA. Reissued when the SAN\n   * list changes.\n   */\n  async ensureServerCert(hostnames: string[]): Promise<{ certFile: string; keyFile: string }> {\n    await this.ensureCa();\n    const { caFile, caKeyFile, serverCertFile, serverKeyFile } = this.paths();\n    const altNames = this.subjectAltNames(hostnames);\n    if (existsSync(serverCertFile) && existsSync(serverKeyFile)) {\n      const existing = new X509Certificate(readFileSync(serverCertFile));\n      const current = (existing.subjectAltName ?? \"\")\n        .split(\", \")\n        .filter(Boolean)\n        .toSorted()\n        .join(\",\");\n      const wanted = altNames\n        .split(\",\")\n        .map((entry) => entry.replace(\"DNS:\", \"DNS:\").replace(\"IP:\", \"IP Address:\"))\n        .toSorted()\n        .join(\",\");\n      if (current === wanted && this.now() < existing.validToDate.getTime() - 24 * 3600 * 1000) {\n        return { certFile: serverCertFile, keyFile: serverKeyFile };\n      }\n    }\n    const csrFile = join(this.requireDir(), \"server.csr\");\n    const extFile = join(this.requireDir(), \"server.ext\");\n    writeFileSync(extFile, `subjectAltName=${altNames}\\n`);\n    await this.openssl([\n      \"req\",\n      \"-newkey\",\n      \"ec\",\n      \"-pkeyopt\",\n      \"ec_paramgen_curve:P-256\",\n      \"-keyout\",\n      serverKeyFile,\n      \"-out\",\n      csrFile,\n      \"-nodes\",\n      \"-subj\",\n      \"/CN=mikan-gateway\",\n    ]);\n    await this.openssl([\n      \"x509\",\n      \"-req\",\n      \"-in\",\n      csrFile,\n      \"-CA\",\n      caFile,\n      \"-CAkey\",\n      caKeyFile,\n      \"-CAcreateserial\",\n      \"-days\",\n      String(SERVER_CERT_DAYS),\n      \"-extfile\",\n      extFile,\n      \"-out\",\n      serverCertFile,\n    ]);\n    rmSync(csrFile, { force: true });\n    rmSync(extFile, { force: true });\n    log.logInfo(`Gondolin gateway certificate issued for ${altNames}`);\n    return { certFile: serverCertFile, keyFile: serverKeyFile };\n  }\n\n  /** SHA-256 of the CA certificate DER — the join command's --ca-pin. */\n  caFingerprint(): string {\n    const certificate = new X509Certificate(readFileSync(this.paths().caFile));\n    return `sha256:${certificate.fingerprint256.replaceAll(\":\", \"\").toLowerCase()}`;\n  }\n\n  /** Mint a single-use join token; only its hash is stored. */\n  async mintToken(): Promise<{ token: string; fingerprint: string; expiresAt: number }> {\n    await this.ensureCa();\n    const id = randomBytes(4).toString(\"hex\");\n    const secret = randomBytes(24).toString(\"base64url\");\n    const expiresAt = this.now() + this.tokenTtlSeconds * 1000;\n    const table = this.readTokens();\n    table.push({ id, secretHash: sha256Hex(secret), expiresAt });\n    this.writeTokens(table);\n    return { token: `${id}.${secret}`, fingerprint: this.caFingerprint(), expiresAt };\n  }\n\n  /** Validate and burn a join token (single use, TTL-bounded). */\n  consumeToken(token: string): boolean {\n    const separator = token.indexOf(\".\");\n    if (separator <= 0) return false;\n    const id = token.slice(0, separator);\n    const secret = token.slice(separator + 1);\n    const table = this.readTokens();\n    const record = table.find((entry) => entry.id === id);\n    if (!record || record.usedAt !== undefined || this.now() > record.expiresAt) return false;\n    const expected = Buffer.from(record.secretHash, \"hex\");\n    const actual = createHash(\"sha256\").update(secret).digest();\n    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return false;\n    record.usedAt = this.now();\n    this.writeTokens(table);\n    return true;\n  }\n\n  /** Sign a joining worker's CSR with the worker CA. */\n  async signCsr(csrPem: string): Promise<{ certPem: string; caPem: string }> {\n    await this.ensureCa();\n    const { caFile, caKeyFile } = this.paths();\n    const scratch = join(tmpdir(), `mikan-join-${randomBytes(6).toString(\"hex\")}`);\n    mkdirSync(scratch, { recursive: true, mode: 0o700 });\n    const csrFile = join(scratch, \"worker.csr\");\n    const certFile = join(scratch, \"worker.pem\");\n    try {\n      writeFileSync(csrFile, csrPem);\n      await this.openssl([\n        \"x509\",\n        \"-req\",\n        \"-in\",\n        csrFile,\n        \"-CA\",\n        caFile,\n        \"-CAkey\",\n        caKeyFile,\n        \"-CAcreateserial\",\n        \"-days\",\n        String(WORKER_CERT_DAYS),\n        \"-out\",\n        certFile,\n      ]);\n      return {\n        certPem: readFileSync(certFile, \"utf8\"),\n        caPem: readFileSync(caFile, \"utf8\"),\n      };\n    } finally {\n      rmSync(scratch, { recursive: true, force: true });\n    }\n  }\n\n  private subjectAltNames(hostnames: string[]): string {\n    const entries = new Set<string>([\"IP:127.0.0.1\", \"DNS:localhost\"]);\n    for (const name of hostnames) {\n      if (/^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(name) || name.includes(\":\")) entries.add(`IP:${name}`);\n      else entries.add(`DNS:${name}`);\n    }\n    return Array.from(entries).join(\",\");\n  }\n\n  private async openssl(args: string[]): Promise<void> {\n    try {\n      await this.execImpl(\"openssl\", args);\n    } catch (err) {\n      throw new Error(\n        `openssl ${args[0]} failed (is openssl installed?): ${err instanceof Error ? err.message : String(err)}`,\n        { cause: err },\n      );\n    }\n  }\n\n  private tokensPath(): string {\n    return join(this.requireDir(), \"tokens.json\");\n  }\n\n  private readTokens(): JoinTokenRecord[] {\n    let table: JoinTokenRecord[] = [];\n    try {\n      const parsed = readJsonFileIfExists(\n        this.tokensPath(),\n        isTokenTable,\n        (detail) => `Malformed join token table: ${detail}`,\n      );\n      table = parsed?.tokens ?? [];\n    } catch (err) {\n      log.logWarning(\n        \"Resetting Gondolin join token table\",\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n    return table.filter((entry) => this.now() <= entry.expiresAt);\n  }\n\n  private writeTokens(tokens: JoinTokenRecord[]): void {\n    mkdirSync(this.requireDir(), { recursive: true, mode: 0o700 });\n    const staged = `${this.tokensPath()}.tmp`;\n    writeFileSync(staged, JSON.stringify({ tokens }, null, 2) + \"\\n\", { mode: 0o600 });\n    renameSync(staged, this.tokensPath());\n  }\n\n  private requireDir(): string {\n    if (!this.dir) throw new Error(\"gondolin join service is not configured\");\n    return this.dir;\n  }\n}\n\nexport const gondolinJoin = new GondolinJoinService();\n"]}

package/dist/sandbox/gondolin-nfs-advisory.d.ts

@@ -0,0 +1,15 @@
+interface NfsAdvisoryDeps {
+    os?: NodeJS.Platform;
+    run?: (cmd: string, args: string[]) => string;
+    emit?: (line: string) => void;
+}
+/**
+ * Startup advisory for gondolin:remote workers: they need the mikan-host
+ * workspace on shared storage, and the simplest way is to NFS-export it from
+ * the host itself. mikan does NOT touch root or system files — it only checks
+ * whether the workspace is already exported and, if not, prints the
+ * OS-appropriate commands the operator runs once by hand.
+ */
+export declare function checkWorkspaceExported(workspaceDir: string, gatewayHostname?: string, deps?: NfsAdvisoryDeps): void;
+export {};
+//# sourceMappingURL=gondolin-nfs-advisory.d.ts.map

package/dist/sandbox/gondolin-nfs-advisory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-nfs-advisory.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-nfs-advisory.ts"],"names":[],"mappings":"AAIA,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACrB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,EACxB,IAAI,GAAE,eAAoB,GACzB,IAAI,CAcN"}

package/dist/sandbox/gondolin-nfs-advisory.js

@@ -0,0 +1,60 @@
+import { execFileSync } from "node:child_process";
+import { platform } from "node:os";
+import * as log from "../log.js";
+/**
+ * Startup advisory for gondolin:remote workers: they need the mikan-host
+ * workspace on shared storage, and the simplest way is to NFS-export it from
+ * the host itself. mikan does NOT touch root or system files — it only checks
+ * whether the workspace is already exported and, if not, prints the
+ * OS-appropriate commands the operator runs once by hand.
+ */
+export function checkWorkspaceExported(workspaceDir, gatewayHostname, deps = {}) {
+    const os = deps.os ?? platform();
+    const emit = deps.emit ?? ((line) => console.log(line));
+    if (os !== "darwin" && os !== "linux") {
+        log.logWarning(`gondolin:remote workers need ${workspaceDir} on shared storage; NFS auto-detection is unavailable on ${os}`);
+        return;
+    }
+    if (isExported(os, workspaceDir, deps.run)) {
+        log.logInfo(`Workspace ${workspaceDir} is NFS-exported for remote workers`);
+        return;
+    }
+    for (const line of setupLines(os, workspaceDir, gatewayHostname))
+        emit(line);
+}
+function isExported(os, workspaceDir, run) {
+    const exec = run ?? ((cmd, args) => execFileSync(cmd, args, { encoding: "utf8" }));
+    try {
+        if (os === "darwin") {
+            const out = exec("showmount", ["-e", "localhost"]);
+            return out.split("\n").some((line) => line.trimStart().startsWith(workspaceDir));
+        }
+        // linux: exportfs -s lists current exports
+        const out = exec("exportfs", ["-s"]);
+        return out
+            .split("\n")
+            .some((line) => line.startsWith(workspaceDir + " ") || line === workspaceDir);
+    }
+    catch {
+        // no NFS server running / tool missing → treat as not exported
+        return false;
+    }
+}
+function setupLines(os, workspaceDir, gatewayHostname) {
+    const hostHint = gatewayHostname ?? "<host-tailscale-ip>";
+    const lines = [
+        "",
+        "  ⚠ gondolin:remote workers need this workspace on shared storage.",
+        `    Export it from this host once (mikan will not modify system files):`,
+        "",
+    ];
+    if (os === "darwin") {
+        lines.push(`    echo '${workspaceDir} -network 100.64.0.0 -mask 255.192.0.0 -mapall=$(id -u):$(id -g)' | sudo tee -a /etc/exports`, `    sudo nfsd enable && sudo nfsd start`);
+    }
+    else {
+        lines.push(`    echo '${workspaceDir} 100.64.0.0/10(rw,sync,no_subtree_check,all_squash,anonuid=$(id -u),anongid=$(id -g))' | sudo tee -a /etc/exports`, `    sudo exportfs -ra && sudo systemctl enable --now nfs-server`);
+    }
+    lines.push("", "    Then on each worker (over tailscale), mount it and point --workspace-root at it:", `    sudo mount -t nfs -o vers=3,resvport,nolock ${hostHint}:${workspaceDir} /mnt/mikan-workspace`, "", "    100.64.0.0/10 is the tailscale range; -mapall/all_squash makes worker", "    writes owned by you on the host. Skip this only if you already share the", "    workspace another way (existing NFS, GCS-fuse, etc.).", "");
+    return lines;
+}
+//# sourceMappingURL=gondolin-nfs-advisory.js.map

package/dist/sandbox/gondolin-nfs-advisory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-nfs-advisory.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-nfs-advisory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAQjC;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,eAAwB,EACxB,IAAI,GAAoB,EAAE;IAE1B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACtC,GAAG,CAAC,UAAU,CACZ,gCAAgC,YAAY,4DAA4D,EAAE,EAAE,CAC7G,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,aAAa,YAAY,qCAAqC,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CACjB,EAAmB,EACnB,YAAoB,EACpB,GAA2B;IAE3B,MAAM,IAAI,GACR,GAAG,IAAI,CAAC,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,2CAA2C;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,EAAmB,EAAE,YAAoB,EAAE,eAAwB;IACrF,MAAM,QAAQ,GAAG,eAAe,IAAI,qBAAqB,CAAC;IAC1D,MAAM,KAAK,GAAa;QACtB,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,EAAE;KACH,CAAC;IACF,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,aAAa,YAAY,8FAA8F,EACvH,yCAAyC,CAC1C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,aAAa,YAAY,mHAAmH,EAC5I,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,sFAAsF,EACtF,mDAAmD,QAAQ,IAAI,YAAY,uBAAuB,EAClG,EAAE,EACF,2EAA2E,EAC3E,8EAA8E,EAC9E,2DAA2D,EAC3D,EAAE,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { platform } from \"node:os\";\nimport * as log from \"../log.js\";\n\ninterface NfsAdvisoryDeps {\n  os?: NodeJS.Platform;\n  run?: (cmd: string, args: string[]) => string;\n  emit?: (line: string) => void;\n}\n\n/**\n * Startup advisory for gondolin:remote workers: they need the mikan-host\n * workspace on shared storage, and the simplest way is to NFS-export it from\n * the host itself. mikan does NOT touch root or system files — it only checks\n * whether the workspace is already exported and, if not, prints the\n * OS-appropriate commands the operator runs once by hand.\n */\nexport function checkWorkspaceExported(\n  workspaceDir: string,\n  gatewayHostname?: string,\n  deps: NfsAdvisoryDeps = {},\n): void {\n  const os = deps.os ?? platform();\n  const emit = deps.emit ?? ((line: string) => console.log(line));\n  if (os !== \"darwin\" && os !== \"linux\") {\n    log.logWarning(\n      `gondolin:remote workers need ${workspaceDir} on shared storage; NFS auto-detection is unavailable on ${os}`,\n    );\n    return;\n  }\n  if (isExported(os, workspaceDir, deps.run)) {\n    log.logInfo(`Workspace ${workspaceDir} is NFS-exported for remote workers`);\n    return;\n  }\n  for (const line of setupLines(os, workspaceDir, gatewayHostname)) emit(line);\n}\n\nfunction isExported(\n  os: NodeJS.Platform,\n  workspaceDir: string,\n  run: NfsAdvisoryDeps[\"run\"],\n): boolean {\n  const exec =\n    run ?? ((cmd: string, args: string[]) => execFileSync(cmd, args, { encoding: \"utf8\" }));\n  try {\n    if (os === \"darwin\") {\n      const out = exec(\"showmount\", [\"-e\", \"localhost\"]);\n      return out.split(\"\\n\").some((line) => line.trimStart().startsWith(workspaceDir));\n    }\n    // linux: exportfs -s lists current exports\n    const out = exec(\"exportfs\", [\"-s\"]);\n    return out\n      .split(\"\\n\")\n      .some((line) => line.startsWith(workspaceDir + \" \") || line === workspaceDir);\n  } catch {\n    // no NFS server running / tool missing → treat as not exported\n    return false;\n  }\n}\n\nfunction setupLines(os: NodeJS.Platform, workspaceDir: string, gatewayHostname?: string): string[] {\n  const hostHint = gatewayHostname ?? \"<host-tailscale-ip>\";\n  const lines: string[] = [\n    \"\",\n    \"  ⚠ gondolin:remote workers need this workspace on shared storage.\",\n    `    Export it from this host once (mikan will not modify system files):`,\n    \"\",\n  ];\n  if (os === \"darwin\") {\n    lines.push(\n      `    echo '${workspaceDir} -network 100.64.0.0 -mask 255.192.0.0 -mapall=$(id -u):$(id -g)' | sudo tee -a /etc/exports`,\n      `    sudo nfsd enable && sudo nfsd start`,\n    );\n  } else {\n    lines.push(\n      `    echo '${workspaceDir} 100.64.0.0/10(rw,sync,no_subtree_check,all_squash,anonuid=$(id -u),anongid=$(id -g))' | sudo tee -a /etc/exports`,\n      `    sudo exportfs -ra && sudo systemctl enable --now nfs-server`,\n    );\n  }\n  lines.push(\n    \"\",\n    \"    Then on each worker (over tailscale), mount it and point --workspace-root at it:\",\n    `    sudo mount -t nfs -o vers=3,resvport,nolock ${hostHint}:${workspaceDir} /mnt/mikan-workspace`,\n    \"\",\n    \"    100.64.0.0/10 is the tailscale range; -mapall/all_squash makes worker\",\n    \"    writes owned by you on the host. Skip this only if you already share the\",\n    \"    workspace another way (existing NFS, GCS-fuse, etc.).\",\n    \"\",\n  );\n  return lines;\n}\n"]}

package/dist/sandbox/gondolin-placement.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Where one conversation's runtime lives in the fleet, plus the fencing
+ * watermark failover must respect: the worker-side lease cannot outlive
+ * `leaseExpiresAt` (mikan clock), after which the old worker's janitor has
+ * stopped the runtime and the shared-storage single-writer rule allows a
+ * placement elsewhere.
+ */
+export interface GondolinPlacementRecord {
+    instanceId: string;
+    worker: string;
+    leaseExpiresAt: number;
+    updatedAt: number;
+}
+/**
+ * Durable instanceId → worker map. mikan is the only scheduler, so a single
+ * atomically-replaced JSON file under the state dir is the source of truth.
+ */
+export declare class GondolinPlacementStore {
+    private path?;
+    private table;
+    configure(path?: string): void;
+    get(instanceId: string): GondolinPlacementRecord | undefined;
+    list(): GondolinPlacementRecord[];
+    countByWorker(worker: string): number;
+    set(instanceId: string, worker: string, leaseExpiresAt: number): void;
+    /** Refresh the fencing watermark without moving the placement. */
+    touch(instanceId: string, leaseExpiresAt: number): void;
+    delete(instanceId: string): void;
+    private persist;
+}
+export declare const gondolinPlacements: GondolinPlacementStore;
+//# sourceMappingURL=gondolin-placement.d.ts.map

package/dist/sandbox/gondolin-placement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-placement.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-placement.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AAcD;;;GAGG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,IAAI,CAAC,CAAS;IACtB,OAAO,CAAC,KAAK,CAA8C;IAE3D,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAiB7B;IAED,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAE3D;IAED,IAAI,IAAI,uBAAuB,EAAE,CAEhC;IAED,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAGpE;IAED,kEAAkE;IAClE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAMtD;IAED,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAE/B;IAED,OAAO,CAAC,OAAO;CAehB;AAED,eAAO,MAAM,kBAAkB,wBAA+B,CAAC"}

package/dist/sandbox/gondolin-placement.js

@@ -0,0 +1,83 @@
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import * as log from "../log.js";
+import { ensureDirExists, isRecord } from "../utils/file-guards.js";
+function isPlacementTable(value) {
+    if (!isRecord(value))
+        return false;
+    return Object.values(value).every((entry) => isRecord(entry) &&
+        typeof entry.instanceId === "string" &&
+        typeof entry.worker === "string" &&
+        typeof entry.leaseExpiresAt === "number" &&
+        typeof entry.updatedAt === "number");
+}
+/**
+ * Durable instanceId → worker map. mikan is the only scheduler, so a single
+ * atomically-replaced JSON file under the state dir is the source of truth.
+ */
+export class GondolinPlacementStore {
+    constructor() {
+        this.table = new Map();
+    }
+    configure(path) {
+        this.path = path;
+        this.table.clear();
+        if (!path)
+            return;
+        try {
+            const raw = readFileSync(path, "utf8");
+            const parsed = JSON.parse(raw);
+            if (!isPlacementTable(parsed))
+                throw new Error("unexpected placement table shape");
+            for (const record of Object.values(parsed))
+                this.table.set(record.instanceId, record);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT") {
+                log.logWarning("Starting with an empty Gondolin placement table", err instanceof Error ? err.message : String(err));
+            }
+        }
+    }
+    get(instanceId) {
+        return this.table.get(instanceId);
+    }
+    list() {
+        return Array.from(this.table.values());
+    }
+    countByWorker(worker) {
+        return this.list().filter((record) => record.worker === worker).length;
+    }
+    set(instanceId, worker, leaseExpiresAt) {
+        this.table.set(instanceId, { instanceId, worker, leaseExpiresAt, updatedAt: Date.now() });
+        this.persist();
+    }
+    /** Refresh the fencing watermark without moving the placement. */
+    touch(instanceId, leaseExpiresAt) {
+        const record = this.table.get(instanceId);
+        if (!record || leaseExpiresAt <= record.leaseExpiresAt)
+            return;
+        record.leaseExpiresAt = leaseExpiresAt;
+        record.updatedAt = Date.now();
+        this.persist();
+    }
+    delete(instanceId) {
+        if (this.table.delete(instanceId))
+            this.persist();
+    }
+    persist() {
+        if (!this.path)
+            return;
+        try {
+            ensureDirExists(dirname(this.path));
+            const snapshot = Object.fromEntries(this.table);
+            const staged = `${this.path}.tmp`;
+            writeFileSync(staged, JSON.stringify(snapshot, null, 2) + "\n");
+            renameSync(staged, this.path);
+        }
+        catch (err) {
+            log.logWarning("Failed to persist Gondolin placement table", err instanceof Error ? err.message : String(err));
+        }
+    }
+}
+export const gondolinPlacements = new GondolinPlacementStore();
+//# sourceMappingURL=gondolin-placement.js.map

package/dist/sandbox/gondolin-placement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-placement.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAgBpE,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAC/B,CAAC,KAAK,EAAE,EAAE,CACR,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IAAnC;QAEU,UAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;IAkE7D,CAAC;IAhEC,SAAS,CAAC,IAAa;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACnF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,GAAG,CAAC,UAAU,CACZ,iDAAiD,EACjD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,GAAG,CAAC,UAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACzE,CAAC;IAED,GAAG,CAAC,UAAkB,EAAE,MAAc,EAAE,cAAsB;QAC5D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,UAAkB,EAAE,cAAsB;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,cAAc,IAAI,MAAM,CAAC,cAAc;YAAE,OAAO;QAC/D,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;QACvC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,IAAI,CAAC;YACH,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;YAClC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAChE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,4CAA4C,EAC5C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,sBAAsB,EAAE,CAAC","sourcesContent":["import { readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport * as log from \"../log.js\";\nimport { ensureDirExists, isRecord } from \"../utils/file-guards.js\";\n\n/**\n * Where one conversation's runtime lives in the fleet, plus the fencing\n * watermark failover must respect: the worker-side lease cannot outlive\n * `leaseExpiresAt` (mikan clock), after which the old worker's janitor has\n * stopped the runtime and the shared-storage single-writer rule allows a\n * placement elsewhere.\n */\nexport interface GondolinPlacementRecord {\n  instanceId: string;\n  worker: string;\n  leaseExpiresAt: number;\n  updatedAt: number;\n}\n\nfunction isPlacementTable(value: unknown): value is Record<string, GondolinPlacementRecord> {\n  if (!isRecord(value)) return false;\n  return Object.values(value).every(\n    (entry) =>\n      isRecord(entry) &&\n      typeof entry.instanceId === \"string\" &&\n      typeof entry.worker === \"string\" &&\n      typeof entry.leaseExpiresAt === \"number\" &&\n      typeof entry.updatedAt === \"number\",\n  );\n}\n\n/**\n * Durable instanceId → worker map. mikan is the only scheduler, so a single\n * atomically-replaced JSON file under the state dir is the source of truth.\n */\nexport class GondolinPlacementStore {\n  private path?: string;\n  private table = new Map<string, GondolinPlacementRecord>();\n\n  configure(path?: string): void {\n    this.path = path;\n    this.table.clear();\n    if (!path) return;\n    try {\n      const raw = readFileSync(path, \"utf8\");\n      const parsed: unknown = JSON.parse(raw);\n      if (!isPlacementTable(parsed)) throw new Error(\"unexpected placement table shape\");\n      for (const record of Object.values(parsed)) this.table.set(record.instanceId, record);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n        log.logWarning(\n          \"Starting with an empty Gondolin placement table\",\n          err instanceof Error ? err.message : String(err),\n        );\n      }\n    }\n  }\n\n  get(instanceId: string): GondolinPlacementRecord | undefined {\n    return this.table.get(instanceId);\n  }\n\n  list(): GondolinPlacementRecord[] {\n    return Array.from(this.table.values());\n  }\n\n  countByWorker(worker: string): number {\n    return this.list().filter((record) => record.worker === worker).length;\n  }\n\n  set(instanceId: string, worker: string, leaseExpiresAt: number): void {\n    this.table.set(instanceId, { instanceId, worker, leaseExpiresAt, updatedAt: Date.now() });\n    this.persist();\n  }\n\n  /** Refresh the fencing watermark without moving the placement. */\n  touch(instanceId: string, leaseExpiresAt: number): void {\n    const record = this.table.get(instanceId);\n    if (!record || leaseExpiresAt <= record.leaseExpiresAt) return;\n    record.leaseExpiresAt = leaseExpiresAt;\n    record.updatedAt = Date.now();\n    this.persist();\n  }\n\n  delete(instanceId: string): void {\n    if (this.table.delete(instanceId)) this.persist();\n  }\n\n  private persist(): void {\n    if (!this.path) return;\n    try {\n      ensureDirExists(dirname(this.path));\n      const snapshot = Object.fromEntries(this.table);\n      const staged = `${this.path}.tmp`;\n      writeFileSync(staged, JSON.stringify(snapshot, null, 2) + \"\\n\");\n      renameSync(staged, this.path);\n    } catch (err) {\n      log.logWarning(\n        \"Failed to persist Gondolin placement table\",\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n}\n\nexport const gondolinPlacements = new GondolinPlacementStore();\n"]}

package/dist/sandbox/gondolin-remote.d.ts

@@ -0,0 +1,73 @@
+import type { GondolinRemoteWorkerSettings } from "../types.js";
+import { type GondolinRuntimeHandle, type GondolinRuntimeSpec, type SessionClient, type SessionClientCallbacks } from "./gondolin-worker-client.js";
+import type { ExecResult } from "./types.js";
+interface RemoteResponse {
+    status: number;
+    json: Record<string, unknown>;
+}
+/** A request that never reached the daemon (network/TLS/timeout failure). */
+export declare class GondolinWorkerUnreachableError extends Error {
+}
+export interface GondolinRemoteOverrides {
+    request?: (method: string, path: string, body?: object, headers?: Record<string, string>) => Promise<RemoteResponse>;
+    tunnel?: (path: string, headers: Record<string, string>, callbacks: SessionClientCallbacks) => SessionClient | Promise<SessionClient>;
+    leaseTtlSeconds?: number;
+    requestTimeoutMs?: number;
+    /** Reports lease grants/renewals so the fleet can persist fencing watermarks. */
+    onLeaseActivity?: (instanceId: string, expiresAtMs: number) => void;
+}
+/** Parses the daemon-to-client session framing: u8 type + u32be length + payload. */
+export declare function createSessionFrameParser(callbacks: SessionClientCallbacks): (chunk: Buffer) => void;
+/** Encodes a client-to-daemon session message: u32be length + JSON. */
+export declare function encodeSessionMessage(message: object): Buffer;
+/**
+ * One mikan-worker daemon as seen from mikan: mTLS requests, per-instance
+ * fenced leases with heartbeat renewal, and per-command upgraded tunnels.
+ * Commands travel through one tunnel each, so abort semantics match the local
+ * transport exactly.
+ */
+export declare class GondolinRemoteConnection {
+    private readonly settings;
+    private readonly overrides;
+    private readonly leases;
+    private readonly leaseTtlSeconds;
+    private readonly requestTimeoutMs;
+    private tls?;
+    constructor(settings: GondolinRemoteWorkerSettings, overrides?: GondolinRemoteOverrides);
+    /** Drop lease timers and caches (does not touch the daemon). */
+    dispose(): void;
+    health(): Promise<Record<string, unknown>>;
+    ensure(instanceId: string, spec: GondolinRuntimeSpec): Promise<GondolinRuntimeHandle>;
+    stop(handle: Pick<GondolinRuntimeHandle, "workerPid" | "sessionId" | "instanceId">): Promise<void>;
+    isRuntimeAlive(handle: GondolinRuntimeHandle): Promise<boolean>;
+    /** Live runtimes hosted by this worker (fleet reconciliation). */
+    listRuntimes(): Promise<Array<{
+        sessionId: string;
+        instanceId: string;
+    }>>;
+    exec(handle: GondolinRuntimeHandle, command: string, options?: {
+        env?: Record<string, string>;
+        signal?: AbortSignal;
+    }): Promise<ExecResult>;
+    /**
+     * Split mounts for the remote worker:
+     * - sources under the mikan-host workspace are translated to the worker's
+     *   shared `workspaceRoot` (shared POSIX storage), and
+     * - sources outside it that are files (vault credentials, which live in the
+     *   host state dir, not the shared workspace) are read and shipped as
+     *   content payloads for the worker to project into the guest.
+     * A non-file source outside the workspace has nowhere to go and is dropped.
+     */
+    private translateMounts;
+    private leaseFor;
+    private renew;
+    private reportLeaseActivity;
+    private releaseLease;
+    private dropLease;
+    private leaseHeaders;
+    private request;
+    private openTunnel;
+    private tlsOptions;
+}
+export {};
+//# sourceMappingURL=gondolin-remote.d.ts.map

package/dist/sandbox/gondolin-remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-remote.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-remote.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAa7C,UAAU,cAAc;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,6EAA6E;AAC7E,qBAAa,8BAA+B,SAAQ,KAAK;CAAG;AAE5D,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,CACR,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,CACP,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,SAAS,EAAE,sBAAsB,KAC9B,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;CACrE;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,sBAAsB,GAChC,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAqBzB;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;GAKG;AACH,qBAAa,wBAAwB;IAOjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,GAAG,CAAC,CAA6C;IAEzD,YACmB,QAAQ,EAAE,4BAA4B,EACtC,SAAS,GAAE,uBAA4B,EAIzD;IAED,gEAAgE;IAChE,OAAO,IAAI,IAAI,CAGd;IAEK,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ/C;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsC1F;IAEK,IAAI,CACR,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,GAC5E,OAAO,CAAC,IAAI,CAAC,CAYf;IAEK,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOpE;IAED,kEAAkE;IAC5D,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAO9E;IAEK,IAAI,CACR,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACnE,OAAO,CAAC,UAAU,CAAC,CAiBrB;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;YAkCT,QAAQ;YAuBR,KAAK;IAiBnB,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,OAAO;IAmDf,OAAO,CAAC,UAAU;IA8DlB,OAAO,CAAC,UAAU;CAcnB"}