@geminixiang/mikan 1.0.0-beta.21 → 1.0.0-beta.23

package/dist/sandbox/gondolin-fleet.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gondolin-fleet.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-fleet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAA+B,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAE/B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAQlE,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAuC3B,SAAS,gBAAgB,CAAC,QAAgC;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAa,EAAE,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7B,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QAC9C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;QAC3C,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;QAC7D,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW;KACxD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB;IAAzB;QAEU,YAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QACzC,wBAAmB,GAA4B,EAAE,CAAC;QAClD,eAAU,GAA2B,kBAAkB,CAAC;QACxD,eAAU,GAAG,iBAAiB,GAAG,IAAI,CAAC;QACtC,gBAAW,GAAG,kBAAkB,GAAG,IAAI,CAAC;QACxC,gBAAW,GAAG,aAAa,CAAC;QAC5B,QAAG,GAAiB,IAAI,CAAC,GAAG,CAAC;QAC7B,UAAK,GAAkC,CAAC,EAAE,EAAE,EAAE,CACpD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IA8UtD,CAAC;IA5UC,SAAS,CAAC,QAAiC,EAAE,SAAkC;QAC7E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,SAAS,EAAE,UAAU,IAAI,kBAAkB,CAAC;QAC9D,IAAI,CAAC,GAAG,GAAG,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,GAAG,SAAS,EAAE,WAAW,IAAI,aAAa,CAAC;QAC3D,IAAI,CAAC,mBAAmB,GAAG,SAAS,EAAE,mBAAmB,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,eAAe,IAAI,iBAAiB,CAAC,GAAG,IAAI,CAAC;QAChG,IAAI,CAAC,WAAW,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC/C,OAAO,CAAC,0DAA0D;QACpE,CAAC;QACD,MAAM,gBAAgB,GACpB,SAAS,EAAE,gBAAgB;YAC3B,CAAC,CAAC,MAAoC,EAAE,mBAA4C,EAAE,EAAE,CACtF,IAAI,wBAAwB,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAc,CAAC;YACnC,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE;gBAC1C,GAAG,SAAS,EAAE,mBAAmB;gBACjC,eAAe,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE;oBAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;wBACrD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;oBACjD,CAAC;gBACH,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,oFAAoF;IACpF,2BAA2B;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;aACrC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;aAClD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,QAAsC,EACtC,gBAAkF;QAElF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,gBAAgB,CAAC;YAClC,GAAG,IAAI,CAAC,mBAAmB;YAC3B,eAAe,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE;gBAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;oBACrD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,IAAY,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,cAAc,GAAG,KAAK,IAAI,SAAS,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAY;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACrD,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,IAAyB;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;gBACvD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,CAAC,GAAG,YAAY,8BAA8B,CAAC;wBAAE,MAAM,GAAG,CAAC;oBAChE,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,qBAAqB,CACxB,UAAU,EACV,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,cAAc,EACrB,IAAI,8BAA8B,CAAC,gCAAgC,CAAC,CACrE,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,UAAU,CACZ,oBAAoB,MAAM,CAAC,MAAM,uBAAuB,UAAU,iBAAiB,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAA4F;QAE5F,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,uEAAuE;YACvE,6DAA6D;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,8BAA8B,EAAE,CAAC;gBAClD,qEAAqE;gBACrE,qEAAqE;gBACrE,GAAG,CAAC,UAAU,CACZ,oBAAoB,MAAM,CAAC,IAAI,iCAAiC,MAAM,CAAC,UAAU,+BAA+B,CACjH,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAA6B,EAC7B,OAAe,EACf,OAAO,GAA2D,EAAE;QAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;QAClF,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,uBAAuB,MAAM,CAAC,UAAU,uBAAuB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAA6B;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,QAA0D,CAAC;YAC/D,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,iDAAiD;YAC7D,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,GAAG,CAAC,OAAO,CACT,uCAAuC,OAAO,CAAC,UAAU,gBAAgB,MAAM,CAAC,IAAI,GAAG,CACxF,CAAC;oBACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;oBACnF,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI;oBAAE,SAAS;gBAC5C,GAAG,CAAC,OAAO,CACT,oCAAoC,OAAO,CAAC,UAAU,gBAAgB,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,MAAM,IAAI,CACpH,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;wBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,SAAS,EAAE,CAAC;qBACb,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,UAAU,CACZ,iCAAiC,OAAO,CAAC,UAAU,SAAS,MAAM,CAAC,IAAI,GAAG,EAC1E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,MAAmB,EACnB,UAAkB,EAClB,IAAyB;QAEzB,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3E,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,MAAmB;QAC/C,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO;QACnC,MAAM,IAAI,YAAY,CACpB,2BAA2B,MAAM,CAAC,IAAI,sCAAsC;YAC1E,GAAG,MAAM,CAAC,cAAc,0EAA0E,CACrG,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,UAAkB,EAClB,UAAkB,EAClB,cAAsB,EACtB,KAAY;QAEZ,MAAM,WAAW,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,IAAI,WAAW,IAAI,CAAC;YAAE,OAAO;QAC7B,yEAAyE;QACzE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,IAAI,YAAY,CACpB,2BAA2B,UAAU,qBAAqB,KAAK,CAAC,OAAO,KAAK;YAC1E,aAAa,UAAU,kBAAkB,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,8BAA8B,CACvG,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/C,SAAS,CAAC;YACR,IAAI,IAAuD,CAAC;YAC5D,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBAC7B,QAAQ,IAAI,CAAC,CAAC;oBACd,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBACD,IAAI,MAAc,CAAC;gBACnB,IAAI,cAAkC,CAAC;gBACvC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBAChD,MAAM,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/E,cAAc;wBACZ,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc;4BAChE,CAAC,CAAC,MAAM,CAAC,cAAc;4BACvB,CAAC,CAAC,SAAS,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,SAAS,IAAI,CAAC,CAAC;gBACf,IAAI,cAAc,EAAE,CAAC;oBACnB,0DAA0D;oBAC1D,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM,cAAc,EAAE,CAAC,CAAC;oBACrD,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACxC,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBACvC,IAAI,IAAI,CAAC,CAAC;oBACV,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBACjF,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI;oBAAE,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACzD,CAAC;YACD,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC;YAC7B,IAAI,SAAS,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,YAAY,CACpB,4EAA4E,MAAM,EAAE,CACrF,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,YAAY,CACpB,8DAA8D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CACtG,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,UAA8B;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAC","sourcesContent":["import * as log from \"../log.js\";\nimport type { GondolinRemoteSettings, GondolinRemoteWorkerSettings } from \"../types.js\";\nimport { SandboxError } from \"./errors.js\";\nimport { gondolinPlacements, type GondolinPlacementStore } from \"./gondolin-placement.js\";\nimport {\n  GondolinRemoteConnection,\n  GondolinWorkerUnreachableError,\n  type GondolinRemoteOverrides,\n} from \"./gondolin-remote.js\";\nimport { GondolinRuntimeGoneError } from \"./gondolin-recovery.js\";\nimport type {\n  GondolinRuntimeHandle,\n  GondolinRuntimeSpec,\n  GondolinRuntimeTransport,\n} from \"./gondolin-worker-client.js\";\nimport type { ExecResult } from \"./types.js\";\n\nconst LEASE_TTL_SECONDS = 300;\nconst QUEUE_WAIT_SECONDS = 60;\nconst QUEUE_POLL_MS = 2000;\n\n/** The connection surface the fleet needs from each worker. */\nexport interface GondolinWorkerConnection {\n  health(): Promise<Record<string, unknown>>;\n  ensure(instanceId: string, spec: GondolinRuntimeSpec): Promise<GondolinRuntimeHandle>;\n  stop(\n    handle: Pick<GondolinRuntimeHandle, \"workerPid\" | \"sessionId\" | \"instanceId\">,\n  ): Promise<void>;\n  exec(\n    handle: GondolinRuntimeHandle,\n    command: string,\n    options?: { env?: Record<string, string>; signal?: AbortSignal },\n  ): Promise<ExecResult>;\n  isRuntimeAlive(handle: GondolinRuntimeHandle): Promise<boolean>;\n  listRuntimes(): Promise<Array<{ sessionId: string; instanceId: string }>>;\n  dispose(): void;\n}\n\ninterface FleetWorker {\n  name: string;\n  settings: GondolinRemoteWorkerSettings;\n  connection: GondolinWorkerConnection;\n  /** Non-empty when the worker's shared workspace failed its usability probe. */\n  workspaceError?: string;\n}\n\ninterface GondolinFleetOverrides {\n  createConnection?: (\n    worker: GondolinRemoteWorkerSettings,\n    connectionOverrides: GondolinRemoteOverrides,\n  ) => GondolinWorkerConnection;\n  placements?: GondolinPlacementStore;\n  connectionOverrides?: GondolinRemoteOverrides;\n  now?: () => number;\n  queuePollMs?: number;\n  sleep?: (ms: number) => Promise<void>;\n}\n\nfunction normalizeWorkers(settings: GondolinRemoteSettings): GondolinRemoteWorkerSettings[] {\n  const inline = settings.workers ?? [{ url: settings.url as string }];\n  return inline.map((worker) => ({\n    ...worker,\n    name: worker.name ?? worker.url,\n    caFile: worker.caFile ?? settings.caFile,\n    certFile: worker.certFile ?? settings.certFile,\n    keyFile: worker.keyFile ?? settings.keyFile,\n    workspaceRoot: worker.workspaceRoot ?? settings.workspaceRoot,\n    maxRuntimes: worker.maxRuntimes ?? settings.maxRuntimes,\n  }));\n}\n\n/**\n * Places each conversation's runtime on one worker of the fleet and keeps it\n * there (sticky placement). Failover to another worker happens only when the\n * placed worker is unreachable AND its lease fencing watermark has passed —\n * the point after which the old worker's janitor has provably stopped the\n * runtime, so shared storage never sees two writers.\n */\nclass GondolinFleetClient implements GondolinRuntimeTransport {\n  private settings?: GondolinRemoteSettings;\n  private workers = new Map<string, FleetWorker>();\n  private connectionOverrides: GondolinRemoteOverrides = {};\n  private placements: GondolinPlacementStore = gondolinPlacements;\n  private leaseTtlMs = LEASE_TTL_SECONDS * 1000;\n  private queueWaitMs = QUEUE_WAIT_SECONDS * 1000;\n  private queuePollMs = QUEUE_POLL_MS;\n  private now: () => number = Date.now;\n  private sleep: (ms: number) => Promise<void> = (ms) =>\n    new Promise((resolve) => setTimeout(resolve, ms));\n\n  configure(settings?: GondolinRemoteSettings, overrides?: GondolinFleetOverrides): void {\n    for (const worker of this.workers.values()) worker.connection.dispose();\n    this.workers.clear();\n    this.settings = settings;\n    this.placements = overrides?.placements ?? gondolinPlacements;\n    this.now = overrides?.now ?? Date.now;\n    this.sleep = overrides?.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));\n    this.queuePollMs = overrides?.queuePollMs ?? QUEUE_POLL_MS;\n    this.connectionOverrides = overrides?.connectionOverrides ?? {};\n    this.leaseTtlMs = (overrides?.connectionOverrides?.leaseTtlSeconds ?? LEASE_TTL_SECONDS) * 1000;\n    this.queueWaitMs = (settings?.queueWaitSeconds ?? QUEUE_WAIT_SECONDS) * 1000;\n    if (!settings) return;\n    if (!settings.workers?.length && !settings.url) {\n      return; // not configured; validate() reports the actionable error\n    }\n    const createConnection =\n      overrides?.createConnection ??\n      ((worker: GondolinRemoteWorkerSettings, connectionOverrides: GondolinRemoteOverrides) =>\n        new GondolinRemoteConnection(worker, connectionOverrides));\n    for (const worker of normalizeWorkers(settings)) {\n      const name = worker.name as string;\n      const connection = createConnection(worker, {\n        ...overrides?.connectionOverrides,\n        onLeaseActivity: (instanceId, expiresAtMs) => {\n          if (this.placements.get(instanceId)?.worker === name) {\n            this.placements.touch(instanceId, expiresAtMs);\n          }\n        },\n      });\n      this.workers.set(name, { name, settings: worker, connection });\n    }\n  }\n\n  isConfigured(): boolean {\n    return this.workers.size > 0;\n  }\n\n  /** Names of statically-configured workers with no workspaceRoot (startup guard). */\n  workersMissingWorkspaceRoot(): string[] {\n    return Array.from(this.workers.values())\n      .filter((worker) => !worker.settings.workspaceRoot)\n      .map((worker) => worker.name);\n  }\n\n  /**\n   * Attach a dial-home worker at runtime (the gateway calls this when a\n   * worker registers). The factory receives the fleet's connection overrides\n   * plus the lease-watermark callback, mirroring configure()'s wiring.\n   */\n  attachWorker(\n    settings: GondolinRemoteWorkerSettings,\n    createConnection: (overrides: GondolinRemoteOverrides) => GondolinWorkerConnection,\n  ): void {\n    const name = settings.name ?? settings.url;\n    this.workers.get(name)?.connection.dispose();\n    const connection = createConnection({\n      ...this.connectionOverrides,\n      onLeaseActivity: (instanceId, expiresAtMs) => {\n        if (this.placements.get(instanceId)?.worker === name) {\n          this.placements.touch(instanceId, expiresAtMs);\n        }\n      },\n    });\n    this.workers.set(name, { name, settings: { ...settings, name }, connection });\n  }\n\n  /**\n   * Record a worker's shared-workspace health (the gateway pushes this from\n   * register and ping frames). A degraded worker keeps its runtimes and its\n   * connection, but new placements skip it and runtime operations fail fast\n   * with the probe's diagnosis instead of hanging on a dead mount.\n   */\n  setWorkspaceHealth(name: string, error?: string): void {\n    const worker = this.workers.get(name);\n    if (!worker) return;\n    worker.workspaceError = error || undefined;\n  }\n\n  /**\n   * Detach a dial-home worker (disconnect). Placements survive: their lease\n   * watermarks keep fencing failover until expiry, exactly as for an\n   * unreachable static worker.\n   */\n  detachWorker(name: string): void {\n    const worker = this.workers.get(name);\n    if (!worker) return;\n    worker.connection.dispose();\n    this.workers.delete(name);\n  }\n\n  imageSelector(): string | undefined {\n    return this.settings?.imageSelector;\n  }\n\n  /** At least one worker must answer for the sandbox mode to come up. */\n  async health(): Promise<Array<{ worker: string; health?: Record<string, unknown> }>> {\n    const report = await Promise.all(\n      Array.from(this.workers.values()).map(async (worker) => {\n        try {\n          return { worker: worker.name, health: await worker.connection.health() };\n        } catch {\n          return { worker: worker.name };\n        }\n      }),\n    );\n    if (report.length > 0 && !report.some((entry) => entry.health)) {\n      throw new SandboxError(\"Error: no gondolin remote worker is reachable\");\n    }\n    return report;\n  }\n\n  async ensure(instanceId: string, spec: GondolinRuntimeSpec): Promise<GondolinRuntimeHandle> {\n    const placed = this.placements.get(instanceId);\n    if (placed) {\n      const worker = this.workers.get(placed.worker);\n      if (worker) {\n        try {\n          return await this.ensureOn(worker, instanceId, spec);\n        } catch (err) {\n          if (!(err instanceof GondolinWorkerUnreachableError)) throw err;\n          this.assertFailoverAllowed(instanceId, placed.worker, placed.leaseExpiresAt, err);\n        }\n      } else {\n        this.assertFailoverAllowed(\n          instanceId,\n          placed.worker,\n          placed.leaseExpiresAt,\n          new GondolinWorkerUnreachableError(\"worker is no longer configured\"),\n        );\n      }\n      log.logWarning(\n        `Gondolin worker '${placed.worker}' lost runtime for '${instanceId}'; failing over`,\n      );\n    }\n    const worker = await this.selectWorker();\n    return this.ensureOn(worker, instanceId, spec);\n  }\n\n  async stop(\n    handle: Pick<GondolinRuntimeHandle, \"workerPid\" | \"sessionId\" | \"instanceId\" | \"workerName\">,\n  ): Promise<void> {\n    const worker = this.workerFor(handle.workerName);\n    if (!worker) {\n      // the worker left the fleet config; its janitor stops the runtime when\n      // the lease expires, and the record keeps fencing until then\n      return;\n    }\n    try {\n      await worker.connection.stop(handle);\n      this.placements.delete(handle.instanceId);\n    } catch (err) {\n      if (err instanceof GondolinWorkerUnreachableError) {\n        // cannot confirm the stop; keep the placement so its watermark still\n        // fences any failover, and let the daemon's expiry janitor finish it\n        log.logWarning(\n          `Gondolin worker '${worker.name}' unreachable while stopping '${handle.instanceId}'; leaving it to lease expiry`,\n        );\n        return;\n      }\n      throw err;\n    }\n  }\n\n  async exec(\n    handle: GondolinRuntimeHandle,\n    command: string,\n    options: { env?: Record<string, string>; signal?: AbortSignal } = {},\n  ): Promise<ExecResult> {\n    const worker = this.workerFor(handle.workerName);\n    if (!worker) throw new GondolinRuntimeGoneError(\"worker is no longer configured\");\n    this.assertWorkspaceUsable(worker);\n    log.logInfo(`Gondolin execution '${handle.instanceId}' routed to worker '${worker.name}'`);\n    return worker.connection.exec(handle, command, options);\n  }\n\n  async isRuntimeAlive(handle: GondolinRuntimeHandle): Promise<boolean> {\n    const worker = this.workerFor(handle.workerName);\n    if (!worker) return false;\n    return worker.connection.isRuntimeAlive(handle);\n  }\n\n  /**\n   * Fleet reconciliation: a runtime whose conversation is placed on a\n   * different worker is a stray from a superseded placement — stop it. A\n   * runtime with no placement at all (crash between daemon ensure and the\n   * placement write) is adopted instead of killed.\n   */\n  async reconcile(): Promise<void> {\n    for (const worker of this.workers.values()) {\n      let runtimes: Array<{ sessionId: string; instanceId: string }>;\n      try {\n        runtimes = await worker.connection.listRuntimes();\n      } catch {\n        continue; // unreachable workers reconcile on a later sweep\n      }\n      for (const runtime of runtimes) {\n        const record = this.placements.get(runtime.instanceId);\n        if (!record) {\n          log.logInfo(\n            `Adopting unplaced Gondolin runtime '${runtime.instanceId}' on worker '${worker.name}'`,\n          );\n          this.placements.set(runtime.instanceId, worker.name, this.now() + this.leaseTtlMs);\n          continue;\n        }\n        if (record.worker === worker.name) continue;\n        log.logInfo(\n          `Stopping stray Gondolin runtime '${runtime.instanceId}' on worker '${worker.name}' (placed on '${record.worker}')`,\n        );\n        try {\n          await worker.connection.stop({\n            sessionId: runtime.sessionId,\n            instanceId: runtime.instanceId,\n            workerPid: 0,\n          });\n        } catch (err) {\n          log.logWarning(\n            `Failed to stop stray runtime '${runtime.instanceId}' on '${worker.name}'`,\n            err instanceof Error ? err.message : String(err),\n          );\n        }\n      }\n    }\n  }\n\n  private async ensureOn(\n    worker: FleetWorker,\n    instanceId: string,\n    spec: GondolinRuntimeSpec,\n  ): Promise<GondolinRuntimeHandle> {\n    this.assertWorkspaceUsable(worker);\n    const handle = await worker.connection.ensure(instanceId, spec);\n    this.placements.set(instanceId, worker.name, this.now() + this.leaseTtlMs);\n    return { ...handle, workerName: worker.name };\n  }\n\n  /**\n   * Fail fast — with the probe's diagnosis — instead of dispatching work that\n   * would hang on a dead shared-workspace mount. Deliberately NOT a\n   * GondolinWorkerUnreachableError: a broken mount must not trigger failover,\n   * because the workspace is shared and likely broken for every worker.\n   */\n  private assertWorkspaceUsable(worker: FleetWorker): void {\n    if (!worker.workspaceError) return;\n    throw new SandboxError(\n      `Error: Gondolin worker '${worker.name}' has an unusable shared workspace: ` +\n        `${worker.workspaceError} (fix the mount on the worker; health refreshes with its next heartbeat)`,\n    );\n  }\n\n  private assertFailoverAllowed(\n    instanceId: string,\n    workerName: string,\n    leaseExpiresAt: number,\n    cause: Error,\n  ): void {\n    const remainingMs = leaseExpiresAt - this.now();\n    if (remainingMs <= 0) return;\n    // Failing over earlier could put a second writable VM on the same shared\n    // workspace: the old worker may be alive behind a partition, and its\n    // daemon only stops the runtime once the lease expires.\n    throw new SandboxError(\n      `Error: Gondolin worker '${workerName}' is unreachable (${cause.message}); ` +\n        `retrying '${instanceId}' elsewhere in ${Math.ceil(remainingMs / 1000)}s once its lease has expired`,\n    );\n  }\n\n  private async selectWorker(): Promise<FleetWorker> {\n    const deadline = this.now() + this.queueWaitMs;\n    for (;;) {\n      let best: { worker: FleetWorker; load: number } | undefined;\n      let reachable = 0;\n      let draining = 0;\n      let full = 0;\n      const degraded: string[] = [];\n      for (const worker of this.workers.values()) {\n        if (worker.settings.draining) {\n          draining += 1;\n          continue;\n        }\n        if (worker.workspaceError) {\n          degraded.push(`'${worker.name}': ${worker.workspaceError}`);\n          continue;\n        }\n        let active: number;\n        let workspaceError: string | undefined;\n        try {\n          const health = await worker.connection.health();\n          active = typeof health.activeRuntimes === \"number\" ? health.activeRuntimes : 0;\n          workspaceError =\n            typeof health.workspaceError === \"string\" && health.workspaceError\n              ? health.workspaceError\n              : undefined;\n        } catch {\n          continue;\n        }\n        reachable += 1;\n        if (workspaceError) {\n          // static workers report probe results via /v1/health only\n          degraded.push(`'${worker.name}': ${workspaceError}`);\n          continue;\n        }\n        const cap = worker.settings.maxRuntimes;\n        if (cap !== undefined && active >= cap) {\n          full += 1;\n          continue;\n        }\n        const load = cap !== undefined ? active / cap : active / Number.MAX_SAFE_INTEGER;\n        if (!best || load < best.load) best = { worker, load };\n      }\n      if (best) return best.worker;\n      if (reachable === 0 && draining === 0 && degraded.length === 0) {\n        throw new SandboxError(\"Error: no gondolin remote worker is reachable\");\n      }\n      if (full === 0) {\n        const detail = degraded.length > 0 ? ` — degraded: ${degraded.join(\"; \")}` : \"\";\n        throw new SandboxError(\n          `Error: every gondolin remote worker is draining, degraded, or unreachable${detail}`,\n        );\n      }\n      if (this.now() >= deadline) {\n        throw new SandboxError(\n          `Error: all gondolin remote workers are at capacity (waited ${Math.round(this.queueWaitMs / 1000)}s)`,\n        );\n      }\n      await this.sleep(this.queuePollMs);\n    }\n  }\n\n  private workerFor(workerName: string | undefined): FleetWorker | undefined {\n    if (!workerName) return undefined;\n    return this.workers.get(workerName);\n  }\n}\n\nexport const gondolinFleet = new GondolinFleetClient();\n"]}

package/dist/sandbox/gondolin-gateway.d.ts

@@ -1,86 +0,0 @@
-import type { Server, Socket } from "node:net";
-import type { GondolinGatewaySettings } from "../types.js";
-/** What a worker announces when it dials home (mirrors the Go register frame). */
-interface GondolinWorkerRegistration {
-    name: string;
-    os?: string;
-    arch?: string;
-    accelerator?: string;
-    cpus?: number;
-    memoryBytes?: number;
-    maxRuntimes?: number;
-    protocolVersion?: number;
-    runtimes?: Array<{
-        sessionId: string;
-        instanceId: string;
-    }>;
-    /** Non-empty when the worker's shared workspace failed its usability probe. */
-    workspaceError?: string;
-}
-interface GatewayOverrides {
-    /** Server factory (tests substitute a plain net.Server). */
-    createServer?: (onConnection: (socket: Socket) => void) => Server;
-    /** mTLS verification result for a socket (tests substitute outcomes). */
-    isAuthorized?: (socket: Socket) => boolean;
-    leaseTtlSeconds?: number;
-    rpcTimeoutMs?: number;
-    tunnelTimeoutMs?: number;
-}
-/**
- * The host side of dial-home workers: one mTLS listener that accepts worker
- * control channels (register/ping/RPC responses) and per-command dial-back
- * tunnels, keeps the registry of connected workers, and attaches each one to
- * the fleet as a regular worker connection. Placement, leases, fencing, and
- * failover are unchanged — this only reverses who dials whom.
- */
-declare class GondolinWorkerGateway {
-    private settings?;
-    private overrides;
-    private server?;
-    private readonly workers;
-    private readonly pendingTunnels;
-    configure(settings?: GondolinGatewaySettings, overrides?: GatewayOverrides): void;
-    isConfigured(): boolean;
-    /** Registered workers and their liveness (admin/observability surface). */
-    list(): Array<{
-        name: string;
-        connected: boolean;
-        activeRuntimes: number;
-        workspaceError?: string;
-        info: GondolinWorkerRegistration;
-    }>;
-    /**
-     * Start the listener. Without explicit certificate settings the gateway
-     * provisions its own: a private worker CA plus a server certificate signed
-     * by it (required for join's CA pinning to also authenticate the host).
-     */
-    start(): Promise<void>;
-    stop(): void;
-    /** Routes one inbound connection by its first frame: control or tunnel. */
-    private handleConnection;
-    private acceptControlChannel;
-    private handleControlFrame;
-    /**
-     * Track shared-workspace health from register/ping frames and push it into
-     * the fleet, logging only the transitions. A worker whose NFS mount died
-     * keeps its control channel alive — this is what turns that silent state
-     * into refused placements and fail-fast execs.
-     */
-    private applyWorkspaceHealth;
-    /** RPC to a worker over its control channel (the reverse of HTTPS requests). */
-    private rpc;
-    private rejectPendingRpc;
-    /** Ask the worker to dial back a data connection for one session tunnel. */
-    private openTunnel;
-    /**
-     * One-time token → CA-signed client certificate. The only operation an
-     * unauthenticated connection may perform; the connection closes after the
-     * response either way.
-     */
-    private handleJoin;
-    private acceptTunnel;
-    private workerBySocket;
-}
-export declare const gondolinGateway: GondolinWorkerGateway;
-export {};
-//# sourceMappingURL=gondolin-gateway.d.ts.map

package/dist/sandbox/gondolin-gateway.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gondolin-gateway.d.ts","sourceRoot":"","sources":["../../src/sandbox/gondolin-gateway.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAI/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAU3D,kFAAkF;AAClF,UAAU,0BAA0B;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAyED,UAAU,gBAAgB;IACxB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KAAK,MAAM,CAAC;IAClE,yEAAyE;IACzE,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;GAMG;AACH,cAAM,qBAAqB;IACzB,OAAO,CAAC,QAAQ,CAAC,CAA0B;IAC3C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG3B;IAEJ,SAAS,CAAC,QAAQ,CAAC,EAAE,uBAAuB,EAAE,SAAS,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAIhF;IAED,YAAY,IAAI,OAAO,CAEtB;IAED,2EAA2E;IAC3E,IAAI,IAAI,KAAK,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,0BAA0B,CAAC;KAClC,CAAC,CAQD;IAED;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA6C3B;IAED,IAAI,IAAI,IAAI,CAUX;IAED,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IA8BxB,OAAO,CAAC,oBAAoB;IAgE5B,OAAO,CAAC,kBAAkB;IAsB1B;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAiB5B,gFAAgF;IAChF,OAAO,CAAC,GAAG;IAqCX,OAAO,CAAC,gBAAgB;IAQxB,4EAA4E;IAC5E,OAAO,CAAC,UAAU;IAyDlB;;;;OAIG;YACW,UAAU;IA0BxB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,cAAc;CAMvB;AAED,eAAO,MAAM,eAAe,uBAA8B,CAAC"}

package/dist/sandbox/gondolin-gateway.js

@@ -1,407 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { hostname } from "node:os";
-import { TLSSocket, createServer as createTlsServer } from "node:tls";
-import * as log from "../log.js";
-import { gondolinFleet } from "./gondolin-fleet.js";
-import { gondolinJoin } from "./gondolin-join.js";
-import { createSessionFrameParser, encodeSessionMessage } from "./gondolin-contract.js";
-import { GondolinRemoteConnection, GondolinWorkerUnreachableError } from "./gondolin-remote.js";
-const RPC_TIMEOUT_MS = 150_000;
-const TUNNEL_TIMEOUT_MS = 15_000;
-/**
- * Splits a byte stream into u32be-length-prefixed JSON frames, preserving any
- * bytes after the point where the consumer stops parsing (a tunnel connection
- * switches protocols after its preamble frame).
- */
-function createControlFrameReader(onFrame) {
-    let buffer = Buffer.alloc(0);
-    let stopped = false;
-    return {
-        push(chunk) {
-            if (stopped)
-                return;
-            buffer = Buffer.concat([buffer, chunk]);
-            for (;;) {
-                // onFrame may call stop() synchronously (a tunnel switching protocols)
-                if (stopped || buffer.length < 4)
-                    return;
-                const length = buffer.readUInt32BE(0);
-                if (buffer.length < 4 + length)
-                    return;
-                const payload = buffer.subarray(4, 4 + length);
-                buffer = buffer.subarray(4 + length);
-                let frame;
-                try {
-                    frame = JSON.parse(payload.toString("utf8"));
-                }
-                catch {
-                    continue; // skip malformed frames
-                }
-                onFrame(frame, buffer);
-            }
-        },
-        stop() {
-            stopped = true;
-        },
-    };
-}
-function encodeControlFrame(frame) {
-    return encodeSessionMessage(frame);
-}
-function defaultIsAuthorized(socket) {
-    return socket instanceof TLSSocket && socket.authorized;
-}
-/**
- * The host side of dial-home workers: one mTLS listener that accepts worker
- * control channels (register/ping/RPC responses) and per-command dial-back
- * tunnels, keeps the registry of connected workers, and attaches each one to
- * the fleet as a regular worker connection. Placement, leases, fencing, and
- * failover are unchanged — this only reverses who dials whom.
- */
-class GondolinWorkerGateway {
-    constructor() {
-        this.overrides = {};
-        this.workers = new Map();
-        this.pendingTunnels = new Map();
-    }
-    configure(settings, overrides) {
-        this.stop();
-        this.settings = settings;
-        this.overrides = overrides ?? {};
-    }
-    isConfigured() {
-        return this.settings !== undefined;
-    }
-    /** Registered workers and their liveness (admin/observability surface). */
-    list() {
-        return Array.from(this.workers.values()).map((worker) => ({
-            name: worker.info.name,
-            connected: !worker.socket.destroyed,
-            activeRuntimes: worker.activeRuntimes,
-            workspaceError: worker.workspaceError,
-            info: worker.info,
-        }));
-    }
-    /**
-     * Start the listener. Without explicit certificate settings the gateway
-     * provisions its own: a private worker CA plus a server certificate signed
-     * by it (required for join's CA pinning to also authenticate the host).
-     */
-    async start() {
-        if (!this.settings || this.server)
-            return;
-        const settings = this.settings;
-        if (!settings.workspaceRoot) {
-            // dial-home workers inherit workspaceRoot from here; without it every
-            // runtime is rejected with "escapes the workspace root"
-            throw new Error("gondolin gateway requires workspaceRoot (the worker-side shared workspace path); " +
-                "set sandbox.gondolin.remote.gateway.workspaceRoot");
-        }
-        let material;
-        if (settings.certFile && settings.keyFile && settings.clientCaFile) {
-            material = {
-                certFile: settings.certFile,
-                keyFile: settings.keyFile,
-                clientCaFile: settings.clientCaFile,
-            };
-        }
-        else {
-            if (!gondolinJoin.isConfigured()) {
-                throw new Error("gondolin gateway auto-init requires the join service to be configured");
-            }
-            const issued = await gondolinJoin.ensureServerCert(settings.hostnames ?? [hostname()]);
-            material = { ...issued, clientCaFile: gondolinJoin.paths().caFile };
-        }
-        const factory = this.overrides.createServer ??
-            ((onConnection) => createTlsServer({
-                cert: readFileSync(material.certFile),
-                key: readFileSync(material.keyFile),
-                ca: readFileSync(material.clientCaFile),
-                requestCert: true,
-                // unauthenticated connections may only send a join frame; the
-                // per-frame authorization gate enforces that below
-                rejectUnauthorized: false,
-                minVersion: "TLSv1.3",
-            }, onConnection));
-        this.server = factory((socket) => this.handleConnection(socket));
-        this.server.listen(this.settings.port, () => {
-            log.logInfo(`Gondolin worker gateway listening on :${this.settings?.port}`);
-        });
-    }
-    stop() {
-        for (const worker of this.workers.values()) {
-            worker.socket.destroy();
-            this.rejectPendingRpc(worker, "gateway stopped");
-        }
-        this.workers.clear();
-        for (const pending of this.pendingTunnels.values())
-            clearTimeout(pending.timer);
-        this.pendingTunnels.clear();
-        this.server?.close();
-        this.server = undefined;
-    }
-    /** Routes one inbound connection by its first frame: control or tunnel. */
-    handleConnection(socket) {
-        socket.setNoDelay(true);
-        socket.setKeepAlive(true, 30_000);
-        let routed = false;
-        const authorized = (this.overrides.isAuthorized ?? defaultIsAuthorized)(socket);
-        const reader = createControlFrameReader((frame, leftover) => {
-            if (!routed) {
-                routed = true;
-                if (frame.type === "join") {
-                    void this.handleJoin(socket, frame);
-                }
-                else if (!authorized) {
-                    // everything except join requires a CA-signed client certificate
-                    socket.destroy();
-                }
-                else if (frame.type === "register" && frame.name) {
-                    this.acceptControlChannel(socket, frame, reader);
-                }
-                else if (frame.type === "tunnel" && frame.nonce) {
-                    reader.stop();
-                    socket.removeAllListeners("data");
-                    this.acceptTunnel(socket, frame.nonce, leftover);
-                }
-                else {
-                    socket.destroy();
-                }
-                return;
-            }
-            this.handleControlFrame(socket, frame);
-        });
-        socket.on("data", (chunk) => reader.push(chunk));
-        socket.on("error", () => socket.destroy());
-    }
-    acceptControlChannel(socket, registration, _reader) {
-        const name = registration.name;
-        const previous = this.workers.get(name);
-        if (previous && !previous.socket.destroyed) {
-            log.logInfo(`Gondolin worker '${name}' re-registered; superseding previous connection`);
-            previous.socket.destroy();
-        }
-        const worker = {
-            info: registration,
-            socket,
-            connectedAt: Date.now(),
-            lastSeen: Date.now(),
-            activeRuntimes: registration.runtimes?.length ?? 0,
-            pendingRpc: new Map(),
-            nextRpcId: 1,
-        };
-        this.workers.set(name, worker);
-        const surviving = registration.runtimes?.length ?? 0;
-        log.logInfo(`Gondolin worker joined: ${name} (${registration.os}/${registration.arch}, ` +
-            `${registration.accelerator}, ${registration.cpus} cpus, ` +
-            `cap ${registration.maxRuntimes ?? "∞"}, ${surviving} runtimes surviving)`);
-        const overrides = this.settings?.workers?.[name];
-        gondolinFleet.attachWorker({
-            name,
-            url: `dialhome://${name}`,
-            workspaceRoot: this.settings?.workspaceRoot,
-            maxRuntimes: overrides?.maxRuntimes ?? registration.maxRuntimes,
-            draining: overrides?.draining,
-        }, (connectionOverrides) => new GondolinRemoteConnection({ name, url: `dialhome://${name}`, workspaceRoot: this.settings?.workspaceRoot }, {
-            ...connectionOverrides,
-            ...(this.overrides.leaseTtlSeconds !== undefined
-                ? { leaseTtlSeconds: this.overrides.leaseTtlSeconds }
-                : {}),
-            request: (method, path, body, headers) => this.rpc(name, method, path, body, headers),
-            tunnel: (path, headers, callbacks) => this.openTunnel(name, path, headers, callbacks),
-        }));
-        this.applyWorkspaceHealth(worker, registration.workspaceError);
-        // a worker that reconnected may carry runtimes whose placements moved
-        void gondolinFleet.reconcile();
-        socket.on("close", () => {
-            this.rejectPendingRpc(worker, `worker '${name}' disconnected`);
-            const current = this.workers.get(name);
-            if (current !== worker)
-                return; // superseded
-            log.logWarning(`Gondolin worker disconnected: ${name} (placements fence until lease expiry)`);
-            gondolinFleet.detachWorker(name);
-            this.workers.delete(name);
-        });
-    }
-    handleControlFrame(socket, frame) {
-        const worker = this.workerBySocket(socket);
-        if (!worker)
-            return;
-        worker.lastSeen = Date.now();
-        if (frame.type === "ping") {
-            if (typeof frame.activeRuntimes === "number") {
-                worker.activeRuntimes = frame.activeRuntimes;
-            }
-            // omitted on healthy pings (Go omitempty), so absence means recovered
-            this.applyWorkspaceHealth(worker, frame.workspaceError);
-            socket.write(encodeControlFrame({ type: "pong" }));
-            return;
-        }
-        if (frame.type === "response" && typeof frame.id === "number") {
-            const pending = worker.pendingRpc.get(frame.id);
-            if (!pending)
-                return;
-            worker.pendingRpc.delete(frame.id);
-            clearTimeout(pending.timer);
-            pending.resolve(frame);
-        }
-    }
-    /**
-     * Track shared-workspace health from register/ping frames and push it into
-     * the fleet, logging only the transitions. A worker whose NFS mount died
-     * keeps its control channel alive — this is what turns that silent state
-     * into refused placements and fail-fast execs.
-     */
-    applyWorkspaceHealth(worker, error) {
-        const next = error || undefined;
-        if (next === worker.workspaceError) {
-            gondolinFleet.setWorkspaceHealth(worker.info.name, next); // attach may have reset it
-            return;
-        }
-        if (next) {
-            log.logWarning(`Gondolin worker '${worker.info.name}' workspace is unusable: ${next} — new placements disabled until it recovers`);
-        }
-        else {
-            log.logInfo(`Gondolin worker '${worker.info.name}' workspace recovered`);
-        }
-        worker.workspaceError = next;
-        gondolinFleet.setWorkspaceHealth(worker.info.name, next);
-    }
-    /** RPC to a worker over its control channel (the reverse of HTTPS requests). */
-    rpc(name, method, path, body, headers) {
-        const worker = this.workers.get(name);
-        if (!worker || worker.socket.destroyed) {
-            return Promise.reject(new GondolinWorkerUnreachableError(`worker '${name}' is not connected`));
-        }
-        const id = worker.nextRpcId++;
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                worker.pendingRpc.delete(id);
-                reject(new GondolinWorkerUnreachableError(`RPC to worker '${name}' timed out (${method} ${path})`));
-            }, this.overrides.rpcTimeoutMs ?? RPC_TIMEOUT_MS);
-            timer.unref?.();
-            worker.pendingRpc.set(id, {
-                timer,
-                reject,
-                resolve: (frame) => resolve({
-                    status: frame.status ?? 0,
-                    json: (frame.body ?? {}),
-                }),
-            });
-            worker.socket.write(encodeControlFrame({ type: "request", id, method, path, body, headers }));
-        });
-    }
-    rejectPendingRpc(worker, reason) {
-        for (const pending of worker.pendingRpc.values()) {
-            clearTimeout(pending.timer);
-            pending.reject(new GondolinWorkerUnreachableError(reason));
-        }
-        worker.pendingRpc.clear();
-    }
-    /** Ask the worker to dial back a data connection for one session tunnel. */
-    openTunnel(name, path, headers, callbacks) {
-        const worker = this.workers.get(name);
-        if (!worker || worker.socket.destroyed) {
-            const error = new Error(`worker '${name}' is not connected`);
-            error.code = "ECONNREFUSED"; // nothing executed — safe to recreate
-            return Promise.reject(error);
-        }
-        const sessionId = path.split("/")[3];
-        const nonce = randomBytes(16).toString("hex");
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                this.pendingTunnels.delete(nonce);
-                const error = new Error(`worker '${name}' did not dial back a tunnel`);
-                error.code = "ECONNREFUSED";
-                reject(error);
-            }, this.overrides.tunnelTimeoutMs ?? TUNNEL_TIMEOUT_MS);
-            timer.unref?.();
-            this.pendingTunnels.set(nonce, {
-                timer,
-                resolve: ({ socket, leftover }) => {
-                    let closed = false;
-                    const parse = createSessionFrameParser(callbacks);
-                    if (leftover.length > 0)
-                        parse(leftover);
-                    socket.on("data", parse);
-                    socket.on("error", (error) => {
-                        if (closed)
-                            return;
-                        closed = true;
-                        callbacks.onClose(error);
-                    });
-                    socket.on("close", () => {
-                        if (closed)
-                            return;
-                        closed = true;
-                        callbacks.onClose();
-                    });
-                    resolve({
-                        send: (message) => {
-                            if (!closed)
-                                socket.write(encodeSessionMessage(message));
-                        },
-                        close: () => {
-                            if (closed)
-                                return;
-                            closed = true;
-                            socket.destroy();
-                        },
-                    });
-                },
-            });
-            worker.socket.write(encodeControlFrame({ type: "open-tunnel", nonce, sessionId, headers }));
-        });
-    }
-    /**
-     * One-time token → CA-signed client certificate. The only operation an
-     * unauthenticated connection may perform; the connection closes after the
-     * response either way.
-     */
-    async handleJoin(socket, frame) {
-        const refuse = (message) => {
-            log.logWarning(`Gondolin worker join refused: ${message}`);
-            socket.end(encodeControlFrame({ type: "join-error", message }));
-        };
-        if (!gondolinJoin.isConfigured()) {
-            refuse("join is not enabled on this gateway");
-            return;
-        }
-        if (!frame.token || !frame.csr || !frame.name) {
-            refuse("join requires token, csr, and name");
-            return;
-        }
-        if (!gondolinJoin.consumeToken(frame.token)) {
-            refuse(`invalid or expired join token (worker '${frame.name}')`);
-            return;
-        }
-        try {
-            const signed = await gondolinJoin.signCsr(frame.csr);
-            log.logInfo(`Gondolin worker '${frame.name}' joined: client certificate issued`);
-            socket.end(encodeControlFrame({ type: "join-ok", cert: signed.certPem, ca: signed.caPem }));
-        }
-        catch (err) {
-            refuse(`certificate issuance failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    acceptTunnel(socket, nonce, leftover) {
-        const pending = this.pendingTunnels.get(nonce);
-        if (!pending) {
-            socket.destroy();
-            return;
-        }
-        this.pendingTunnels.delete(nonce);
-        clearTimeout(pending.timer);
-        pending.resolve({ socket, leftover: Buffer.from(leftover) });
-    }
-    workerBySocket(socket) {
-        for (const worker of this.workers.values()) {
-            if (worker.socket === socket)
-                return worker;
-        }
-        return undefined;
-    }
-}
-export const gondolinGateway = new GondolinWorkerGateway();
-//# sourceMappingURL=gondolin-gateway.js.map

package/dist/sandbox/gondolin-gateway.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gondolin-gateway.js","sourceRoot":"","sources":["../../src/sandbox/gondolin-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAGhG,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AA+CjC;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,OAAwD;IAIxF,IAAI,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACxC,SAAS,CAAC;gBACR,uEAAuE;gBACvE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBACzC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;oBAAE,OAAO;gBACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;gBAC/C,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;gBACrC,IAAI,KAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,wBAAwB;gBACpC,CAAC;gBACD,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAYD,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,YAAY,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB;IAA3B;QAEU,cAAS,GAAqB,EAAE,CAAC;QAExB,YAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC9C,mBAAc,GAAG,IAAI,GAAG,EAGtC,CAAC;IAiYN,CAAC;IA/XC,SAAS,CAAC,QAAkC,EAAE,SAA4B;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;IACnC,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;IACrC,CAAC;IAED,2EAA2E;IAC3E,IAAI;QAOF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC5B,sEAAsE;YACtE,wDAAwD;YACxD,MAAM,IAAI,KAAK,CACb,mFAAmF;gBACjF,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,QAAqE,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACnE,QAAQ,GAAG;gBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvF,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,SAAS,CAAC,YAAY;YAC3B,CAAC,CAAC,YAAsC,EAAE,EAAE,CAC1C,eAAe,CACb;gBACE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACnC,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACvC,WAAW,EAAE,IAAI;gBACjB,8DAA8D;gBAC9D,mDAAmD;gBACnD,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,SAAS;aACtB,EACD,YAAY,CACb,CAAC,CAAC;QACP,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,yCAAyC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI;QACF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,2EAA2E;IACnE,gBAAgB,CAAC,MAAc;QACrC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1B,KAAK,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,CAAC,UAAU,EAAE,CAAC;oBACvB,iEAAiE;oBACjE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBACnD,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAClD,MAAM,CAAC,IAAI,EAAE,CAAC;oBACd,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAClC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEO,oBAAoB,CAC1B,MAAc,EACd,YAA0B,EAC1B,OAA6B;QAE7B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAc,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,kDAAkD,CAAC,CAAC;YACxF,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAqB;YAC/B,IAAI,EAAE,YAAY;YAClB,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,cAAc,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;YAClD,UAAU,EAAE,IAAI,GAAG,EAAE;YACrB,SAAS,EAAE,CAAC;SACb,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,OAAO,CACT,2BAA2B,IAAI,KAAK,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,IAAI,IAAI;YAC1E,GAAG,YAAY,CAAC,WAAW,KAAK,YAAY,CAAC,IAAI,SAAS;YAC1D,OAAO,YAAY,CAAC,WAAW,IAAI,GAAG,KAAK,SAAS,sBAAsB,CAC7E,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,aAAa,CAAC,YAAY,CACxB;YACE,IAAI;YACJ,GAAG,EAAE,cAAc,IAAI,EAAE;YACzB,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa;YAC3C,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI,YAAY,CAAC,WAAW;YAC/D,QAAQ,EAAE,SAAS,EAAE,QAAQ;SAC9B,EACD,CAAC,mBAAmB,EAAE,EAAE,CACtB,IAAI,wBAAwB,CAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,EAChF;YACE,GAAG,mBAAmB;YACtB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE;gBACrD,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YACrF,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;SACtF,CACF,CACJ,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;QAC/D,sEAAsE;QACtE,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;QAE/B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,IAAI,gBAAgB,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,MAAM;gBAAE,OAAO,CAAC,aAAa;YAC7C,GAAG,CAAC,UAAU,CAAC,iCAAiC,IAAI,wCAAwC,CAAC,CAAC;YAC9F,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,MAAc,EAAE,KAAmB;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;YAC/C,CAAC;YACD,sEAAsE;YACtE,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,MAAwB,EAAE,KAAyB;QAC9E,MAAM,IAAI,GAAG,KAAK,IAAI,SAAS,CAAC;QAChC,IAAI,IAAI,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;YACnC,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,2BAA2B;YACrF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CACZ,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,4BAA4B,IAAI,8CAA8C,CACnH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,gFAAgF;IACxE,GAAG,CACT,IAAY,EACZ,MAAc,EACd,IAAY,EACZ,IAAa,EACb,OAAgC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,8BAA8B,CAAC,WAAW,IAAI,oBAAoB,CAAC,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC7B,MAAM,CACJ,IAAI,8BAA8B,CAChC,kBAAkB,IAAI,gBAAgB,MAAM,IAAI,IAAI,GAAG,CACxD,CACF,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC;YAClD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACxB,KAAK;gBACL,MAAM;gBACN,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,OAAO,CAAC;oBACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;oBACzB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACpD,CAAC;aACL,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAAwB,EAAE,MAAc;QAC/D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,4EAA4E;IACpE,UAAU,CAChB,IAAY,EACZ,IAAY,EACZ,OAA+B,EAC/B,SAAiC;QAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,IAAI,oBAAoB,CAA0B,CAAC;YACtF,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,sCAAsC;YACnE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,WAAW,IAAI,8BAA8B,CACrB,CAAC;gBAC3B,KAAK,CAAC,IAAI,GAAG,cAAc,CAAC;gBAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,IAAI,iBAAiB,CAAC,CAAC;YACxD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC7B,KAAK;gBACL,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;oBAChC,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,KAAK,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;oBAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;wBAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACzC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;wBAClC,IAAI,MAAM;4BAAE,OAAO;wBACnB,MAAM,GAAG,IAAI,CAAC;wBACd,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC3B,CAAC,CAAC,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;wBACtB,IAAI,MAAM;4BAAE,OAAO;wBACnB,MAAM,GAAG,IAAI,CAAC;wBACd,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,CAAC,CAAC,CAAC;oBACH,OAAO,CAAC;wBACN,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;4BAChB,IAAI,CAAC,MAAM;gCAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;wBAC3D,CAAC;wBACD,KAAK,EAAE,GAAG,EAAE;4BACV,IAAI,MAAM;gCAAE,OAAO;4BACnB,MAAM,GAAG,IAAI,CAAC;4BACd,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,KAAmB;QAC1D,MAAM,MAAM,GAAG,CAAC,OAAe,EAAQ,EAAE;YACvC,GAAG,CAAC,UAAU,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,qCAAqC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,oCAAoC,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,0CAA0C,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,CAAC,IAAI,qCAAqC,CAAC,CAAC;YACjF,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,QAAgB;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,qBAAqB,EAAE,CAAC","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { readFileSync } from \"node:fs\";\nimport type { Server, Socket } from \"node:net\";\nimport { hostname } from \"node:os\";\nimport { TLSSocket, createServer as createTlsServer } from \"node:tls\";\nimport * as log from \"../log.js\";\nimport type { GondolinGatewaySettings } from \"../types.js\";\nimport { gondolinFleet } from \"./gondolin-fleet.js\";\nimport { gondolinJoin } from \"./gondolin-join.js\";\nimport { createSessionFrameParser, encodeSessionMessage } from \"./gondolin-contract.js\";\nimport { GondolinRemoteConnection, GondolinWorkerUnreachableError } from \"./gondolin-remote.js\";\nimport type { SessionClient, SessionClientCallbacks } from \"./gondolin-worker-client.js\";\n\nconst RPC_TIMEOUT_MS = 150_000;\nconst TUNNEL_TIMEOUT_MS = 15_000;\n\n/** What a worker announces when it dials home (mirrors the Go register frame). */\ninterface GondolinWorkerRegistration {\n  name: string;\n  os?: string;\n  arch?: string;\n  accelerator?: string;\n  cpus?: number;\n  memoryBytes?: number;\n  maxRuntimes?: number;\n  protocolVersion?: number;\n  runtimes?: Array<{ sessionId: string; instanceId: string }>;\n  /** Non-empty when the worker's shared workspace failed its usability probe. */\n  workspaceError?: string;\n}\n\ninterface ControlFrame extends GondolinWorkerRegistration {\n  type: string;\n  id?: number;\n  status?: number;\n  body?: unknown;\n  nonce?: string;\n  activeRuntimes?: number;\n  /** join exchange */\n  token?: string;\n  csr?: string;\n}\n\ninterface RegisteredWorker {\n  info: GondolinWorkerRegistration;\n  socket: Socket;\n  connectedAt: number;\n  lastSeen: number;\n  activeRuntimes: number;\n  workspaceError?: string;\n  pendingRpc: Map<\n    number,\n    {\n      resolve: (frame: ControlFrame) => void;\n      reject: (error: Error) => void;\n      timer: NodeJS.Timeout;\n    }\n  >;\n  nextRpcId: number;\n}\n\n/**\n * Splits a byte stream into u32be-length-prefixed JSON frames, preserving any\n * bytes after the point where the consumer stops parsing (a tunnel connection\n * switches protocols after its preamble frame).\n */\nfunction createControlFrameReader(onFrame: (frame: ControlFrame, leftover: Buffer) => void): {\n  push: (chunk: Buffer) => void;\n  stop: () => void;\n} {\n  let buffer = Buffer.alloc(0);\n  let stopped = false;\n  return {\n    push(chunk: Buffer) {\n      if (stopped) return;\n      buffer = Buffer.concat([buffer, chunk]);\n      for (;;) {\n        // onFrame may call stop() synchronously (a tunnel switching protocols)\n        if (stopped || buffer.length < 4) return;\n        const length = buffer.readUInt32BE(0);\n        if (buffer.length < 4 + length) return;\n        const payload = buffer.subarray(4, 4 + length);\n        buffer = buffer.subarray(4 + length);\n        let frame: ControlFrame;\n        try {\n          frame = JSON.parse(payload.toString(\"utf8\")) as ControlFrame;\n        } catch {\n          continue; // skip malformed frames\n        }\n        onFrame(frame, buffer);\n      }\n    },\n    stop() {\n      stopped = true;\n    },\n  };\n}\n\nfunction encodeControlFrame(frame: object): Buffer {\n  return encodeSessionMessage(frame);\n}\n\ninterface GatewayOverrides {\n  /** Server factory (tests substitute a plain net.Server). */\n  createServer?: (onConnection: (socket: Socket) => void) => Server;\n  /** mTLS verification result for a socket (tests substitute outcomes). */\n  isAuthorized?: (socket: Socket) => boolean;\n  leaseTtlSeconds?: number;\n  rpcTimeoutMs?: number;\n  tunnelTimeoutMs?: number;\n}\n\nfunction defaultIsAuthorized(socket: Socket): boolean {\n  return socket instanceof TLSSocket && socket.authorized;\n}\n\n/**\n * The host side of dial-home workers: one mTLS listener that accepts worker\n * control channels (register/ping/RPC responses) and per-command dial-back\n * tunnels, keeps the registry of connected workers, and attaches each one to\n * the fleet as a regular worker connection. Placement, leases, fencing, and\n * failover are unchanged — this only reverses who dials whom.\n */\nclass GondolinWorkerGateway {\n  private settings?: GondolinGatewaySettings;\n  private overrides: GatewayOverrides = {};\n  private server?: Server;\n  private readonly workers = new Map<string, RegisteredWorker>();\n  private readonly pendingTunnels = new Map<\n    string,\n    { resolve: (value: { socket: Socket; leftover: Buffer }) => void; timer: NodeJS.Timeout }\n  >();\n\n  configure(settings?: GondolinGatewaySettings, overrides?: GatewayOverrides): void {\n    this.stop();\n    this.settings = settings;\n    this.overrides = overrides ?? {};\n  }\n\n  isConfigured(): boolean {\n    return this.settings !== undefined;\n  }\n\n  /** Registered workers and their liveness (admin/observability surface). */\n  list(): Array<{\n    name: string;\n    connected: boolean;\n    activeRuntimes: number;\n    workspaceError?: string;\n    info: GondolinWorkerRegistration;\n  }> {\n    return Array.from(this.workers.values()).map((worker) => ({\n      name: worker.info.name,\n      connected: !worker.socket.destroyed,\n      activeRuntimes: worker.activeRuntimes,\n      workspaceError: worker.workspaceError,\n      info: worker.info,\n    }));\n  }\n\n  /**\n   * Start the listener. Without explicit certificate settings the gateway\n   * provisions its own: a private worker CA plus a server certificate signed\n   * by it (required for join's CA pinning to also authenticate the host).\n   */\n  async start(): Promise<void> {\n    if (!this.settings || this.server) return;\n    const settings = this.settings;\n    if (!settings.workspaceRoot) {\n      // dial-home workers inherit workspaceRoot from here; without it every\n      // runtime is rejected with \"escapes the workspace root\"\n      throw new Error(\n        \"gondolin gateway requires workspaceRoot (the worker-side shared workspace path); \" +\n          \"set sandbox.gondolin.remote.gateway.workspaceRoot\",\n      );\n    }\n    let material: { certFile: string; keyFile: string; clientCaFile: string };\n    if (settings.certFile && settings.keyFile && settings.clientCaFile) {\n      material = {\n        certFile: settings.certFile,\n        keyFile: settings.keyFile,\n        clientCaFile: settings.clientCaFile,\n      };\n    } else {\n      if (!gondolinJoin.isConfigured()) {\n        throw new Error(\"gondolin gateway auto-init requires the join service to be configured\");\n      }\n      const issued = await gondolinJoin.ensureServerCert(settings.hostnames ?? [hostname()]);\n      material = { ...issued, clientCaFile: gondolinJoin.paths().caFile };\n    }\n    const factory =\n      this.overrides.createServer ??\n      ((onConnection: (socket: Socket) => void) =>\n        createTlsServer(\n          {\n            cert: readFileSync(material.certFile),\n            key: readFileSync(material.keyFile),\n            ca: readFileSync(material.clientCaFile),\n            requestCert: true,\n            // unauthenticated connections may only send a join frame; the\n            // per-frame authorization gate enforces that below\n            rejectUnauthorized: false,\n            minVersion: \"TLSv1.3\",\n          },\n          onConnection,\n        ));\n    this.server = factory((socket) => this.handleConnection(socket));\n    this.server.listen(this.settings.port, () => {\n      log.logInfo(`Gondolin worker gateway listening on :${this.settings?.port}`);\n    });\n  }\n\n  stop(): void {\n    for (const worker of this.workers.values()) {\n      worker.socket.destroy();\n      this.rejectPendingRpc(worker, \"gateway stopped\");\n    }\n    this.workers.clear();\n    for (const pending of this.pendingTunnels.values()) clearTimeout(pending.timer);\n    this.pendingTunnels.clear();\n    this.server?.close();\n    this.server = undefined;\n  }\n\n  /** Routes one inbound connection by its first frame: control or tunnel. */\n  private handleConnection(socket: Socket): void {\n    socket.setNoDelay(true);\n    socket.setKeepAlive(true, 30_000);\n    let routed = false;\n    const authorized = (this.overrides.isAuthorized ?? defaultIsAuthorized)(socket);\n    const reader = createControlFrameReader((frame, leftover) => {\n      if (!routed) {\n        routed = true;\n        if (frame.type === \"join\") {\n          void this.handleJoin(socket, frame);\n        } else if (!authorized) {\n          // everything except join requires a CA-signed client certificate\n          socket.destroy();\n        } else if (frame.type === \"register\" && frame.name) {\n          this.acceptControlChannel(socket, frame, reader);\n        } else if (frame.type === \"tunnel\" && frame.nonce) {\n          reader.stop();\n          socket.removeAllListeners(\"data\");\n          this.acceptTunnel(socket, frame.nonce, leftover);\n        } else {\n          socket.destroy();\n        }\n        return;\n      }\n      this.handleControlFrame(socket, frame);\n    });\n    socket.on(\"data\", (chunk: Buffer) => reader.push(chunk));\n    socket.on(\"error\", () => socket.destroy());\n  }\n\n  private acceptControlChannel(\n    socket: Socket,\n    registration: ControlFrame,\n    _reader: { stop: () => void },\n  ): void {\n    const name = registration.name as string;\n    const previous = this.workers.get(name);\n    if (previous && !previous.socket.destroyed) {\n      log.logInfo(`Gondolin worker '${name}' re-registered; superseding previous connection`);\n      previous.socket.destroy();\n    }\n    const worker: RegisteredWorker = {\n      info: registration,\n      socket,\n      connectedAt: Date.now(),\n      lastSeen: Date.now(),\n      activeRuntimes: registration.runtimes?.length ?? 0,\n      pendingRpc: new Map(),\n      nextRpcId: 1,\n    };\n    this.workers.set(name, worker);\n    const surviving = registration.runtimes?.length ?? 0;\n    log.logInfo(\n      `Gondolin worker joined: ${name} (${registration.os}/${registration.arch}, ` +\n        `${registration.accelerator}, ${registration.cpus} cpus, ` +\n        `cap ${registration.maxRuntimes ?? \"∞\"}, ${surviving} runtimes surviving)`,\n    );\n\n    const overrides = this.settings?.workers?.[name];\n    gondolinFleet.attachWorker(\n      {\n        name,\n        url: `dialhome://${name}`,\n        workspaceRoot: this.settings?.workspaceRoot,\n        maxRuntimes: overrides?.maxRuntimes ?? registration.maxRuntimes,\n        draining: overrides?.draining,\n      },\n      (connectionOverrides) =>\n        new GondolinRemoteConnection(\n          { name, url: `dialhome://${name}`, workspaceRoot: this.settings?.workspaceRoot },\n          {\n            ...connectionOverrides,\n            ...(this.overrides.leaseTtlSeconds !== undefined\n              ? { leaseTtlSeconds: this.overrides.leaseTtlSeconds }\n              : {}),\n            request: (method, path, body, headers) => this.rpc(name, method, path, body, headers),\n            tunnel: (path, headers, callbacks) => this.openTunnel(name, path, headers, callbacks),\n          },\n        ),\n    );\n    this.applyWorkspaceHealth(worker, registration.workspaceError);\n    // a worker that reconnected may carry runtimes whose placements moved\n    void gondolinFleet.reconcile();\n\n    socket.on(\"close\", () => {\n      this.rejectPendingRpc(worker, `worker '${name}' disconnected`);\n      const current = this.workers.get(name);\n      if (current !== worker) return; // superseded\n      log.logWarning(`Gondolin worker disconnected: ${name} (placements fence until lease expiry)`);\n      gondolinFleet.detachWorker(name);\n      this.workers.delete(name);\n    });\n  }\n\n  private handleControlFrame(socket: Socket, frame: ControlFrame): void {\n    const worker = this.workerBySocket(socket);\n    if (!worker) return;\n    worker.lastSeen = Date.now();\n    if (frame.type === \"ping\") {\n      if (typeof frame.activeRuntimes === \"number\") {\n        worker.activeRuntimes = frame.activeRuntimes;\n      }\n      // omitted on healthy pings (Go omitempty), so absence means recovered\n      this.applyWorkspaceHealth(worker, frame.workspaceError);\n      socket.write(encodeControlFrame({ type: \"pong\" }));\n      return;\n    }\n    if (frame.type === \"response\" && typeof frame.id === \"number\") {\n      const pending = worker.pendingRpc.get(frame.id);\n      if (!pending) return;\n      worker.pendingRpc.delete(frame.id);\n      clearTimeout(pending.timer);\n      pending.resolve(frame);\n    }\n  }\n\n  /**\n   * Track shared-workspace health from register/ping frames and push it into\n   * the fleet, logging only the transitions. A worker whose NFS mount died\n   * keeps its control channel alive — this is what turns that silent state\n   * into refused placements and fail-fast execs.\n   */\n  private applyWorkspaceHealth(worker: RegisteredWorker, error: string | undefined): void {\n    const next = error || undefined;\n    if (next === worker.workspaceError) {\n      gondolinFleet.setWorkspaceHealth(worker.info.name, next); // attach may have reset it\n      return;\n    }\n    if (next) {\n      log.logWarning(\n        `Gondolin worker '${worker.info.name}' workspace is unusable: ${next} — new placements disabled until it recovers`,\n      );\n    } else {\n      log.logInfo(`Gondolin worker '${worker.info.name}' workspace recovered`);\n    }\n    worker.workspaceError = next;\n    gondolinFleet.setWorkspaceHealth(worker.info.name, next);\n  }\n\n  /** RPC to a worker over its control channel (the reverse of HTTPS requests). */\n  private rpc(\n    name: string,\n    method: string,\n    path: string,\n    body?: object,\n    headers?: Record<string, string>,\n  ): Promise<{ status: number; json: Record<string, unknown> }> {\n    const worker = this.workers.get(name);\n    if (!worker || worker.socket.destroyed) {\n      return Promise.reject(\n        new GondolinWorkerUnreachableError(`worker '${name}' is not connected`),\n      );\n    }\n    const id = worker.nextRpcId++;\n    return new Promise((resolve, reject) => {\n      const timer = setTimeout(() => {\n        worker.pendingRpc.delete(id);\n        reject(\n          new GondolinWorkerUnreachableError(\n            `RPC to worker '${name}' timed out (${method} ${path})`,\n          ),\n        );\n      }, this.overrides.rpcTimeoutMs ?? RPC_TIMEOUT_MS);\n      timer.unref?.();\n      worker.pendingRpc.set(id, {\n        timer,\n        reject,\n        resolve: (frame) =>\n          resolve({\n            status: frame.status ?? 0,\n            json: (frame.body ?? {}) as Record<string, unknown>,\n          }),\n      });\n      worker.socket.write(encodeControlFrame({ type: \"request\", id, method, path, body, headers }));\n    });\n  }\n\n  private rejectPendingRpc(worker: RegisteredWorker, reason: string): void {\n    for (const pending of worker.pendingRpc.values()) {\n      clearTimeout(pending.timer);\n      pending.reject(new GondolinWorkerUnreachableError(reason));\n    }\n    worker.pendingRpc.clear();\n  }\n\n  /** Ask the worker to dial back a data connection for one session tunnel. */\n  private openTunnel(\n    name: string,\n    path: string,\n    headers: Record<string, string>,\n    callbacks: SessionClientCallbacks,\n  ): Promise<SessionClient> {\n    const worker = this.workers.get(name);\n    if (!worker || worker.socket.destroyed) {\n      const error = new Error(`worker '${name}' is not connected`) as NodeJS.ErrnoException;\n      error.code = \"ECONNREFUSED\"; // nothing executed — safe to recreate\n      return Promise.reject(error);\n    }\n    const sessionId = path.split(\"/\")[3];\n    const nonce = randomBytes(16).toString(\"hex\");\n    return new Promise((resolve, reject) => {\n      const timer = setTimeout(() => {\n        this.pendingTunnels.delete(nonce);\n        const error = new Error(\n          `worker '${name}' did not dial back a tunnel`,\n        ) as NodeJS.ErrnoException;\n        error.code = \"ECONNREFUSED\";\n        reject(error);\n      }, this.overrides.tunnelTimeoutMs ?? TUNNEL_TIMEOUT_MS);\n      timer.unref?.();\n      this.pendingTunnels.set(nonce, {\n        timer,\n        resolve: ({ socket, leftover }) => {\n          let closed = false;\n          const parse = createSessionFrameParser(callbacks);\n          if (leftover.length > 0) parse(leftover);\n          socket.on(\"data\", parse);\n          socket.on(\"error\", (error: Error) => {\n            if (closed) return;\n            closed = true;\n            callbacks.onClose(error);\n          });\n          socket.on(\"close\", () => {\n            if (closed) return;\n            closed = true;\n            callbacks.onClose();\n          });\n          resolve({\n            send: (message) => {\n              if (!closed) socket.write(encodeSessionMessage(message));\n            },\n            close: () => {\n              if (closed) return;\n              closed = true;\n              socket.destroy();\n            },\n          });\n        },\n      });\n      worker.socket.write(encodeControlFrame({ type: \"open-tunnel\", nonce, sessionId, headers }));\n    });\n  }\n\n  /**\n   * One-time token → CA-signed client certificate. The only operation an\n   * unauthenticated connection may perform; the connection closes after the\n   * response either way.\n   */\n  private async handleJoin(socket: Socket, frame: ControlFrame): Promise<void> {\n    const refuse = (message: string): void => {\n      log.logWarning(`Gondolin worker join refused: ${message}`);\n      socket.end(encodeControlFrame({ type: \"join-error\", message }));\n    };\n    if (!gondolinJoin.isConfigured()) {\n      refuse(\"join is not enabled on this gateway\");\n      return;\n    }\n    if (!frame.token || !frame.csr || !frame.name) {\n      refuse(\"join requires token, csr, and name\");\n      return;\n    }\n    if (!gondolinJoin.consumeToken(frame.token)) {\n      refuse(`invalid or expired join token (worker '${frame.name}')`);\n      return;\n    }\n    try {\n      const signed = await gondolinJoin.signCsr(frame.csr);\n      log.logInfo(`Gondolin worker '${frame.name}' joined: client certificate issued`);\n      socket.end(encodeControlFrame({ type: \"join-ok\", cert: signed.certPem, ca: signed.caPem }));\n    } catch (err) {\n      refuse(`certificate issuance failed: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  private acceptTunnel(socket: Socket, nonce: string, leftover: Buffer): void {\n    const pending = this.pendingTunnels.get(nonce);\n    if (!pending) {\n      socket.destroy();\n      return;\n    }\n    this.pendingTunnels.delete(nonce);\n    clearTimeout(pending.timer);\n    pending.resolve({ socket, leftover: Buffer.from(leftover) });\n  }\n\n  private workerBySocket(socket: Socket): RegisteredWorker | undefined {\n    for (const worker of this.workers.values()) {\n      if (worker.socket === socket) return worker;\n    }\n    return undefined;\n  }\n}\n\nexport const gondolinGateway = new GondolinWorkerGateway();\n"]}