@geminixiang/mikan 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/sandbox/gondolin-inventory.js

@@ -0,0 +1,257 @@
+import { readdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import * as log from "../log.js";
+import { ensureDirExists, readJsonFileIfExists } from "../utils/file-guards.js";
+import { execSimple } from "./utils.js";
+import { isGondolinRuntimeRecord } from "./gondolin-contract.js";
+async function defaultGcSessions() {
+    const { gcSessions } = await import("@earendil-works/gondolin");
+    return gcSessions();
+}
+class GondolinRuntimeInventory {
+    constructor() {
+        this.execFileImpl = execSimple;
+        this.killImpl = (pid, signal) => process.kill(pid, signal);
+        this.gcSessionsImpl = defaultGcSessions;
+        this.killWaitMs = 2000;
+        this.killPollIntervalMs = 100;
+        this.liveRecords = new Map();
+    }
+    configure(dir, overrides) {
+        this.dir = dir;
+        this.execFileImpl = overrides?.execFile ?? execSimple;
+        this.killImpl = overrides?.kill ?? ((pid, signal) => process.kill(pid, signal));
+        this.gcSessionsImpl = overrides?.gcSessions ?? defaultGcSessions;
+        this.killWaitMs = overrides?.killWaitMs ?? 2000;
+        this.killPollIntervalMs = overrides?.killPollIntervalMs ?? 100;
+        this.liveRecords.clear();
+    }
+    record(entry) {
+        if (!this.dir)
+            return;
+        const record = {
+            ...entry,
+            ownerPid: process.pid,
+            createdAt: new Date().toISOString(),
+        };
+        this.liveRecords.set(entry.sessionId, record);
+        this.write(record);
+    }
+    /** Re-persist a runtime whose runner pid changed (late boot, runner restart). */
+    refresh(sessionId, runnerPid) {
+        const record = this.liveRecords.get(sessionId);
+        if (!record || record.runnerPid === runnerPid)
+            return;
+        record.runnerPid = runnerPid;
+        this.write(record);
+    }
+    release(sessionId) {
+        this.liveRecords.delete(sessionId);
+        if (!this.dir)
+            return;
+        try {
+            rmSync(this.recordPath(sessionId), { force: true });
+        }
+        catch (err) {
+            log.logWarning(`Failed to release Gondolin runtime record '${sessionId}'`, err instanceof Error ? err.message : String(err));
+        }
+    }
+    /**
+     * Newest worker-owned record for a session key whose owner is still alive —
+     * a candidate for adoption instead of spawning a fresh worker. Records left
+     * by dead owners are reaped on the spot.
+     */
+    async findAdoptable(instanceId) {
+        let newest;
+        for (const { record, path } of this.readRecords()) {
+            if (record.instanceId !== instanceId || !record.socketPath)
+                continue;
+            if (!this.isPidAlive(record.ownerPid)) {
+                await this.reapRecord(record, path);
+                continue;
+            }
+            if (!newest || record.createdAt > newest.createdAt)
+                newest = record;
+        }
+        return newest;
+    }
+    /** Reap one session's record if its owner is gone (e.g. after force-killing a worker). */
+    async reapSession(sessionId) {
+        for (const { record, path } of this.readRecords()) {
+            if (record.sessionId !== sessionId)
+                continue;
+            if (!this.isPidAlive(record.ownerPid))
+                await this.reapRecord(record, path);
+            return;
+        }
+    }
+    /** Worker-owned records with live owners (runtimes surviving from a previous mikan). */
+    listWorkerRecords() {
+        return this.readRecords()
+            .map(({ record }) => record)
+            .filter((record) => record.socketPath !== undefined && this.isPidAlive(record.ownerPid));
+    }
+    /**
+     * mikan liveness signal for workers: a worker whose heartbeat goes stale
+     * knows every mikan that could adopt it is gone and shuts itself down.
+     */
+    touchHeartbeat() {
+        if (!this.dir)
+            return;
+        try {
+            ensureDirExists(this.dir);
+            writeFileSync(this.heartbeatPath(), new Date().toISOString() + "\n");
+        }
+        catch (err) {
+            log.logWarning("Failed to touch Gondolin heartbeat", err instanceof Error ? err.message : String(err));
+        }
+    }
+    heartbeatPath() {
+        return this.dir ? join(this.dir, "heartbeat") : undefined;
+    }
+    directory() {
+        return this.dir;
+    }
+    /**
+     * Startup reconciliation: stop VM runners orphaned by a previous owner
+     * process that died without cleanup, drop stale records, and let Gondolin
+     * collect its own stale session registry entries. Runtimes whose owner is
+     * still alive (workers surviving a mikan restart) are left for adoption.
+     * Idempotent — a second run finds an empty inventory.
+     */
+    async reconcile() {
+        if (!this.dir)
+            return;
+        ensureDirExists(this.dir);
+        let killed = 0;
+        let stale = 0;
+        let skipped = 0;
+        for (const { record, path } of this.readRecords((badPath) => {
+            rmSync(badPath, { force: true });
+            stale += 1;
+        })) {
+            if (record.ownerPid === process.pid)
+                continue;
+            if (this.isPidAlive(record.ownerPid)) {
+                skipped += 1;
+                continue;
+            }
+            const outcome = await this.reapRecord(record, path);
+            if (outcome === "killed")
+                killed += 1;
+            else if (outcome !== "alive")
+                stale += 1;
+        }
+        try {
+            await this.gcSessionsImpl();
+        }
+        catch (err) {
+            log.logWarning("Failed to collect Gondolin session registry", err instanceof Error ? err.message : String(err));
+        }
+        log.logInfo(`Reconciled Gondolin runtimes (killed=${killed}, stale=${stale}, liveOwner=${skipped})`);
+    }
+    /**
+     * Reap one dead-owner record: stop its orphaned runner if it is still the
+     * process we launched, then drop the record (kept only while the runner
+     * refuses to die, so the next reconcile retries).
+     */
+    async reapRecord(record, path = this.recordPath(record.sessionId)) {
+        const outcome = record.runnerPid === null ? "gone" : await this.stopOrphan(record);
+        if (outcome === "alive") {
+            log.logWarning(`Orphaned Gondolin runner ${record.runnerPid} survived SIGKILL; keeping record '${record.sessionId}'`);
+            return outcome;
+        }
+        rmSync(path, { force: true });
+        return outcome;
+    }
+    readRecords(onMalformed) {
+        if (!this.dir)
+            return [];
+        ensureDirExists(this.dir);
+        const entries = [];
+        for (const file of readdirSync(this.dir)) {
+            if (!file.endsWith(".json"))
+                continue;
+            const path = join(this.dir, file);
+            let record;
+            try {
+                record = readJsonFileIfExists(path, isGondolinRuntimeRecord, (detail) => `Malformed Gondolin runtime record at ${path}: ${detail}`);
+            }
+            catch (err) {
+                log.logWarning("Dropping malformed Gondolin runtime record", err instanceof Error ? err.message : String(err));
+            }
+            if (record)
+                entries.push({ record, path });
+            else
+                onMalformed?.(path);
+        }
+        return entries;
+    }
+    async stopOrphan(record) {
+        const pid = record.runnerPid;
+        if (!this.isPidAlive(pid))
+            return "gone";
+        // Guard against pid reuse: only kill processes that still look like a
+        // Gondolin runner (its guest assets and overlay disk live under paths
+        // containing "gondolin").
+        let command;
+        try {
+            command = await this.execFileImpl("ps", ["-p", String(pid), "-o", "command="]);
+        }
+        catch {
+            return "gone";
+        }
+        if (!command.toLowerCase().includes("gondolin")) {
+            log.logWarning(`Pid ${pid} from Gondolin runtime record '${record.sessionId}' no longer looks like a Gondolin runner; skipping kill`);
+            return "reused";
+        }
+        log.logInfo(`Stopping orphaned Gondolin runner ${pid} (session '${record.sessionId}', instance '${record.instanceId}')`);
+        this.signal(pid, "SIGTERM");
+        if (await this.waitForExit(pid))
+            return "killed";
+        this.signal(pid, "SIGKILL");
+        return (await this.waitForExit(pid)) ? "killed" : "alive";
+    }
+    signal(pid, signal) {
+        try {
+            this.killImpl(pid, signal);
+        }
+        catch {
+            // process already gone
+        }
+    }
+    isPidAlive(pid) {
+        try {
+            this.killImpl(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async waitForExit(pid) {
+        const deadline = Date.now() + this.killWaitMs;
+        while (this.isPidAlive(pid)) {
+            if (Date.now() >= deadline)
+                return false;
+            await new Promise((resolve) => setTimeout(resolve, this.killPollIntervalMs));
+        }
+        return true;
+    }
+    write(record) {
+        if (!this.dir)
+            return;
+        try {
+            ensureDirExists(this.dir);
+            writeFileSync(this.recordPath(record.sessionId), JSON.stringify(record, null, 2) + "\n");
+        }
+        catch (err) {
+            log.logWarning(`Failed to persist Gondolin runtime record '${record.sessionId}'`, err instanceof Error ? err.message : String(err));
+        }
+    }
+    recordPath(sessionId) {
+        return join(this.dir, `${sessionId}.json`);
+    }
+}
+export const gondolinInventory = new GondolinRuntimeInventory();
+//# sourceMappingURL=gondolin-inventory.js.map

package/dist/sandbox/gondolin-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-inventory.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAWxC,OAAO,EAAE,uBAAuB,EAA8B,MAAM,wBAAwB,CAAC;AAU7F,KAAK,UAAU,iBAAiB;IAC9B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAChE,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,wBAAwB;IAA9B;QAEU,iBAAY,GAAG,UAAU,CAAC;QAC1B,aAAQ,GAAsD,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CACpF,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpB,mBAAc,GAAG,iBAAiB,CAAC;QACnC,eAAU,GAAG,IAAI,CAAC;QAClB,uBAAkB,GAAG,GAAG,CAAC;QAChB,gBAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;IA2Q1E,CAAC;IAzQC,SAAS,CAAC,GAAY,EAAE,SAAsC;QAC5D,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,YAAY,GAAG,SAAS,EAAE,QAAQ,IAAI,UAAU,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,cAAc,GAAG,SAAS,EAAE,UAAU,IAAI,iBAAiB,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,SAAS,EAAE,UAAU,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,kBAAkB,GAAG,SAAS,EAAE,kBAAkB,IAAI,GAAG,CAAC;QAC/D,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,KAMN;QACC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,MAAM,MAAM,GAA0B;YACpC,GAAG,KAAK;YACR,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,iFAAiF;IACjF,OAAO,CAAC,SAAiB,EAAE,SAAwB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO;QACtD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,8CAA8C,SAAS,GAAG,EAC1D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,IAAI,MAAyC,CAAC;QAC9C,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU;gBAAE,SAAS;YACrE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS;gBAAE,MAAM,GAAG,MAAM,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,WAAW,CAAC,SAAiB;QACjC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,EAAE;aACtB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;aAC3B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC;YACH,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,aAAa,EAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,oCAAoC,EACpC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1D,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,KAAK,IAAI,CAAC,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;YACH,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG;gBAAE,SAAS;YAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,CAAC,CAAC;iBACjC,IAAI,OAAO,KAAK,OAAO;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,6CAA6C,EAC7C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CACT,wCAAwC,MAAM,WAAW,KAAK,eAAe,OAAO,GAAG,CACxF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CACd,MAA6B,EAC7B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,UAAU,CACZ,4BAA4B,MAAM,CAAC,SAAS,sCAAsC,MAAM,CAAC,SAAS,GAAG,CACtG,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,WAAW,CACjB,WAAoC;QAEpC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACzB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,OAAO,GAA2D,EAAE,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,MAAyC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,GAAG,oBAAoB,CAC3B,IAAI,EACJ,uBAAuB,EACvB,CAAC,MAAM,EAAE,EAAE,CAAC,wCAAwC,IAAI,KAAK,MAAM,EAAE,CACtE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,UAAU,CACZ,4CAA4C,EAC5C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;;gBACtC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAA6B;QAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAmB,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QACzC,sEAAsE;QACtE,sEAAsE;QACtE,0BAA0B;QAC1B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,UAAU,CACZ,OAAO,GAAG,kCAAkC,MAAM,CAAC,SAAS,yDAAyD,CACtH,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,OAAO,CACT,qCAAqC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB,MAAM,CAAC,UAAU,IAAI,CAC5G,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,CAAC;IAEO,MAAM,CAAC,GAAW,EAAE,MAAsB;QAChD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAW;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,MAA6B;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC;YACH,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,8CAA8C,MAAM,CAAC,SAAS,GAAG,EACjE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAa,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IACvD,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,wBAAwB,EAAE,CAAC","sourcesContent":["import { readdirSync, rmSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport * as log from \"../log.js\";\nimport { ensureDirExists, readJsonFileIfExists } from \"../utils/file-guards.js\";\nimport { execSimple } from \"./utils.js\";\n\n/**\n * Durable record of one Gondolin runtime. Written beside the state dir (never\n * inside the workspace) by whichever process owns the VM — the worker process\n * hosting it — so a crash that skips every exit hook still leaves enough\n * behind to adopt the runtime back or stop its orphaned VM runner.\n */\n// The record is a wire contract shape shared with the Go daemon's\n// rediscovery; its single home is gondolin-contract.ts.\nexport type { GondolinRuntimeRecord } from \"./gondolin-contract.js\";\nimport { isGondolinRuntimeRecord, type GondolinRuntimeRecord } from \"./gondolin-contract.js\";\n\ninterface GondolinInventoryOverrides {\n  execFile?: (cmd: string, args: string[]) => Promise<string>;\n  kill?: (pid: number, signal: NodeJS.Signals | 0) => void;\n  gcSessions?: () => Promise<number>;\n  killWaitMs?: number;\n  killPollIntervalMs?: number;\n}\n\nasync function defaultGcSessions(): Promise<number> {\n  const { gcSessions } = await import(\"@earendil-works/gondolin\");\n  return gcSessions();\n}\n\nclass GondolinRuntimeInventory {\n  private dir?: string;\n  private execFileImpl = execSimple;\n  private killImpl: (pid: number, signal: NodeJS.Signals | 0) => void = (pid, signal) =>\n    process.kill(pid, signal);\n  private gcSessionsImpl = defaultGcSessions;\n  private killWaitMs = 2000;\n  private killPollIntervalMs = 100;\n  private readonly liveRecords = new Map<string, GondolinRuntimeRecord>();\n\n  configure(dir?: string, overrides?: GondolinInventoryOverrides): void {\n    this.dir = dir;\n    this.execFileImpl = overrides?.execFile ?? execSimple;\n    this.killImpl = overrides?.kill ?? ((pid, signal) => process.kill(pid, signal));\n    this.gcSessionsImpl = overrides?.gcSessions ?? defaultGcSessions;\n    this.killWaitMs = overrides?.killWaitMs ?? 2000;\n    this.killPollIntervalMs = overrides?.killPollIntervalMs ?? 100;\n    this.liveRecords.clear();\n  }\n\n  record(entry: {\n    sessionId: string;\n    instanceId: string;\n    runnerPid: number | null;\n    socketPath?: string;\n    fingerprint?: string;\n  }): void {\n    if (!this.dir) return;\n    const record: GondolinRuntimeRecord = {\n      ...entry,\n      ownerPid: process.pid,\n      createdAt: new Date().toISOString(),\n    };\n    this.liveRecords.set(entry.sessionId, record);\n    this.write(record);\n  }\n\n  /** Re-persist a runtime whose runner pid changed (late boot, runner restart). */\n  refresh(sessionId: string, runnerPid: number | null): void {\n    const record = this.liveRecords.get(sessionId);\n    if (!record || record.runnerPid === runnerPid) return;\n    record.runnerPid = runnerPid;\n    this.write(record);\n  }\n\n  release(sessionId: string): void {\n    this.liveRecords.delete(sessionId);\n    if (!this.dir) return;\n    try {\n      rmSync(this.recordPath(sessionId), { force: true });\n    } catch (err) {\n      log.logWarning(\n        `Failed to release Gondolin runtime record '${sessionId}'`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  /**\n   * Newest worker-owned record for a session key whose owner is still alive —\n   * a candidate for adoption instead of spawning a fresh worker. Records left\n   * by dead owners are reaped on the spot.\n   */\n  async findAdoptable(instanceId: string): Promise<GondolinRuntimeRecord | undefined> {\n    let newest: GondolinRuntimeRecord | undefined;\n    for (const { record, path } of this.readRecords()) {\n      if (record.instanceId !== instanceId || !record.socketPath) continue;\n      if (!this.isPidAlive(record.ownerPid)) {\n        await this.reapRecord(record, path);\n        continue;\n      }\n      if (!newest || record.createdAt > newest.createdAt) newest = record;\n    }\n    return newest;\n  }\n\n  /** Reap one session's record if its owner is gone (e.g. after force-killing a worker). */\n  async reapSession(sessionId: string): Promise<void> {\n    for (const { record, path } of this.readRecords()) {\n      if (record.sessionId !== sessionId) continue;\n      if (!this.isPidAlive(record.ownerPid)) await this.reapRecord(record, path);\n      return;\n    }\n  }\n\n  /** Worker-owned records with live owners (runtimes surviving from a previous mikan). */\n  listWorkerRecords(): GondolinRuntimeRecord[] {\n    return this.readRecords()\n      .map(({ record }) => record)\n      .filter((record) => record.socketPath !== undefined && this.isPidAlive(record.ownerPid));\n  }\n\n  /**\n   * mikan liveness signal for workers: a worker whose heartbeat goes stale\n   * knows every mikan that could adopt it is gone and shuts itself down.\n   */\n  touchHeartbeat(): void {\n    if (!this.dir) return;\n    try {\n      ensureDirExists(this.dir);\n      writeFileSync(this.heartbeatPath() as string, new Date().toISOString() + \"\\n\");\n    } catch (err) {\n      log.logWarning(\n        \"Failed to touch Gondolin heartbeat\",\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  heartbeatPath(): string | undefined {\n    return this.dir ? join(this.dir, \"heartbeat\") : undefined;\n  }\n\n  directory(): string | undefined {\n    return this.dir;\n  }\n\n  /**\n   * Startup reconciliation: stop VM runners orphaned by a previous owner\n   * process that died without cleanup, drop stale records, and let Gondolin\n   * collect its own stale session registry entries. Runtimes whose owner is\n   * still alive (workers surviving a mikan restart) are left for adoption.\n   * Idempotent — a second run finds an empty inventory.\n   */\n  async reconcile(): Promise<void> {\n    if (!this.dir) return;\n    ensureDirExists(this.dir);\n    let killed = 0;\n    let stale = 0;\n    let skipped = 0;\n    for (const { record, path } of this.readRecords((badPath) => {\n      rmSync(badPath, { force: true });\n      stale += 1;\n    })) {\n      if (record.ownerPid === process.pid) continue;\n      if (this.isPidAlive(record.ownerPid)) {\n        skipped += 1;\n        continue;\n      }\n      const outcome = await this.reapRecord(record, path);\n      if (outcome === \"killed\") killed += 1;\n      else if (outcome !== \"alive\") stale += 1;\n    }\n    try {\n      await this.gcSessionsImpl();\n    } catch (err) {\n      log.logWarning(\n        \"Failed to collect Gondolin session registry\",\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n    log.logInfo(\n      `Reconciled Gondolin runtimes (killed=${killed}, stale=${stale}, liveOwner=${skipped})`,\n    );\n  }\n\n  /**\n   * Reap one dead-owner record: stop its orphaned runner if it is still the\n   * process we launched, then drop the record (kept only while the runner\n   * refuses to die, so the next reconcile retries).\n   */\n  async reapRecord(\n    record: GondolinRuntimeRecord,\n    path = this.recordPath(record.sessionId),\n  ): Promise<\"killed\" | \"gone\" | \"reused\" | \"alive\"> {\n    const outcome = record.runnerPid === null ? \"gone\" : await this.stopOrphan(record);\n    if (outcome === \"alive\") {\n      log.logWarning(\n        `Orphaned Gondolin runner ${record.runnerPid} survived SIGKILL; keeping record '${record.sessionId}'`,\n      );\n      return outcome;\n    }\n    rmSync(path, { force: true });\n    return outcome;\n  }\n\n  private readRecords(\n    onMalformed?: (path: string) => void,\n  ): Array<{ record: GondolinRuntimeRecord; path: string }> {\n    if (!this.dir) return [];\n    ensureDirExists(this.dir);\n    const entries: Array<{ record: GondolinRuntimeRecord; path: string }> = [];\n    for (const file of readdirSync(this.dir)) {\n      if (!file.endsWith(\".json\")) continue;\n      const path = join(this.dir, file);\n      let record: GondolinRuntimeRecord | undefined;\n      try {\n        record = readJsonFileIfExists(\n          path,\n          isGondolinRuntimeRecord,\n          (detail) => `Malformed Gondolin runtime record at ${path}: ${detail}`,\n        );\n      } catch (err) {\n        log.logWarning(\n          \"Dropping malformed Gondolin runtime record\",\n          err instanceof Error ? err.message : String(err),\n        );\n      }\n      if (record) entries.push({ record, path });\n      else onMalformed?.(path);\n    }\n    return entries;\n  }\n\n  private async stopOrphan(\n    record: GondolinRuntimeRecord,\n  ): Promise<\"killed\" | \"gone\" | \"reused\" | \"alive\"> {\n    const pid = record.runnerPid as number;\n    if (!this.isPidAlive(pid)) return \"gone\";\n    // Guard against pid reuse: only kill processes that still look like a\n    // Gondolin runner (its guest assets and overlay disk live under paths\n    // containing \"gondolin\").\n    let command: string;\n    try {\n      command = await this.execFileImpl(\"ps\", [\"-p\", String(pid), \"-o\", \"command=\"]);\n    } catch {\n      return \"gone\";\n    }\n    if (!command.toLowerCase().includes(\"gondolin\")) {\n      log.logWarning(\n        `Pid ${pid} from Gondolin runtime record '${record.sessionId}' no longer looks like a Gondolin runner; skipping kill`,\n      );\n      return \"reused\";\n    }\n    log.logInfo(\n      `Stopping orphaned Gondolin runner ${pid} (session '${record.sessionId}', instance '${record.instanceId}')`,\n    );\n    this.signal(pid, \"SIGTERM\");\n    if (await this.waitForExit(pid)) return \"killed\";\n    this.signal(pid, \"SIGKILL\");\n    return (await this.waitForExit(pid)) ? \"killed\" : \"alive\";\n  }\n\n  private signal(pid: number, signal: NodeJS.Signals): void {\n    try {\n      this.killImpl(pid, signal);\n    } catch {\n      // process already gone\n    }\n  }\n\n  isPidAlive(pid: number): boolean {\n    try {\n      this.killImpl(pid, 0);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private async waitForExit(pid: number): Promise<boolean> {\n    const deadline = Date.now() + this.killWaitMs;\n    while (this.isPidAlive(pid)) {\n      if (Date.now() >= deadline) return false;\n      await new Promise((resolve) => setTimeout(resolve, this.killPollIntervalMs));\n    }\n    return true;\n  }\n\n  private write(record: GondolinRuntimeRecord): void {\n    if (!this.dir) return;\n    try {\n      ensureDirExists(this.dir);\n      writeFileSync(this.recordPath(record.sessionId), JSON.stringify(record, null, 2) + \"\\n\");\n    } catch (err) {\n      log.logWarning(\n        `Failed to persist Gondolin runtime record '${record.sessionId}'`,\n        err instanceof Error ? err.message : String(err),\n      );\n    }\n  }\n\n  private recordPath(sessionId: string): string {\n    return join(this.dir as string, `${sessionId}.json`);\n  }\n}\n\nexport const gondolinInventory = new GondolinRuntimeInventory();\n"]}

package/dist/sandbox/gondolin-join.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Certificate provisioning and join-token authority for dial-home workers.
+ *
+ * Owns a private CA under the state dir (`gondolin-gateway/`), auto-issues the
+ * gateway's own server certificate from it, and exchanges one-time join
+ * tokens for CA-signed worker client certificates — the kubeadm-style
+ * bootstrap that replaces hand-provisioned mTLS material. All X.509 issuance
+ * shells out to openssl (Node can parse but not issue certificates).
+ */
+declare class GondolinJoinService {
+    private dir?;
+    private execImpl;
+    private now;
+    private tokenTtlSeconds;
+    configure(dir?: string, overrides?: {
+        execFile?: (cmd: string, args: string[]) => Promise<unknown>;
+        now?: () => number;
+        tokenTtlSeconds?: number;
+    }): void;
+    isConfigured(): boolean;
+    paths(): {
+        caFile: string;
+        caKeyFile: string;
+        serverCertFile: string;
+        serverKeyFile: string;
+    };
+    /** Create the worker CA on first use; idempotent afterwards. */
+    ensureCa(): Promise<void>;
+    /**
+     * Issue the gateway's server certificate from the worker CA so joining
+     * workers can verify the host against the pinned CA. Reissued when the SAN
+     * list changes.
+     */
+    ensureServerCert(hostnames: string[]): Promise<{
+        certFile: string;
+        keyFile: string;
+    }>;
+    /** SHA-256 of the CA certificate DER — the join command's --ca-pin. */
+    caFingerprint(): string;
+    /** Mint a single-use join token; only its hash is stored. */
+    mintToken(): Promise<{
+        token: string;
+        fingerprint: string;
+        expiresAt: number;
+    }>;
+    /** Validate and burn a join token (single use, TTL-bounded). */
+    consumeToken(token: string): boolean;
+    /** Sign a joining worker's CSR with the worker CA. */
+    signCsr(csrPem: string): Promise<{
+        certPem: string;
+        caPem: string;
+    }>;
+    private subjectAltNames;
+    private openssl;
+    private tokensPath;
+    private readTokens;
+    private writeTokens;
+    private requireDir;
+}
+export declare const gondolinJoin: GondolinJoinService;
+export {};
+//# sourceMappingURL=gondolin-join.d.ts.map

package/dist/sandbox/gondolin-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gondolin-join.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-join.ts"],"names":[],"mappings":"AAyCA;;;;;;;;GAQG;AACH,cAAM,mBAAmB;IACvB,OAAO,CAAC,GAAG,CAAC,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAoE;IACpF,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,eAAe,CAAqB;IAE5C,SAAS,CACP,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,IAAI,CAKN;IAED,YAAY,IAAI,OAAO,CAEtB;IAED,KAAK,IAAI;QACP,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;KACvB,CAQA;IAED,gEAAgE;IAC1D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAsB9B;IAED;;;;OAIG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CA0D1F;IAED,uEAAuE;IACvE,aAAa,IAAI,MAAM,CAGtB;IAED,6DAA6D;IACvD,SAAS,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CASpF;IAED,gEAAgE;IAChE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAcnC;IAED,sDAAsD;IAChD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CA+BzE;IAED,OAAO,CAAC,eAAe;YAST,OAAO;IAWrB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,UAAU;IAkBlB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,UAAU;CAInB;AAED,eAAO,MAAM,YAAY,qBAA4B,CAAC"}

package/dist/sandbox/gondolin-join.js

@@ -0,0 +1,261 @@
+import { execFile } from "node:child_process";
+import { X509Certificate, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import * as log from "../log.js";
+import { isRecord, readJsonFileIfExists } from "../utils/file-guards.js";
+const execFileAsync = promisify(execFile);
+const TOKEN_TTL_SECONDS = 15 * 60;
+const CA_DAYS = 3650;
+const SERVER_CERT_DAYS = 825;
+const WORKER_CERT_DAYS = 365;
+function isTokenTable(value) {
+    return (isRecord(value) &&
+        Array.isArray(value.tokens) &&
+        value.tokens.every((entry) => isRecord(entry) &&
+            typeof entry.id === "string" &&
+            typeof entry.secretHash === "string" &&
+            typeof entry.expiresAt === "number"));
+}
+function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+/**
+ * Certificate provisioning and join-token authority for dial-home workers.
+ *
+ * Owns a private CA under the state dir (`gondolin-gateway/`), auto-issues the
+ * gateway's own server certificate from it, and exchanges one-time join
+ * tokens for CA-signed worker client certificates — the kubeadm-style
+ * bootstrap that replaces hand-provisioned mTLS material. All X.509 issuance
+ * shells out to openssl (Node can parse but not issue certificates).
+ */
+class GondolinJoinService {
+    constructor() {
+        this.execImpl = execFileAsync;
+        this.now = Date.now;
+        this.tokenTtlSeconds = TOKEN_TTL_SECONDS;
+    }
+    configure(dir, overrides) {
+        this.dir = dir;
+        this.execImpl = overrides?.execFile ?? execFileAsync;
+        this.now = overrides?.now ?? Date.now;
+        this.tokenTtlSeconds = overrides?.tokenTtlSeconds ?? TOKEN_TTL_SECONDS;
+    }
+    isConfigured() {
+        return this.dir !== undefined;
+    }
+    paths() {
+        const dir = this.requireDir();
+        return {
+            caFile: join(dir, "ca.pem"),
+            caKeyFile: join(dir, "ca-key.pem"),
+            serverCertFile: join(dir, "server.pem"),
+            serverKeyFile: join(dir, "server-key.pem"),
+        };
+    }
+    /** Create the worker CA on first use; idempotent afterwards. */
+    async ensureCa() {
+        const { caFile, caKeyFile } = this.paths();
+        if (existsSync(caFile) && existsSync(caKeyFile))
+            return;
+        mkdirSync(this.requireDir(), { recursive: true, mode: 0o700 });
+        await this.openssl([
+            "req",
+            "-x509",
+            "-newkey",
+            "ec",
+            "-pkeyopt",
+            "ec_paramgen_curve:P-256",
+            "-keyout",
+            caKeyFile,
+            "-out",
+            caFile,
+            "-days",
+            String(CA_DAYS),
+            "-nodes",
+            "-subj",
+            "/CN=mikan-worker-ca",
+        ]);
+        log.logInfo(`Gondolin worker CA created at ${caFile} (pin ${this.caFingerprint()})`);
+    }
+    /**
+     * Issue the gateway's server certificate from the worker CA so joining
+     * workers can verify the host against the pinned CA. Reissued when the SAN
+     * list changes.
+     */
+    async ensureServerCert(hostnames) {
+        await this.ensureCa();
+        const { caFile, caKeyFile, serverCertFile, serverKeyFile } = this.paths();
+        const altNames = this.subjectAltNames(hostnames);
+        if (existsSync(serverCertFile) && existsSync(serverKeyFile)) {
+            const existing = new X509Certificate(readFileSync(serverCertFile));
+            const current = (existing.subjectAltName ?? "")
+                .split(", ")
+                .filter(Boolean)
+                .toSorted()
+                .join(",");
+            const wanted = altNames
+                .split(",")
+                .map((entry) => entry.replace("DNS:", "DNS:").replace("IP:", "IP Address:"))
+                .toSorted()
+                .join(",");
+            if (current === wanted && this.now() < existing.validToDate.getTime() - 24 * 3600 * 1000) {
+                return { certFile: serverCertFile, keyFile: serverKeyFile };
+            }
+        }
+        const csrFile = join(this.requireDir(), "server.csr");
+        const extFile = join(this.requireDir(), "server.ext");
+        writeFileSync(extFile, `subjectAltName=${altNames}\n`);
+        await this.openssl([
+            "req",
+            "-newkey",
+            "ec",
+            "-pkeyopt",
+            "ec_paramgen_curve:P-256",
+            "-keyout",
+            serverKeyFile,
+            "-out",
+            csrFile,
+            "-nodes",
+            "-subj",
+            "/CN=mikan-gateway",
+        ]);
+        await this.openssl([
+            "x509",
+            "-req",
+            "-in",
+            csrFile,
+            "-CA",
+            caFile,
+            "-CAkey",
+            caKeyFile,
+            "-CAcreateserial",
+            "-days",
+            String(SERVER_CERT_DAYS),
+            "-extfile",
+            extFile,
+            "-out",
+            serverCertFile,
+        ]);
+        rmSync(csrFile, { force: true });
+        rmSync(extFile, { force: true });
+        log.logInfo(`Gondolin gateway certificate issued for ${altNames}`);
+        return { certFile: serverCertFile, keyFile: serverKeyFile };
+    }
+    /** SHA-256 of the CA certificate DER — the join command's --ca-pin. */
+    caFingerprint() {
+        const certificate = new X509Certificate(readFileSync(this.paths().caFile));
+        return `sha256:${certificate.fingerprint256.replaceAll(":", "").toLowerCase()}`;
+    }
+    /** Mint a single-use join token; only its hash is stored. */
+    async mintToken() {
+        await this.ensureCa();
+        const id = randomBytes(4).toString("hex");
+        const secret = randomBytes(24).toString("base64url");
+        const expiresAt = this.now() + this.tokenTtlSeconds * 1000;
+        const table = this.readTokens();
+        table.push({ id, secretHash: sha256Hex(secret), expiresAt });
+        this.writeTokens(table);
+        return { token: `${id}.${secret}`, fingerprint: this.caFingerprint(), expiresAt };
+    }
+    /** Validate and burn a join token (single use, TTL-bounded). */
+    consumeToken(token) {
+        const separator = token.indexOf(".");
+        if (separator <= 0)
+            return false;
+        const id = token.slice(0, separator);
+        const secret = token.slice(separator + 1);
+        const table = this.readTokens();
+        const record = table.find((entry) => entry.id === id);
+        if (!record || record.usedAt !== undefined || this.now() > record.expiresAt)
+            return false;
+        const expected = Buffer.from(record.secretHash, "hex");
+        const actual = createHash("sha256").update(secret).digest();
+        if (expected.length !== actual.length || !timingSafeEqual(expected, actual))
+            return false;
+        record.usedAt = this.now();
+        this.writeTokens(table);
+        return true;
+    }
+    /** Sign a joining worker's CSR with the worker CA. */
+    async signCsr(csrPem) {
+        await this.ensureCa();
+        const { caFile, caKeyFile } = this.paths();
+        const scratch = join(tmpdir(), `mikan-join-${randomBytes(6).toString("hex")}`);
+        mkdirSync(scratch, { recursive: true, mode: 0o700 });
+        const csrFile = join(scratch, "worker.csr");
+        const certFile = join(scratch, "worker.pem");
+        try {
+            writeFileSync(csrFile, csrPem);
+            await this.openssl([
+                "x509",
+                "-req",
+                "-in",
+                csrFile,
+                "-CA",
+                caFile,
+                "-CAkey",
+                caKeyFile,
+                "-CAcreateserial",
+                "-days",
+                String(WORKER_CERT_DAYS),
+                "-out",
+                certFile,
+            ]);
+            return {
+                certPem: readFileSync(certFile, "utf8"),
+                caPem: readFileSync(caFile, "utf8"),
+            };
+        }
+        finally {
+            rmSync(scratch, { recursive: true, force: true });
+        }
+    }
+    subjectAltNames(hostnames) {
+        const entries = new Set(["IP:127.0.0.1", "DNS:localhost"]);
+        for (const name of hostnames) {
+            if (/^\d+\.\d+\.\d+\.\d+$/.test(name) || name.includes(":"))
+                entries.add(`IP:${name}`);
+            else
+                entries.add(`DNS:${name}`);
+        }
+        return Array.from(entries).join(",");
+    }
+    async openssl(args) {
+        try {
+            await this.execImpl("openssl", args);
+        }
+        catch (err) {
+            throw new Error(`openssl ${args[0]} failed (is openssl installed?): ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+    }
+    tokensPath() {
+        return join(this.requireDir(), "tokens.json");
+    }
+    readTokens() {
+        let table = [];
+        try {
+            const parsed = readJsonFileIfExists(this.tokensPath(), isTokenTable, (detail) => `Malformed join token table: ${detail}`);
+            table = parsed?.tokens ?? [];
+        }
+        catch (err) {
+            log.logWarning("Resetting Gondolin join token table", err instanceof Error ? err.message : String(err));
+        }
+        return table.filter((entry) => this.now() <= entry.expiresAt);
+    }
+    writeTokens(tokens) {
+        mkdirSync(this.requireDir(), { recursive: true, mode: 0o700 });
+        const staged = `${this.tokensPath()}.tmp`;
+        writeFileSync(staged, JSON.stringify({ tokens }, null, 2) + "\n", { mode: 0o600 });
+        renameSync(staged, this.tokensPath());
+    }
+    requireDir() {
+        if (!this.dir)
+            throw new Error("gondolin join service is not configured");
+        return this.dir;
+    }
+}
+export const gondolinJoin = new GondolinJoinService();
+//# sourceMappingURL=gondolin-join.js.map