@geminixiang/mikan 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/sandbox/gondolin-contract.js

@@ -1,155 +0,0 @@
-import { Type } from "@sinclair/typebox";
-import { isRecord } from "../utils/file-guards.js";
-/**
- * Single home for every wire shape that crosses the mikan ⇄ gondolin-worker
- * boundary. The Go daemon mirrors these shapes by hand
- * (worker/internal/runtime/supervisor.go, worker/internal/api/server.go,
- * worker/internal/lease/lease.go); the shared fixtures under
- * `worker/contract-fixtures/` pin both sides — the TS test
- * (test/gondolin-contract.test.ts) checks each fixture against the schemas
- * here, and the Go contract tests round-trip the same files through the Go
- * structs. Add a field on one side only and one of those tests fails.
- *
- * Secrets never travel through these shapes: vault env rides per-exec over
- * the session IPC socket, and credential files are shipped by content only
- * on the authenticated ensure request.
- */
-const GondolinMountSchema = Type.Object({
-    source: Type.String(),
-    target: Type.String(),
-});
-/**
- * Everything a worker process needs to host one Gondolin VM. Serialized as a
- * single JSON argv entry by both spawners (the local TS worker client and
- * the Go daemon's supervisor).
- */
-export const GondolinWorkerConfigSchema = Type.Object({
-    /** mikan session key the runtime belongs to. */
-    instanceId: Type.String(),
-    /** Resolved guest image asset directory. */
-    image: Type.Optional(Type.String()),
-    /** Image selector resolved inside the worker (remote workers, where the
-     * spawning host has no image store). Ignored when `image` is set. */
-    imageSelector: Type.Optional(Type.String()),
-    mounts: Type.Array(GondolinMountSchema),
-    cpus: Type.Optional(Type.Number()),
-    memory: Type.Optional(Type.String()),
-    /** Desired-runtime fingerprint recorded for adoption checks. */
-    fingerprint: Type.String(),
-    /** Runtime inventory directory (shared with the spawning mikan). */
-    inventoryDir: Type.String(),
-    /** Self-stop when the mikan heartbeat file is older than this. 0 disables. */
-    heartbeatStaleMs: Type.Number(),
-});
-/** First stdout line of a worker, consumed by both spawners. */
-export const GondolinWorkerHandshakeSchema = Type.Object({
-    ready: Type.Boolean(),
-    error: Type.Optional(Type.String()),
-    sessionId: Type.Optional(Type.String()),
-    socketPath: Type.Optional(Type.String()),
-    workerPid: Type.Optional(Type.Number()),
-    runnerPid: Type.Optional(Type.Union([Type.Number(), Type.Null()])),
-});
-/**
- * One `<sessionId>.json` inventory record, written by the worker process and
- * read back by the TS inventory and the Go daemon's rediscovery.
- */
-export const GondolinRuntimeRecordSchema = Type.Object({
-    /** Gondolin session id (`vm.id`); also names the record file. */
-    sessionId: Type.String(),
-    /** mikan session key (vault key) the runtime was created for. */
-    instanceId: Type.String(),
-    /** Process that owns the runtime (the worker process). */
-    ownerPid: Type.Number(),
-    /** Host pid of the active VM runner process (QEMU/krun), if started. */
-    runnerPid: Type.Union([Type.Number(), Type.Null()]),
-    createdAt: Type.String(),
-    /** Session IPC socket for adopting the runtime from a new mikan process. */
-    socketPath: Type.Optional(Type.String()),
-    /** Desired-runtime fingerprint the VM was created from. */
-    fingerprint: Type.Optional(Type.String()),
-});
-export function isGondolinRuntimeRecord(value) {
-    return (isRecord(value) &&
-        typeof value.sessionId === "string" &&
-        value.sessionId.length > 0 &&
-        typeof value.instanceId === "string" &&
-        typeof value.ownerPid === "number" &&
-        (value.runnerPid === null || typeof value.runnerPid === "number") &&
-        typeof value.createdAt === "string" &&
-        (value.socketPath === undefined || typeof value.socketPath === "string") &&
-        (value.fingerprint === undefined || typeof value.fingerprint === "string"));
-}
-/** A vault credential shipped by content on the ensure request (never a shared-fs mount). */
-const GondolinCredentialFileSchema = Type.Object({
-    target: Type.String(),
-    contentBase64: Type.String(),
-});
-/** POST /v1/runtimes body sent to the remote worker daemon. */
-export const GondolinEnsureRuntimeRequestSchema = Type.Object({
-    instanceId: Type.String(),
-    imageSelector: Type.String(),
-    mounts: Type.Array(GondolinMountSchema),
-    credentialFiles: Type.Array(GondolinCredentialFileSchema),
-    /** Fractional cgroup CPU limit as a string; "" when unset. */
-    cpus: Type.String(),
-    memory: Type.String(),
-    fingerprint: Type.String(),
-    /** Accepted by the daemon; the TS client currently leaves it unset (0). */
-    heartbeatStaleMs: Type.Optional(Type.Number()),
-});
-/**
- * One runtime as reported by the daemon (ensure response, GET, and the
- * elements of the list response). The daemon's socketPath never crosses the
- * wire — sessions reach the runtime through the tunnel, not the socket.
- */
-export const GondolinRemoteRuntimeSchema = Type.Object({
-    sessionId: Type.String(),
-    instanceId: Type.String(),
-    fingerprint: Type.String(),
-    workerPid: Type.Number(),
-    runnerPid: Type.Number(),
-    epoch: Type.Number(),
-    adopted: Type.Boolean(),
-});
-/** POST /v1/leases response: a fenced, epoch-monotonic per-instance lease. */
-export const GondolinLeaseGrantSchema = Type.Object({
-    id: Type.String(),
-    instanceId: Type.String(),
-    epoch: Type.Number(),
-    /** RFC 3339 timestamp (Go time.Time marshalling). */
-    expiresAt: Type.String(),
-});
-/** Parses the daemon-to-client session framing: u8 type + u32be length + payload. */
-export function createSessionFrameParser(callbacks) {
-    let buffer = Buffer.alloc(0);
-    return (chunk) => {
-        buffer = Buffer.concat([buffer, chunk]);
-        while (buffer.length >= 5) {
-            const type = buffer.readUInt8(0);
-            const length = buffer.readUInt32BE(1);
-            if (buffer.length < 5 + length)
-                return;
-            const payload = buffer.subarray(5, 5 + length);
-            buffer = buffer.subarray(5 + length);
-            if (type === 1) {
-                callbacks.onBinary(Buffer.from(payload));
-                continue;
-            }
-            try {
-                callbacks.onJson(JSON.parse(payload.toString("utf8")));
-            }
-            catch {
-                // ignore malformed frames
-            }
-        }
-    };
-}
-/** Encodes a client-to-daemon session message: u32be length + JSON. */
-export function encodeSessionMessage(message) {
-    const payload = Buffer.from(JSON.stringify(message));
-    const header = Buffer.alloc(4);
-    header.writeUInt32BE(payload.length, 0);
-    return Buffer.concat([header, payload]);
-}
-//# sourceMappingURL=gondolin-contract.js.map

package/dist/sandbox/gondolin-contract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gondolin-contract.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AAEH,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,MAAM,CAAC;IACpD,gDAAgD;IAChD,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;IACzB,4CAA4C;IAC5C,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC;yEACqE;IACrE,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3C,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACpC,gEAAgE;IAChE,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;IAC1B,oEAAoE;IACpE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE;IAC3B,8EAA8E;IAC9E,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE;CAChC,CAAC,CAAC;AAIH,gEAAgE;AAChE,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC,MAAM,CAAC;IACvD,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE;IACrB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACvC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CACnE,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,MAAM,CAAC;IACrD,iEAAiE;IACjE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,iEAAiE;IACjE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;IACzB,0DAA0D;IAC1D,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE;IACvB,wEAAwE;IACxE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,4EAA4E;IAC5E,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACxC,2DAA2D;IAC3D,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CAC1C,CAAC,CAAC;AAIH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;QACjE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC;QACxE,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,4BAA4B,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE;CAC7B,CAAC,CAAC;AAIH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;IACzB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE;IAC5B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACvC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC;IACzD,8DAA8D;IAC9D,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;IAC1B,2EAA2E;IAC3E,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CAC/C,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,MAAM,CAAC;IACrD,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE;IAC1B,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAIH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;IACjB,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,qDAAqD;IACrD,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAmBH,qFAAqF;AACrF,MAAM,UAAU,wBAAwB,CACtC,SAAgC;IAEhC,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;gBAAE,OAAO;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["import { Type, type Static } from \"@sinclair/typebox\";\nimport { isRecord } from \"../utils/file-guards.js\";\n\n/**\n * Single home for every wire shape that crosses the mikan ⇄ gondolin-worker\n * boundary. The Go daemon mirrors these shapes by hand\n * (worker/internal/runtime/supervisor.go, worker/internal/api/server.go,\n * worker/internal/lease/lease.go); the shared fixtures under\n * `worker/contract-fixtures/` pin both sides — the TS test\n * (test/gondolin-contract.test.ts) checks each fixture against the schemas\n * here, and the Go contract tests round-trip the same files through the Go\n * structs. Add a field on one side only and one of those tests fails.\n *\n * Secrets never travel through these shapes: vault env rides per-exec over\n * the session IPC socket, and credential files are shipped by content only\n * on the authenticated ensure request.\n */\n\nconst GondolinMountSchema = Type.Object({\n  source: Type.String(),\n  target: Type.String(),\n});\n\n/**\n * Everything a worker process needs to host one Gondolin VM. Serialized as a\n * single JSON argv entry by both spawners (the local TS worker client and\n * the Go daemon's supervisor).\n */\nexport const GondolinWorkerConfigSchema = Type.Object({\n  /** mikan session key the runtime belongs to. */\n  instanceId: Type.String(),\n  /** Resolved guest image asset directory. */\n  image: Type.Optional(Type.String()),\n  /** Image selector resolved inside the worker (remote workers, where the\n   * spawning host has no image store). Ignored when `image` is set. */\n  imageSelector: Type.Optional(Type.String()),\n  mounts: Type.Array(GondolinMountSchema),\n  cpus: Type.Optional(Type.Number()),\n  memory: Type.Optional(Type.String()),\n  /** Desired-runtime fingerprint recorded for adoption checks. */\n  fingerprint: Type.String(),\n  /** Runtime inventory directory (shared with the spawning mikan). */\n  inventoryDir: Type.String(),\n  /** Self-stop when the mikan heartbeat file is older than this. 0 disables. */\n  heartbeatStaleMs: Type.Number(),\n});\n\nexport type GondolinWorkerConfig = Static<typeof GondolinWorkerConfigSchema>;\n\n/** First stdout line of a worker, consumed by both spawners. */\nexport const GondolinWorkerHandshakeSchema = Type.Object({\n  ready: Type.Boolean(),\n  error: Type.Optional(Type.String()),\n  sessionId: Type.Optional(Type.String()),\n  socketPath: Type.Optional(Type.String()),\n  workerPid: Type.Optional(Type.Number()),\n  runnerPid: Type.Optional(Type.Union([Type.Number(), Type.Null()])),\n});\n\nexport type GondolinWorkerHandshake = Static<typeof GondolinWorkerHandshakeSchema>;\n\n/**\n * One `<sessionId>.json` inventory record, written by the worker process and\n * read back by the TS inventory and the Go daemon's rediscovery.\n */\nexport const GondolinRuntimeRecordSchema = Type.Object({\n  /** Gondolin session id (`vm.id`); also names the record file. */\n  sessionId: Type.String(),\n  /** mikan session key (vault key) the runtime was created for. */\n  instanceId: Type.String(),\n  /** Process that owns the runtime (the worker process). */\n  ownerPid: Type.Number(),\n  /** Host pid of the active VM runner process (QEMU/krun), if started. */\n  runnerPid: Type.Union([Type.Number(), Type.Null()]),\n  createdAt: Type.String(),\n  /** Session IPC socket for adopting the runtime from a new mikan process. */\n  socketPath: Type.Optional(Type.String()),\n  /** Desired-runtime fingerprint the VM was created from. */\n  fingerprint: Type.Optional(Type.String()),\n});\n\nexport type GondolinRuntimeRecord = Static<typeof GondolinRuntimeRecordSchema>;\n\nexport function isGondolinRuntimeRecord(value: unknown): value is GondolinRuntimeRecord {\n  return (\n    isRecord(value) &&\n    typeof value.sessionId === \"string\" &&\n    value.sessionId.length > 0 &&\n    typeof value.instanceId === \"string\" &&\n    typeof value.ownerPid === \"number\" &&\n    (value.runnerPid === null || typeof value.runnerPid === \"number\") &&\n    typeof value.createdAt === \"string\" &&\n    (value.socketPath === undefined || typeof value.socketPath === \"string\") &&\n    (value.fingerprint === undefined || typeof value.fingerprint === \"string\")\n  );\n}\n\n/** A vault credential shipped by content on the ensure request (never a shared-fs mount). */\nconst GondolinCredentialFileSchema = Type.Object({\n  target: Type.String(),\n  contentBase64: Type.String(),\n});\n\nexport type GondolinCredentialFile = Static<typeof GondolinCredentialFileSchema>;\n\n/** POST /v1/runtimes body sent to the remote worker daemon. */\nexport const GondolinEnsureRuntimeRequestSchema = Type.Object({\n  instanceId: Type.String(),\n  imageSelector: Type.String(),\n  mounts: Type.Array(GondolinMountSchema),\n  credentialFiles: Type.Array(GondolinCredentialFileSchema),\n  /** Fractional cgroup CPU limit as a string; \"\" when unset. */\n  cpus: Type.String(),\n  memory: Type.String(),\n  fingerprint: Type.String(),\n  /** Accepted by the daemon; the TS client currently leaves it unset (0). */\n  heartbeatStaleMs: Type.Optional(Type.Number()),\n});\n\nexport type GondolinEnsureRuntimeRequest = Static<typeof GondolinEnsureRuntimeRequestSchema>;\n\n/**\n * One runtime as reported by the daemon (ensure response, GET, and the\n * elements of the list response). The daemon's socketPath never crosses the\n * wire — sessions reach the runtime through the tunnel, not the socket.\n */\nexport const GondolinRemoteRuntimeSchema = Type.Object({\n  sessionId: Type.String(),\n  instanceId: Type.String(),\n  fingerprint: Type.String(),\n  workerPid: Type.Number(),\n  runnerPid: Type.Number(),\n  epoch: Type.Number(),\n  adopted: Type.Boolean(),\n});\n\nexport type GondolinRemoteRuntime = Static<typeof GondolinRemoteRuntimeSchema>;\n\n/** POST /v1/leases response: a fenced, epoch-monotonic per-instance lease. */\nexport const GondolinLeaseGrantSchema = Type.Object({\n  id: Type.String(),\n  instanceId: Type.String(),\n  epoch: Type.Number(),\n  /** RFC 3339 timestamp (Go time.Time marshalling). */\n  expiresAt: Type.String(),\n});\n\n// ── session tunnel framing ────────────────────────────────────────────────────\n// The session protocol itself is TS⇄TS (worker session server ⇄ client); the\n// Go daemon splices it byte-for-byte through the upgraded tunnel. The framing\n// still lives here because it is part of the boundary a transport must carry.\n\n/** Structural shape of the JSON messages on the session protocol. */\nexport interface SessionFrameCallbacks {\n  onJson: (message: {\n    type: string;\n    id?: number;\n    exit_code?: number | null;\n    code?: string;\n    message?: string;\n  }) => void;\n  onBinary: (frame: Buffer) => void;\n}\n\n/** Parses the daemon-to-client session framing: u8 type + u32be length + payload. */\nexport function createSessionFrameParser(\n  callbacks: SessionFrameCallbacks,\n): (chunk: Buffer) => void {\n  let buffer = Buffer.alloc(0);\n  return (chunk: Buffer) => {\n    buffer = Buffer.concat([buffer, chunk]);\n    while (buffer.length >= 5) {\n      const type = buffer.readUInt8(0);\n      const length = buffer.readUInt32BE(1);\n      if (buffer.length < 5 + length) return;\n      const payload = buffer.subarray(5, 5 + length);\n      buffer = buffer.subarray(5 + length);\n      if (type === 1) {\n        callbacks.onBinary(Buffer.from(payload));\n        continue;\n      }\n      try {\n        callbacks.onJson(JSON.parse(payload.toString(\"utf8\")));\n      } catch {\n        // ignore malformed frames\n      }\n    }\n  };\n}\n\n/** Encodes a client-to-daemon session message: u32be length + JSON. */\nexport function encodeSessionMessage(message: object): Buffer {\n  const payload = Buffer.from(JSON.stringify(message));\n  const header = Buffer.alloc(4);\n  header.writeUInt32BE(payload.length, 0);\n  return Buffer.concat([header, payload]);\n}\n"]}

package/dist/sandbox/gondolin-fleet.d.ts

@@ -1,104 +0,0 @@
-import type { GondolinRemoteSettings, GondolinRemoteWorkerSettings } from "../types.js";
-import { type GondolinPlacementStore } from "./gondolin-placement.js";
-import { type GondolinRemoteOverrides } from "./gondolin-remote.js";
-import type { GondolinRuntimeHandle, GondolinRuntimeSpec, GondolinRuntimeTransport } from "./gondolin-worker-client.js";
-import type { ExecResult } from "./types.js";
-/** The connection surface the fleet needs from each worker. */
-export interface GondolinWorkerConnection {
-    health(): Promise<Record<string, unknown>>;
-    ensure(instanceId: string, spec: GondolinRuntimeSpec): Promise<GondolinRuntimeHandle>;
-    stop(handle: Pick<GondolinRuntimeHandle, "workerPid" | "sessionId" | "instanceId">): Promise<void>;
-    exec(handle: GondolinRuntimeHandle, command: string, options?: {
-        env?: Record<string, string>;
-        signal?: AbortSignal;
-    }): Promise<ExecResult>;
-    isRuntimeAlive(handle: GondolinRuntimeHandle): Promise<boolean>;
-    listRuntimes(): Promise<Array<{
-        sessionId: string;
-        instanceId: string;
-    }>>;
-    dispose(): void;
-}
-interface GondolinFleetOverrides {
-    createConnection?: (worker: GondolinRemoteWorkerSettings, connectionOverrides: GondolinRemoteOverrides) => GondolinWorkerConnection;
-    placements?: GondolinPlacementStore;
-    connectionOverrides?: GondolinRemoteOverrides;
-    now?: () => number;
-    queuePollMs?: number;
-    sleep?: (ms: number) => Promise<void>;
-}
-/**
- * Places each conversation's runtime on one worker of the fleet and keeps it
- * there (sticky placement). Failover to another worker happens only when the
- * placed worker is unreachable AND its lease fencing watermark has passed —
- * the point after which the old worker's janitor has provably stopped the
- * runtime, so shared storage never sees two writers.
- */
-declare class GondolinFleetClient implements GondolinRuntimeTransport {
-    private settings?;
-    private workers;
-    private connectionOverrides;
-    private placements;
-    private leaseTtlMs;
-    private queueWaitMs;
-    private queuePollMs;
-    private now;
-    private sleep;
-    configure(settings?: GondolinRemoteSettings, overrides?: GondolinFleetOverrides): void;
-    isConfigured(): boolean;
-    /** Names of statically-configured workers with no workspaceRoot (startup guard). */
-    workersMissingWorkspaceRoot(): string[];
-    /**
-     * Attach a dial-home worker at runtime (the gateway calls this when a
-     * worker registers). The factory receives the fleet's connection overrides
-     * plus the lease-watermark callback, mirroring configure()'s wiring.
-     */
-    attachWorker(settings: GondolinRemoteWorkerSettings, createConnection: (overrides: GondolinRemoteOverrides) => GondolinWorkerConnection): void;
-    /**
-     * Record a worker's shared-workspace health (the gateway pushes this from
-     * register and ping frames). A degraded worker keeps its runtimes and its
-     * connection, but new placements skip it and runtime operations fail fast
-     * with the probe's diagnosis instead of hanging on a dead mount.
-     */
-    setWorkspaceHealth(name: string, error?: string): void;
-    /**
-     * Detach a dial-home worker (disconnect). Placements survive: their lease
-     * watermarks keep fencing failover until expiry, exactly as for an
-     * unreachable static worker.
-     */
-    detachWorker(name: string): void;
-    imageSelector(): string | undefined;
-    /** At least one worker must answer for the sandbox mode to come up. */
-    health(): Promise<Array<{
-        worker: string;
-        health?: Record<string, unknown>;
-    }>>;
-    ensure(instanceId: string, spec: GondolinRuntimeSpec): Promise<GondolinRuntimeHandle>;
-    stop(handle: Pick<GondolinRuntimeHandle, "workerPid" | "sessionId" | "instanceId" | "workerName">): Promise<void>;
-    exec(handle: GondolinRuntimeHandle, command: string, options?: {
-        env?: Record<string, string>;
-        signal?: AbortSignal;
-    }): Promise<ExecResult>;
-    isRuntimeAlive(handle: GondolinRuntimeHandle): Promise<boolean>;
-    /**
-     * Fleet reconciliation: a runtime whose conversation is placed on a
-     * different worker is a stray from a superseded placement — stop it. A
-     * runtime with no placement at all (crash between daemon ensure and the
-     * placement write) is adopted instead of killed.
-     */
-    reconcile(): Promise<void>;
-    private ensureOn;
-    /**
-     * Fail fast — with the probe's diagnosis — instead of dispatching work that
-     * would hang on a dead shared-workspace mount. Deliberately NOT a
-     * GondolinWorkerUnreachableError: a broken mount must not trigger failover,
-     * because the workspace is shared and likely broken for every worker.
-     */
-    private assertWorkspaceUsable;
-    private assertFailoverAllowed;
-    private selectWorker;
-    private workerFor;
-}
-export declare const gondolinFleet: GondolinFleetClient;
-export {};
-//# sourceMappingURL=gondolin-fleet.d.ts.map

package/dist/sandbox/gondolin-fleet.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gondolin-fleet.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-fleet.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAExF,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM7C,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtF,IAAI,CACF,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC,GAC5E,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,CACF,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC/D,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAI,IAAI,CAAC;CACjB;AAUD,UAAU,sBAAsB;IAC9B,gBAAgB,CAAC,EAAE,CACjB,MAAM,EAAE,4BAA4B,EACpC,mBAAmB,EAAE,uBAAuB,KACzC,wBAAwB,CAAC;IAC9B,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAeD;;;;;;GAMG;AACH,cAAM,mBAAoB,YAAW,wBAAwB;IAC3D,OAAO,CAAC,QAAQ,CAAC,CAAyB;IAC1C,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,mBAAmB,CAA+B;IAC1D,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,WAAW,CAAiB;IACpC,OAAO,CAAC,GAAG,CAA0B;IACrC,OAAO,CAAC,KAAK,CACuC;IAEpD,SAAS,CAAC,QAAQ,CAAC,EAAE,sBAAsB,EAAE,SAAS,CAAC,EAAE,sBAAsB,GAAG,IAAI,CA+BrF;IAED,YAAY,IAAI,OAAO,CAEtB;IAED,oFAAoF;IACpF,2BAA2B,IAAI,MAAM,EAAE,CAItC;IAED;;;;OAIG;IACH,YAAY,CACV,QAAQ,EAAE,4BAA4B,EACtC,gBAAgB,EAAE,CAAC,SAAS,EAAE,uBAAuB,KAAK,wBAAwB,GACjF,IAAI,CAYN;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAIrD;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAK/B;IAED,aAAa,IAAI,MAAM,GAAG,SAAS,CAElC;IAED,uEAAuE;IACjE,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC,CAcnF;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyB1F;IAEK,IAAI,CACR,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,CAAC,GAC3F,OAAO,CAAC,IAAI,CAAC,CAqBf;IAEK,IAAI,CACR,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACnE,OAAO,CAAC,UAAU,CAAC,CAMrB;IAEK,cAAc,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAIpE;IAED;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAmC/B;YAEa,QAAQ;IAWtB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,qBAAqB;YAiBf,YAAY;IA8D1B,OAAO,CAAC,SAAS;CAIlB;AAED,eAAO,MAAM,aAAa,qBAA4B,CAAC"}

package/dist/sandbox/gondolin-fleet.js

@@ -1,330 +0,0 @@
-import * as log from "../log.js";
-import { SandboxError } from "./errors.js";
-import { gondolinPlacements } from "./gondolin-placement.js";
-import { GondolinRemoteConnection, GondolinWorkerUnreachableError, } from "./gondolin-remote.js";
-import { GondolinRuntimeGoneError } from "./gondolin-recovery.js";
-const LEASE_TTL_SECONDS = 300;
-const QUEUE_WAIT_SECONDS = 60;
-const QUEUE_POLL_MS = 2000;
-function normalizeWorkers(settings) {
-    const inline = settings.workers ?? [{ url: settings.url }];
-    return inline.map((worker) => ({
-        ...worker,
-        name: worker.name ?? worker.url,
-        caFile: worker.caFile ?? settings.caFile,
-        certFile: worker.certFile ?? settings.certFile,
-        keyFile: worker.keyFile ?? settings.keyFile,
-        workspaceRoot: worker.workspaceRoot ?? settings.workspaceRoot,
-        maxRuntimes: worker.maxRuntimes ?? settings.maxRuntimes,
-    }));
-}
-/**
- * Places each conversation's runtime on one worker of the fleet and keeps it
- * there (sticky placement). Failover to another worker happens only when the
- * placed worker is unreachable AND its lease fencing watermark has passed —
- * the point after which the old worker's janitor has provably stopped the
- * runtime, so shared storage never sees two writers.
- */
-class GondolinFleetClient {
-    constructor() {
-        this.workers = new Map();
-        this.connectionOverrides = {};
-        this.placements = gondolinPlacements;
-        this.leaseTtlMs = LEASE_TTL_SECONDS * 1000;
-        this.queueWaitMs = QUEUE_WAIT_SECONDS * 1000;
-        this.queuePollMs = QUEUE_POLL_MS;
-        this.now = Date.now;
-        this.sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-    }
-    configure(settings, overrides) {
-        for (const worker of this.workers.values())
-            worker.connection.dispose();
-        this.workers.clear();
-        this.settings = settings;
-        this.placements = overrides?.placements ?? gondolinPlacements;
-        this.now = overrides?.now ?? Date.now;
-        this.sleep = overrides?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-        this.queuePollMs = overrides?.queuePollMs ?? QUEUE_POLL_MS;
-        this.connectionOverrides = overrides?.connectionOverrides ?? {};
-        this.leaseTtlMs = (overrides?.connectionOverrides?.leaseTtlSeconds ?? LEASE_TTL_SECONDS) * 1000;
-        this.queueWaitMs = (settings?.queueWaitSeconds ?? QUEUE_WAIT_SECONDS) * 1000;
-        if (!settings)
-            return;
-        if (!settings.workers?.length && !settings.url) {
-            return; // not configured; validate() reports the actionable error
-        }
-        const createConnection = overrides?.createConnection ??
-            ((worker, connectionOverrides) => new GondolinRemoteConnection(worker, connectionOverrides));
-        for (const worker of normalizeWorkers(settings)) {
-            const name = worker.name;
-            const connection = createConnection(worker, {
-                ...overrides?.connectionOverrides,
-                onLeaseActivity: (instanceId, expiresAtMs) => {
-                    if (this.placements.get(instanceId)?.worker === name) {
-                        this.placements.touch(instanceId, expiresAtMs);
-                    }
-                },
-            });
-            this.workers.set(name, { name, settings: worker, connection });
-        }
-    }
-    isConfigured() {
-        return this.workers.size > 0;
-    }
-    /** Names of statically-configured workers with no workspaceRoot (startup guard). */
-    workersMissingWorkspaceRoot() {
-        return Array.from(this.workers.values())
-            .filter((worker) => !worker.settings.workspaceRoot)
-            .map((worker) => worker.name);
-    }
-    /**
-     * Attach a dial-home worker at runtime (the gateway calls this when a
-     * worker registers). The factory receives the fleet's connection overrides
-     * plus the lease-watermark callback, mirroring configure()'s wiring.
-     */
-    attachWorker(settings, createConnection) {
-        const name = settings.name ?? settings.url;
-        this.workers.get(name)?.connection.dispose();
-        const connection = createConnection({
-            ...this.connectionOverrides,
-            onLeaseActivity: (instanceId, expiresAtMs) => {
-                if (this.placements.get(instanceId)?.worker === name) {
-                    this.placements.touch(instanceId, expiresAtMs);
-                }
-            },
-        });
-        this.workers.set(name, { name, settings: { ...settings, name }, connection });
-    }
-    /**
-     * Record a worker's shared-workspace health (the gateway pushes this from
-     * register and ping frames). A degraded worker keeps its runtimes and its
-     * connection, but new placements skip it and runtime operations fail fast
-     * with the probe's diagnosis instead of hanging on a dead mount.
-     */
-    setWorkspaceHealth(name, error) {
-        const worker = this.workers.get(name);
-        if (!worker)
-            return;
-        worker.workspaceError = error || undefined;
-    }
-    /**
-     * Detach a dial-home worker (disconnect). Placements survive: their lease
-     * watermarks keep fencing failover until expiry, exactly as for an
-     * unreachable static worker.
-     */
-    detachWorker(name) {
-        const worker = this.workers.get(name);
-        if (!worker)
-            return;
-        worker.connection.dispose();
-        this.workers.delete(name);
-    }
-    imageSelector() {
-        return this.settings?.imageSelector;
-    }
-    /** At least one worker must answer for the sandbox mode to come up. */
-    async health() {
-        const report = await Promise.all(Array.from(this.workers.values()).map(async (worker) => {
-            try {
-                return { worker: worker.name, health: await worker.connection.health() };
-            }
-            catch {
-                return { worker: worker.name };
-            }
-        }));
-        if (report.length > 0 && !report.some((entry) => entry.health)) {
-            throw new SandboxError("Error: no gondolin remote worker is reachable");
-        }
-        return report;
-    }
-    async ensure(instanceId, spec) {
-        const placed = this.placements.get(instanceId);
-        if (placed) {
-            const worker = this.workers.get(placed.worker);
-            if (worker) {
-                try {
-                    return await this.ensureOn(worker, instanceId, spec);
-                }
-                catch (err) {
-                    if (!(err instanceof GondolinWorkerUnreachableError))
-                        throw err;
-                    this.assertFailoverAllowed(instanceId, placed.worker, placed.leaseExpiresAt, err);
-                }
-            }
-            else {
-                this.assertFailoverAllowed(instanceId, placed.worker, placed.leaseExpiresAt, new GondolinWorkerUnreachableError("worker is no longer configured"));
-            }
-            log.logWarning(`Gondolin worker '${placed.worker}' lost runtime for '${instanceId}'; failing over`);
-        }
-        const worker = await this.selectWorker();
-        return this.ensureOn(worker, instanceId, spec);
-    }
-    async stop(handle) {
-        const worker = this.workerFor(handle.workerName);
-        if (!worker) {
-            // the worker left the fleet config; its janitor stops the runtime when
-            // the lease expires, and the record keeps fencing until then
-            return;
-        }
-        try {
-            await worker.connection.stop(handle);
-            this.placements.delete(handle.instanceId);
-        }
-        catch (err) {
-            if (err instanceof GondolinWorkerUnreachableError) {
-                // cannot confirm the stop; keep the placement so its watermark still
-                // fences any failover, and let the daemon's expiry janitor finish it
-                log.logWarning(`Gondolin worker '${worker.name}' unreachable while stopping '${handle.instanceId}'; leaving it to lease expiry`);
-                return;
-            }
-            throw err;
-        }
-    }
-    async exec(handle, command, options = {}) {
-        const worker = this.workerFor(handle.workerName);
-        if (!worker)
-            throw new GondolinRuntimeGoneError("worker is no longer configured");
-        this.assertWorkspaceUsable(worker);
-        log.logInfo(`Gondolin execution '${handle.instanceId}' routed to worker '${worker.name}'`);
-        return worker.connection.exec(handle, command, options);
-    }
-    async isRuntimeAlive(handle) {
-        const worker = this.workerFor(handle.workerName);
-        if (!worker)
-            return false;
-        return worker.connection.isRuntimeAlive(handle);
-    }
-    /**
-     * Fleet reconciliation: a runtime whose conversation is placed on a
-     * different worker is a stray from a superseded placement — stop it. A
-     * runtime with no placement at all (crash between daemon ensure and the
-     * placement write) is adopted instead of killed.
-     */
-    async reconcile() {
-        for (const worker of this.workers.values()) {
-            let runtimes;
-            try {
-                runtimes = await worker.connection.listRuntimes();
-            }
-            catch {
-                continue; // unreachable workers reconcile on a later sweep
-            }
-            for (const runtime of runtimes) {
-                const record = this.placements.get(runtime.instanceId);
-                if (!record) {
-                    log.logInfo(`Adopting unplaced Gondolin runtime '${runtime.instanceId}' on worker '${worker.name}'`);
-                    this.placements.set(runtime.instanceId, worker.name, this.now() + this.leaseTtlMs);
-                    continue;
-                }
-                if (record.worker === worker.name)
-                    continue;
-                log.logInfo(`Stopping stray Gondolin runtime '${runtime.instanceId}' on worker '${worker.name}' (placed on '${record.worker}')`);
-                try {
-                    await worker.connection.stop({
-                        sessionId: runtime.sessionId,
-                        instanceId: runtime.instanceId,
-                        workerPid: 0,
-                    });
-                }
-                catch (err) {
-                    log.logWarning(`Failed to stop stray runtime '${runtime.instanceId}' on '${worker.name}'`, err instanceof Error ? err.message : String(err));
-                }
-            }
-        }
-    }
-    async ensureOn(worker, instanceId, spec) {
-        this.assertWorkspaceUsable(worker);
-        const handle = await worker.connection.ensure(instanceId, spec);
-        this.placements.set(instanceId, worker.name, this.now() + this.leaseTtlMs);
-        return { ...handle, workerName: worker.name };
-    }
-    /**
-     * Fail fast — with the probe's diagnosis — instead of dispatching work that
-     * would hang on a dead shared-workspace mount. Deliberately NOT a
-     * GondolinWorkerUnreachableError: a broken mount must not trigger failover,
-     * because the workspace is shared and likely broken for every worker.
-     */
-    assertWorkspaceUsable(worker) {
-        if (!worker.workspaceError)
-            return;
-        throw new SandboxError(`Error: Gondolin worker '${worker.name}' has an unusable shared workspace: ` +
-            `${worker.workspaceError} (fix the mount on the worker; health refreshes with its next heartbeat)`);
-    }
-    assertFailoverAllowed(instanceId, workerName, leaseExpiresAt, cause) {
-        const remainingMs = leaseExpiresAt - this.now();
-        if (remainingMs <= 0)
-            return;
-        // Failing over earlier could put a second writable VM on the same shared
-        // workspace: the old worker may be alive behind a partition, and its
-        // daemon only stops the runtime once the lease expires.
-        throw new SandboxError(`Error: Gondolin worker '${workerName}' is unreachable (${cause.message}); ` +
-            `retrying '${instanceId}' elsewhere in ${Math.ceil(remainingMs / 1000)}s once its lease has expired`);
-    }
-    async selectWorker() {
-        const deadline = this.now() + this.queueWaitMs;
-        for (;;) {
-            let best;
-            let reachable = 0;
-            let draining = 0;
-            let full = 0;
-            const degraded = [];
-            for (const worker of this.workers.values()) {
-                if (worker.settings.draining) {
-                    draining += 1;
-                    continue;
-                }
-                if (worker.workspaceError) {
-                    degraded.push(`'${worker.name}': ${worker.workspaceError}`);
-                    continue;
-                }
-                let active;
-                let workspaceError;
-                try {
-                    const health = await worker.connection.health();
-                    active = typeof health.activeRuntimes === "number" ? health.activeRuntimes : 0;
-                    workspaceError =
-                        typeof health.workspaceError === "string" && health.workspaceError
-                            ? health.workspaceError
-                            : undefined;
-                }
-                catch {
-                    continue;
-                }
-                reachable += 1;
-                if (workspaceError) {
-                    // static workers report probe results via /v1/health only
-                    degraded.push(`'${worker.name}': ${workspaceError}`);
-                    continue;
-                }
-                const cap = worker.settings.maxRuntimes;
-                if (cap !== undefined && active >= cap) {
-                    full += 1;
-                    continue;
-                }
-                const load = cap !== undefined ? active / cap : active / Number.MAX_SAFE_INTEGER;
-                if (!best || load < best.load)
-                    best = { worker, load };
-            }
-            if (best)
-                return best.worker;
-            if (reachable === 0 && draining === 0 && degraded.length === 0) {
-                throw new SandboxError("Error: no gondolin remote worker is reachable");
-            }
-            if (full === 0) {
-                const detail = degraded.length > 0 ? ` — degraded: ${degraded.join("; ")}` : "";
-                throw new SandboxError(`Error: every gondolin remote worker is draining, degraded, or unreachable${detail}`);
-            }
-            if (this.now() >= deadline) {
-                throw new SandboxError(`Error: all gondolin remote workers are at capacity (waited ${Math.round(this.queueWaitMs / 1000)}s)`);
-            }
-            await this.sleep(this.queuePollMs);
-        }
-    }
-    workerFor(workerName) {
-        if (!workerName)
-            return undefined;
-        return this.workers.get(workerName);
-    }
-}
-export const gondolinFleet = new GondolinFleetClient();
-//# sourceMappingURL=gondolin-fleet.js.map