posipaki 0.33.1 → 0.34.0

package/dist/{gateway-BGdUHktZ.js → gateway-BytuRl_6.js}

@@ -1,12 +1,11 @@
-import { t as LIB_VERSION } from "./version-W7guWJeR.js";
+import { t as LIB_VERSION } from "./version-DLA1LhFe.js";
 import { c as isProto, i as json1Channel, t as VERSION } from "./json1-DS3xxg13.js";
 import { mkdtemp, open, rm } from "node:fs/promises";
 import * as readline from "node:readline";
 import { execFile, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { tmpdir } from "node:os";
-import { dirname, extname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join } from "node:path";
 import { createReadStream, createWriteStream } from "node:fs";
 import { promisify } from "node:util";
 //#region src/remote/transports/fifo.ts
@@ -552,12 +551,6 @@ function parseBootstrapReport(stdout) {
 const run = promisify(execFile);
 /** Exit code for "this environment could not be set up". */
 const GATEWAY_FAILED = 1;
-/**
-* Absolute path to the gateway's entry point — the file a client runs as a
-* program.  It is this module's sibling, under whatever name this module has:
-* `gateway-cli.ts` from source, `gateway-cli.js` in a build.
-*/
-const GATEWAY_SCRIPT = join(dirname(fileURLToPath(import.meta.url)), `gateway-cli${extname(fileURLToPath(import.meta.url)) || ".js"}`);
 function errorText(err) {
 	return err instanceof Error ? err.message : String(err);
 }
@@ -736,6 +729,6 @@ async function runGateway(argv = process.argv) {
 	return code;
 }
 //#endregion
-export { fdStreams as C, stderrSink as D, serverChannel as E, FifoUtf8NlineTransport as O, errorReason as S, parseOutputFrame as T, LineTransport as _, runGateway as a, clientChannel as b, KIT_LAYOUT as c, kitVersion as d, makeKit as f, HANDSHAKE_TIMEOUT_MS as g, versionLine as h, gatewayBoot as i, bootstrapScript as l, sha256Hex as m, GATEWAY_SCRIPT as n, DEFAULT_KIT_PARENT as o, parseBootstrapReport as p, gatewayArgs as r, DEFAULT_RUNTIMES as s, GATEWAY_FAILED as t, kitName as u, OutputFilter as v, outputFrame as w, errorFrame as x, StdioWireError as y };
+export { outputFrame as C, FifoUtf8NlineTransport as D, stderrSink as E, fdStreams as S, serverChannel as T, OutputFilter as _, DEFAULT_KIT_PARENT as a, errorFrame as b, bootstrapScript as c, makeKit as d, parseBootstrapReport as f, LineTransport as g, HANDSHAKE_TIMEOUT_MS as h, runGateway as i, kitName as l, versionLine as m, gatewayArgs as n, DEFAULT_RUNTIMES as o, sha256Hex as p, gatewayBoot as r, KIT_LAYOUT as s, GATEWAY_FAILED as t, kitVersion as u, StdioWireError as v, parseOutputFrame as w, errorReason as x, clientChannel as y };
 
-//# sourceMappingURL=gateway-BGdUHktZ.js.map
+//# sourceMappingURL=gateway-BytuRl_6.js.map

package/dist/{gateway-BGdUHktZ.js.map → gateway-BytuRl_6.js.map}

@@ -1 +1 @@
-{"version":3,"file":"gateway-BGdUHktZ.js","names":["errorText","Lines"],"sources":["../src/remote/transports/fifo.ts","../src/remote/stdio.ts","../src/remote/kit.ts","../src/remote/gateway.ts"],"sourcesContent":["// ── FIFO transport ─────────────────────────────────────────────────────────\n//\n// Newline-delimited UTF-8 over named fifos.  Strict handler lifecycle:\n// onMessage() throws if a handler is already set; call removeHandler() first.\n\nimport { open, type FileHandle } from \"node:fs/promises\";\nimport type { ReadStream, WriteStream } from \"node:fs\";\nimport * as readline from \"node:readline\";\nimport type { StringTransport } from \"../channel.js\";\n\nexport class FifoUtf8NlineTransport implements StringTransport {\n  private readFd: FileHandle | null;\n  private writeFd: FileHandle | null;\n  private rl: readline.Interface | null;\n  private rs: ReadStream | null;\n  private ws: WriteStream | null;\n  private pvtOnMessage: ((line: string) => void) | null = null;\n  private pvtOnClose: (() => void) | null = null;\n  private closed = false;\n  private closingPromise: Promise<void> | null = null;\n  private pvtError: Error | null = null;\n\n  private constructor(opts: { readFd?: FileHandle; writeFd?: FileHandle }) {\n    this.readFd = opts.readFd ?? null;\n    this.writeFd = opts.writeFd ?? null;\n\n    if (this.readFd) {\n      this.rs = this.readFd.createReadStream({ encoding: \"utf-8\" });\n      this.rl = readline.createInterface({ input: this.rs });\n\n      this.rl.on(\"line\", (line) => {\n        if (this.pvtOnMessage && !this.closed) this.pvtOnMessage(line);\n      });\n\n      this.rl.on(\"close\", () => {\n        this.pvtOnClose?.();\n        this.close();\n      });\n\n      this.rs.on(\"error\", (err: Error) => {\n        this.pvtError = err;\n        this.close();\n      });\n    } else {\n      this.rs = null;\n      this.rl = null;\n    }\n\n    if (this.writeFd) {\n      this.ws = this.writeFd.createWriteStream({ encoding: \"utf-8\" });\n      this.ws.on(\"error\", (err: Error) => {\n        this.pvtError = err;\n        this.close();\n      });\n    } else {\n      this.ws = null;\n    }\n  }\n\n  // ── factories ──────────────────────────────────────────────────────────\n\n  static openReaderFd(readFd: FileHandle): FifoUtf8NlineTransport {\n    return new FifoUtf8NlineTransport({ readFd });\n  }\n\n  static openWriterFd(writeFd: FileHandle): FifoUtf8NlineTransport {\n    return new FifoUtf8NlineTransport({ writeFd });\n  }\n\n  static fromFds(readFd: FileHandle, writeFd: FileHandle): FifoUtf8NlineTransport {\n    return new FifoUtf8NlineTransport({ readFd, writeFd });\n  }\n\n  // ── bidirectional connection ───────────────────────────────────────────\n\n  /**\n   * Start opening a bidirectional connection.  Opens readPath for reading\n   * in the background, returns a promise.  The caller should do whatever\n   * setup is needed to unblock the read (e.g. spawn a process that opens\n   * readPath for writing), then await the returned transport.\n   *\n   * The transport itself is built only once both directions are open.  A read\n   * stream created while no writer exists on its fifo is handed an immediate\n   * end-of-stream by some runtimes (bun), which closes a channel that has not\n   * carried a byte yet — so the writes side is opened before the reader exists.\n   */\n  static beginConnect(\n    readPath: string,\n    writePath: string,\n  ): { transport: Promise<FifoUtf8NlineTransport> } {\n    const readFdPromise = open(readPath, \"r\");\n\n    const transport = readFdPromise.then(async (readFd) => {\n      const writeFd = await open(writePath, \"w\");\n      return FifoUtf8NlineTransport.fromFds(readFd, writeFd);\n    });\n\n    return { transport };\n  }\n\n  /**\n   * Open a bidirectional connection.  Opens writePath for writing first\n   * (unblocking the peer's read), starts reading readPath in the\n   * background, then awaits both.\n   *\n   * Use this when you are the side that responds to the peer's beginConnect\n   * (i.e. you don't need to interleave any setup between the read and write\n   * opens).  Built like `beginConnect`: the transport exists only after both\n   * directions do.\n   */\n  static async connect(readPath: string, writePath: string): Promise<FifoUtf8NlineTransport> {\n    const readFdPromise = open(readPath, \"r\");\n    const writeFd = await open(writePath, \"w\");\n    const readFd = await readFdPromise;\n    return FifoUtf8NlineTransport.fromFds(readFd, writeFd);\n  }\n\n  // ── public API ─────────────────────────────────────────────────────────\n\n  get canSend(): boolean {\n    return this.writeFd !== null && !this.closed;\n  }\n\n  onMessage(handler: (line: string) => void): void {\n    if (this.closed) throw new Error(\"FifoUtf8NlineTransport: closed\");\n    if (this.readFd === null) throw new Error(\"FifoUtf8NlineTransport: not a reader\");\n    if (this.pvtOnMessage !== null) {\n      throw new Error(\"FifoUtf8NlineTransport: handler already set — call removeHandler() first\");\n    }\n    this.pvtOnMessage = handler;\n  }\n\n  removeHandler(): ((line: string) => void) | null {\n    const prev = this.pvtOnMessage;\n    this.pvtOnMessage = null;\n    return prev;\n  }\n\n  onClose(handler: () => void): void {\n    this.pvtOnClose = handler;\n  }\n\n  get hasHandler(): boolean {\n    return this.pvtOnMessage !== null;\n  }\n\n  get lastError(): Error | null {\n    return this.pvtError;\n  }\n\n  async send(line: string): Promise<void> {\n    if (this.closed) throw new Error(\"FifoUtf8NlineTransport: closed\");\n    if (this.writeFd === null) throw new Error(\"FifoUtf8NlineTransport: not a writer\");\n    if (!line.endsWith(\"\\n\")) line += \"\\n\";\n    await this.ws?.write(line);\n  }\n\n  async close(): Promise<void> {\n    this.closingPromise = this.closingPromise || this.pvtClose();\n    await this.closingPromise;\n    this.closed = true;\n  }\n\n  private async pvtClose(): Promise<void> {\n    // tranfser control back to caller\n    // so they can capture the promise reference\n    // and prevent reentry\n    await Promise.resolve();\n\n    if (this.rl) {\n      this.rl.close();\n      this.rl = null;\n    }\n    if (this.rs) {\n      this.rs.destroy();\n      this.rs = null;\n    }\n    if (this.ws) {\n      await new Promise<void>((resolve) => {\n        try {\n          this.ws?.end(\"\", resolve);\n        } catch {\n          resolve();\n        }\n      });\n      this.ws = null;\n    }\n\n    if (this.readFd) {\n      try {\n        await this.readFd.close();\n      } catch {}\n      this.readFd = null;\n    }\n    if (this.writeFd) {\n      try {\n        await this.writeFd.close();\n      } catch {}\n      this.writeFd = null;\n    }\n  }\n}\n","// ── stdio wire ─────────────────────────────────────────────────────────────\n//\n// A newline-delimited JSON channel over a pair of streams: the one wire every\n// way into a foreign execution context can carry.  Two callers rely on it, and\n// they are two halves of the same thing:\n//\n//   * the client of a spawn we make ourselves, on fds handed to the child (see\n//     `fdStreams`) — private fds, so the child's own stdout stays free;\n//   * a first-stage command on its own stdin/stdout, over ssh, under `sudo`, in\n//     a container — where stdio is the only channel there is.\n//\n// Frames are one JSON object per line.  Whatever the far end prints is carried\n// as an *output frame* (`$fd`), so it can never be mistaken for a frame of the\n// protocol itself; a failed start is carried as an `$error` frame.\n//\n// Why the client filters output frames before handing the transport to the\n// seam: `json1Channel` decodes every line it sees, and the first frame of a\n// session is the peer's `$proto`.  Stripping output frames in the transport\n// keeps the protocol view clean without the seam knowing anything about them.\n\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport * as readline from \"node:readline\";\nimport type { Readable, Writable } from \"node:stream\";\nimport { isProto, type Channel, type StringTransport } from \"./channel.js\";\nimport { VERSION, json1Channel } from \"./protocols/json1.js\";\n\n/** The stream pair a line transport talks over. */\nexport interface LineStreams {\n  read: Readable;\n  write: Writable;\n}\n\n/** A stream of the far end's process: its stdout or its stderr. */\nexport type OutputFd = 1 | 2;\n\n/** Where the far end's own output goes. */\nexport type OutputSink = (fd: OutputFd, data: string) => void;\n\n/** How long to wait for the far end's first protocol frame. */\nexport const HANDSHAKE_TIMEOUT_MS = 15_000;\n\nconst OUTPUT_KEY = \"$fd\";\n\nconst ERROR_KEY = \"$error\";\n\n/** Raised when the wire itself fails: no frame, the wrong protocol, a peer that went away. */\nexport class StdioWireError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"StdioWireError\";\n  }\n}\n\n// ── output frames ──────────────────────────────────────────────────────────\n\n/** One frame of the far end's own output. */\nexport interface OutputFrame {\n  fd: OutputFd;\n  data: string;\n}\n\nexport function outputFrame(fd: OutputFd, data: string): string {\n  return JSON.stringify({ [OUTPUT_KEY]: fd, data });\n}\n\n/** The output frame a line carries, or null when it carries something else. */\nexport function parseOutputFrame(line: string): OutputFrame | null {\n  // Cheap reject first: almost every line of a session is protocol traffic.\n  if (!line.startsWith('{\"$fd\"')) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return null;\n  }\n  if (typeof parsed !== \"object\" || parsed === null) return null;\n  const frame = parsed as Record<string, unknown>;\n  const fd = frame[OUTPUT_KEY];\n  const data = frame.data;\n  if (fd !== 1 && fd !== 2) return null;\n  return { fd, data: typeof data === \"string\" ? data : JSON.stringify(data) };\n}\n\nexport function errorFrame(reason: string): string {\n  return JSON.stringify({ [ERROR_KEY]: reason });\n}\n\n/** The reason an `$error` frame carries, or null when it is not one. */\nexport function errorReason(frame: Record<string, unknown>): string | null {\n  const reason = frame[ERROR_KEY];\n  return typeof reason === \"string\" ? reason : null;\n}\n\n// ── transports ─────────────────────────────────────────────────────────────\n\n/** Is this write error just a peer that already left? */\nfunction peerGone(code: unknown): boolean {\n  return (\n    code === \"EPIPE\" ||\n    code === \"ERR_STREAM_DESTROYED\" ||\n    code === \"ERR_STREAM_WRITE_AFTER_END\" ||\n    code === \"ERR_STREAM_ALREADY_FINISHED\"\n  );\n}\n\nfunction errorText(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\n/**\n * A `StringTransport` over a read/write stream pair, one JSON frame per line.\n *\n * `close()` is idempotent and never throws: teardown races are normal here —\n * the peer exits, the read side ends, and a write arrives a moment later.\n */\nexport class LineTransport implements StringTransport {\n  private readonly streams: LineStreams;\n  private pvtOnMessage: ((line: string) => void) | null = null;\n  private pvtOnClose: (() => void) | null = null;\n  private pvtClosed = false;\n  private pvtClosing: Promise<void> | null = null;\n\n  constructor(streams: LineStreams) {\n    this.streams = streams;\n    const lines = readline.createInterface({ input: streams.read });\n    lines.on(\"line\", (line) => {\n      if (this.pvtOnMessage && !this.pvtClosed) this.pvtOnMessage(line);\n    });\n    lines.on(\"close\", () => {\n      this.pvtOnClose?.();\n      void this.close();\n    });\n    // A stream error is a peer that went away, not a reason to take the process\n    // down with an unhandled 'error' event.\n    streams.read.on(\"error\", () => {\n      void this.close();\n    });\n    streams.write.on(\"error\", () => {\n      void this.close();\n    });\n  }\n\n  get closed(): boolean {\n    return this.pvtClosed;\n  }\n\n  get hasHandler(): boolean {\n    return this.pvtOnMessage !== null;\n  }\n\n  onMessage(handler: (line: string) => void): void {\n    if (this.pvtClosed) throw new StdioWireError(\"stdio transport: closed\");\n    if (this.pvtOnMessage !== null) {\n      throw new StdioWireError(\"stdio transport: handler already set — call removeHandler()\");\n    }\n    this.pvtOnMessage = handler;\n  }\n\n  removeHandler(): ((line: string) => void) | null {\n    const previous = this.pvtOnMessage;\n    this.pvtOnMessage = null;\n    return previous;\n  }\n\n  onClose(handler: () => void): void {\n    this.pvtOnClose = handler;\n  }\n\n  send(frame: string): Promise<void> {\n    if (this.pvtClosed) {\n      return Promise.resolve();\n    }\n    const line = frame.endsWith(\"\\n\") ? frame : `${frame}\\n`;\n    return new Promise<void>((resolve, reject) => {\n      try {\n        this.streams.write.write(line, (err?: Error | null) => {\n          if (!err) return resolve();\n          const code = (err as { code?: unknown }).code;\n          // A peer that has hung up cannot be told anything; the write that\n          // races its exit is not an error in this transport.\n          if (peerGone(code)) {\n            return resolve();\n          }\n          reject(new StdioWireError(`stdio transport: ${err.message}`));\n        });\n      } catch (err) {\n        reject(new StdioWireError(`stdio transport: ${errorText(err)}`));\n      }\n    });\n  }\n\n  async close(): Promise<void> {\n    this.pvtClosing ??= this.pvtClose();\n    await this.pvtClosing;\n  }\n\n  private async pvtClose(): Promise<void> {\n    await Promise.resolve();\n\n    this.pvtClosed = true;\n    // Best effort: a half-open stream (the peer is already gone) must not turn\n    // teardown into an exception.\n    try {\n      this.streams.read.destroy?.();\n    } catch {\n      /* already gone */\n    }\n    try {\n      if (!this.streams.write.writableEnded) this.streams.write.end();\n    } catch {\n      /* already gone */\n    }\n  }\n}\n\n/** Streams over two fds of *our own* process — the child side of an fd wire. */\nexport function fdStreams(readFd: number, writeFd: number): LineStreams {\n  const read = createReadStream(\"\", { fd: readFd, encoding: \"utf-8\", autoClose: false });\n  const write = createWriteStream(\"\", { fd: writeFd, encoding: \"utf-8\", autoClose: false });\n  return { read, write };\n}\n\n/**\n * A transport that lifts output frames out of the stream: everything else is\n * passed through untouched, so the protocol sees frames and only frames.\n */\nexport class OutputFilter implements StringTransport {\n  private readonly inner: StringTransport;\n  private readonly sink: OutputSink;\n\n  constructor(inner: StringTransport, sink: OutputSink) {\n    this.inner = inner;\n    this.sink = sink;\n  }\n\n  send(frame: string): void | Promise<void> {\n    return this.inner.send(frame);\n  }\n\n  onMessage(handler: (frame: string) => void): void {\n    this.inner.onMessage((line) => {\n      const output = parseOutputFrame(line);\n      if (output) this.sink(output.fd, output.data);\n      else handler(line);\n    });\n  }\n\n  removeHandler(): void {\n    this.inner.removeHandler();\n  }\n\n  onClose(handler: () => void): void {\n    this.inner.onClose(handler);\n  }\n\n  close(): Promise<void> {\n    return this.inner.close();\n  }\n}\n\n// ── sinks ──────────────────────────────────────────────────────────────────\n\n/** Write the far end's output to our stderr, tagged with its name. */\nexport function stderrSink(name = \"\"): OutputSink {\n  const tag = name ? `[${name}] ` : \"\";\n  return (fd, data) => {\n    const lead = fd === 1 ? tag : `${tag}err: `;\n    for (const line of data.split(\"\\n\")) {\n      if (line.length > 0) process.stderr.write(`${lead}${line}\\n`);\n    }\n  };\n}\n\n// ── handshakes ─────────────────────────────────────────────────────────────\n\n/** The next frame that arrives, or a timeout. */\nasync function nextFrame(channel: Channel, timeoutMs: number): Promise<Record<string, unknown>> {\n  return await new Promise((resolve, reject) => {\n    const timer = setTimeout(\n      () => reject(new StdioWireError(`no protocol frame within ${timeoutMs}ms`)),\n      timeoutMs,\n    );\n    timer.unref?.();\n    channel.onMessage((frame) => {\n      clearTimeout(timer);\n      resolve(frame);\n    });\n  });\n}\n\nexport interface ClientChannelOptions {\n  /** Where the far end's own output goes.  Defaults to our stderr. */\n  onOutput?: OutputSink;\n  /** How long to wait for the peer's protocol frame.  Defaults to {@link HANDSHAKE_TIMEOUT_MS}. */\n  timeoutMs?: number;\n}\n\n/**\n * The client end of the wire: hand the streams to the seam (minus output\n * frames) and wait for the peer's `$proto`.  A first stage reports a failed\n * start as an `$error` frame instead.\n */\nexport async function clientChannel(\n  streams: LineStreams,\n  opts: ClientChannelOptions = {},\n): Promise<Channel> {\n  const transport = new LineTransport(streams);\n  const channel = json1Channel(new OutputFilter(transport, opts.onOutput ?? stderrSink()));\n  const frame = await nextFrame(channel, opts.timeoutMs ?? HANDSHAKE_TIMEOUT_MS);\n  channel.removeHandler();\n\n  const reason = errorReason(frame);\n  if (reason) throw new StdioWireError(reason);\n  if (!isProto(frame)) {\n    throw new StdioWireError(`unexpected first frame: ${JSON.stringify(frame).slice(0, 120)}`);\n  }\n  if (frame.$proto !== VERSION) {\n    throw new StdioWireError(`unsupported protocol ${String(frame.$proto)}, expected ${VERSION}`);\n  }\n  return channel;\n}\n\n/** The server end of the wire — a payload speaking stdio itself. */\nexport async function serverChannel(streams: LineStreams): Promise<Channel> {\n  const channel = json1Channel(new LineTransport(streams));\n  await channel.send({ $proto: VERSION });\n  return channel;\n}\n","// ── Kit ────────────────────────────────────────────────────────────────────\n//\n// Getting a payload onto a host we know nothing about.  A way in gives us a\n// shell; from there one script runs everywhere: probe what is really there, write\n// the kit only if it is not, and report every step as one machine-readable line.\n// The script always arrives on stdin, never in argv — and since stdin *is* the\n// script, the payload gets its own channel into the same environment (a second\n// `ssh`, an `exec` on a container that is already running).\n//\n// The script assumes POSIX sh and nothing else: `command -v`, `mkdir -p`,\n// `wc -c`, `base64 -d`.  A broken environment therefore reaches the client as a\n// readable reason instead of a channel that just closes.\n//\n// A kit is named after the build that made it and the posipaki it speaks, so two\n// consumers, two builds or two releases cannot land on each other's files.\n\nimport { createHash } from \"node:crypto\";\nimport { LIB_VERSION } from \"../version.js\";\n\n/** Runtimes a kit is happy to be run with, best first.  A caller may override. */\nexport const DEFAULT_RUNTIMES = [\"node\", \"nodejs\", \"bun\"];\n\n/** Layout of a staged kit — the contract's own version, recorded in `version.json`. */\nexport const KIT_LAYOUT = 1;\n\n/** Where kits live on a host, relative to `$HOME`, unless the caller says otherwise. */\nexport const DEFAULT_KIT_PARENT = \"bin/posipaki\";\n\nexport interface KitFile {\n  /** Name inside the kit directory, e.g. `payload.js`. */\n  name: string;\n  /** The file's bytes, base64 — what the script writes. */\n  base64: string;\n  /** Byte count, for the cheap presence check. */\n  bytes: number;\n  /** sha256 of the file, recorded in `version.json`. */\n  sha256: string;\n}\n\n/** Who is staging this kit: the consumer's own name and build version. */\nexport interface KitApp {\n  name: string;\n  version: string;\n}\n\nexport interface Kit {\n  /** Directory name: `<app>-<app version>-posipaki-<posipaki version>-<manifest8>`. */\n  name: string;\n  /** sha256 over the manifest of the kit's own files. */\n  manifestHash: string;\n  /** Everything the kit installs, `version.json` last. */\n  files: KitFile[];\n  /** Runtime candidates, in order; the first one found wins. */\n  runtimes: string[];\n  /** Directory the kit lands in, relative to the host's `$HOME`. */\n  parent: string;\n  /** The consumer this kit belongs to. */\n  app: KitApp;\n}\n\nexport interface MakeKitOptions {\n  /** Required: a kit with no owner cannot be told apart from another's. */\n  app: KitApp;\n  /** Defaults to {@link DEFAULT_RUNTIMES}. */\n  runtimes?: string[];\n  /** Defaults to {@link DEFAULT_KIT_PARENT}. */\n  parent?: string;\n}\n\nexport type BootstrapReport =\n  | { kind: \"ready\"; kitDir: string; runtime: string; staged: boolean }\n  | { kind: \"error\"; reason: string };\n\n/** The part an artifact plays when it names itself. */\nexport type ArtifactRole = \"gateway\" | \"payload\";\n\n/** Hex sha256 of some content. */\nexport function sha256Hex(content: string | Uint8Array): string {\n  return createHash(\"sha256\").update(content).digest(\"hex\");\n}\n\n/** The directory name a kit with these contents, this owner and this posipaki gets. */\nexport function kitName(app: KitApp, manifestHash: string): string {\n  return `${app.name}-${app.version}-posipaki-${LIB_VERSION}-${manifestHash.slice(0, 8)}`;\n}\n\n/**\n * One line naming a staged artifact: what it is, which posipaki it speaks, which\n * kit layout it was built for.  A client that staged it can judge compatibility\n * from this alone — nothing else is claimed.\n */\nexport function versionLine(app: KitApp, role: ArtifactRole, proto: string): string {\n  return `${app.name}-${role} ${app.version} posipaki ${LIB_VERSION} proto ${proto} layout ${KIT_LAYOUT}`;\n}\n\n/** Wrap base64 at a comfortable width; `base64 -d` ignores the newlines. */\nfunction wrapped(base64: string, width = 76): string {\n  const lines: string[] = [];\n  for (let at = 0; at < base64.length; at += width) lines.push(base64.slice(at, at + width));\n  return lines.join(\"\\n\");\n}\n\n/**\n * Describe a kit around its files.  The manifest hash covers the files only, so\n * `version.json` — which records that hash — can be one of them without chasing\n * its own tail.\n */\nexport function makeKit(\n  files: { name: string; content: string | Uint8Array }[],\n  options: MakeKitOptions,\n): Kit {\n  const raw = files.map((file) => ({\n    name: file.name,\n    bytes: Buffer.byteLength(file.content),\n    sha256: sha256Hex(file.content),\n    base64: Buffer.from(file.content).toString(\"base64\"),\n  }));\n  const manifestHash = sha256Hex(raw.map((f) => `${f.name} ${f.sha256} ${f.bytes}`).join(\"\\n\"));\n  const kit: Kit = {\n    name: kitName(options.app, manifestHash),\n    manifestHash,\n    files: raw,\n    runtimes: [...(options.runtimes ?? DEFAULT_RUNTIMES)],\n    parent: options.parent ?? DEFAULT_KIT_PARENT,\n    app: options.app,\n  };\n  const version = Buffer.from(`${JSON.stringify(kitVersion(kit), null, 2)}\\n`);\n  return {\n    ...kit,\n    files: [\n      ...kit.files,\n      {\n        name: \"version.json\",\n        bytes: version.byteLength,\n        sha256: sha256Hex(version),\n        base64: version.toString(\"base64\"),\n      },\n    ],\n  };\n}\n\n/** What `version.json` says: identity, versions, and the exact content hashes. */\nexport function kitVersion(kit: Kit): Record<string, unknown> {\n  return {\n    kit: kit.name,\n    app: kit.app,\n    posipaki: LIB_VERSION,\n    layout: KIT_LAYOUT,\n    manifestHash: kit.manifestHash,\n    files: kit.files.map((file) => ({ name: file.name, sha256: file.sha256, bytes: file.bytes })),\n  };\n}\n\n/** The `[ -f … ] && [ \"$(wc -c < …)\" -eq … ]` test for one file. */\nfunction presentTest(file: KitFile): string {\n  return `[ -f \"$kit_dir/${file.name}\" ] && [ \"$(wc -c < \"$kit_dir/${file.name}\")\" -eq ${file.bytes} ]`;\n}\n\n/** One file: write it to a temp name, then move it into place. */\nfunction writeFile(file: KitFile): string {\n  return [\n    `  base64 -d > \"$tmp\" <<'KIT_FILE'`,\n    wrapped(file.base64),\n    \"KIT_FILE\",\n    `  mv \"$tmp\" \"$kit_dir/${file.name}\" || { echo \"error cannot install ${file.name}\"; exit 73; }`,\n  ].join(\"\\n\");\n}\n\n/**\n * The bootstrap, as one POSIX sh script.\n *\n * Staging is the whole job.  The script always arrives on stdin, never in argv,\n * and that is also why it cannot carry the wire: the caller runs the payload on a\n * second channel into the same environment once this one has reported.\n */\nexport function bootstrapScript(kit: Kit): string {\n  const checks = kit.files.map(presentTest).join(\" && \\\\\\n  \");\n  const lines = [\n    \"# ── kit bootstrap ─────────────────────────────────────────────────────────\",\n    \"# probe, stage what is missing, report every step as one machine-readable line.\",\n    \"set -u\",\n    \"\",\n    'if [ -z \"${HOME:-}\" ]; then echo \"error HOME is not set\"; exit 74; fi',\n    `kit_dir=\"$HOME/${kit.parent}/${kit.name}\"`,\n    \"\",\n    'runtime=\"\"',\n    `for candidate in ${kit.runtimes.join(\" \")}; do`,\n    '  if command -v \"$candidate\" >/dev/null 2>&1; then runtime=\"$(command -v \"$candidate\")\"; break; fi',\n    \"done\",\n    `if [ -z \"$runtime\" ]; then echo \"error no runtime among: ${kit.runtimes.join(\" \")}\"; exit 75; fi`,\n    'if ! command -v base64 >/dev/null 2>&1; then echo \"error base64 is missing\"; exit 76; fi',\n    \"\",\n    `if ${checks}; then`,\n    '  echo \"present\"',\n    \"else\",\n    `  mkdir -p \"$kit_dir\" || { echo \"error cannot create $kit_dir\"; exit 73; }`,\n    '  tmp=\"$kit_dir/.staging.$$\"',\n    ...kit.files.map(writeFile),\n    '  echo \"staged\"',\n    \"fi\",\n    'echo \"kit $kit_dir\"',\n    'echo \"runtime $runtime\"',\n  ];\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\n/** Read the script's report back.  Missing or unknown lines are an error. */\nexport function parseBootstrapReport(stdout: string): BootstrapReport {\n  let kitDir = \"\";\n  let runtime = \"\";\n  let staged: boolean | null = null;\n  for (const raw of stdout.split(\"\\n\")) {\n    const line = raw.trim();\n    if (line === \"\") continue;\n    if (line.startsWith(\"error \")) return { kind: \"error\", reason: line.slice(\"error \".length) };\n    if (line === \"staged\") {\n      staged = true;\n      continue;\n    }\n    if (line === \"present\") {\n      staged = false;\n      continue;\n    }\n    if (line.startsWith(\"kit \")) {\n      kitDir = line.slice(\"kit \".length);\n      continue;\n    }\n    if (line.startsWith(\"runtime \")) {\n      runtime = line.slice(\"runtime \".length);\n      continue;\n    }\n  }\n  if (kitDir === \"\" || runtime === \"\" || staged === null) {\n    const seen = stdout.trim();\n    return {\n      kind: \"error\",\n      reason: seen === \"\" ? \"no report at all\" : `incomplete report: ${seen}`,\n    };\n  }\n  return { kind: \"ready\", kitDir, runtime, staged };\n}\n","// ── Gateway ────────────────────────────────────────────────────────────────\n//\n// The first-stage command.  Run this *inside* a foreign environment — directly,\n// under `sudo`, over ssh, in a container — and it:\n//\n//   1. creates the channel to the payload (fifo paths it makes itself, in a\n//      private temp dir, so they belong to the uid that will open them),\n//   2. starts the payload (`--worker=<script>`, required) and relays frames\n//      between stdin/stdout,\n//   3. carries whatever the payload prints to the client as output frames\n//      (`$fd`), so the payload's own stdout can never be mistaken for protocol.\n//\n// Why a gateway at all: a fifo path created on the client side is useless when the\n// payload runs as another uid (it cannot open it) or on another host (the path is\n// not there).  stdio is the one channel every way into an environment gives us, so\n// the wire is stdio and the fifo stays inside the environment.\n//\n// Directories and processes are cleaned up on every exit path, which is also why\n// the client never sees a transport being closed twice.\n//\n// It imports nothing but node builtins and this package, so the payload behind it\n// can be anything the runtime there can start.\n\nimport { execFile, spawn } from \"node:child_process\";\nimport type { ChildProcess } from \"node:child_process\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, extname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { promisify } from \"node:util\";\nimport type { KitApp } from \"./kit.js\";\nimport { versionLine } from \"./kit.js\";\nimport { VERSION } from \"./protocols/json1.js\";\nimport { errorFrame, outputFrame } from \"./stdio.js\";\nimport type { LineTransport, OutputFd } from \"./stdio.js\";\nimport { LineTransport as Lines } from \"./stdio.js\";\nimport { FifoUtf8NlineTransport } from \"./transports/fifo.js\";\n\nconst run = promisify(execFile);\n\n/** Exit code for \"this environment could not be set up\". */\nexport const GATEWAY_FAILED = 1;\n\n/**\n * Absolute path to the gateway's entry point — the file a client runs as a\n * program.  It is this module's sibling, under whatever name this module has:\n * `gateway-cli.ts` from source, `gateway-cli.js` in a build.\n */\nexport const GATEWAY_SCRIPT = join(\n  dirname(fileURLToPath(import.meta.url)),\n  `gateway-cli${extname(fileURLToPath(import.meta.url)) || \".js\"}`,\n);\n\nexport interface GatewayBoot {\n  /** Who staged this payload.  Names the artifact in its `--version` line. */\n  app: KitApp;\n  /** A label for logs and the tree name; the payload may have its own default. */\n  env: string;\n  /** Forwarded to the payload when given. */\n  poolSize?: number;\n  /** The payload to relay to.  Required — the gateway has no opinion of its own. */\n  worker: string;\n}\n\nfunction errorText(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\nfunction flagValue(argv: string[], name: string): string | undefined {\n  const prefix = `--${name}=`;\n  return argv.find((a) => a.startsWith(prefix))?.slice(prefix.length);\n}\n\n/** A `--flag=<positive integer>` argument, or undefined. */\nfunction positiveInt(value: string | undefined): number | undefined {\n  const n = Number(value);\n  return value !== undefined && Number.isFinite(n) && n >= 1 ? Math.floor(n) : undefined;\n}\n\n/**\n * The argv that boots this gateway — built by the client, read by\n * {@link gatewayBoot}, so the two halves cannot drift apart.\n */\nexport function gatewayArgs(boot: GatewayBoot): string[] {\n  return [\n    `--worker=${boot.worker}`,\n    `--env=${boot.env}`,\n    `--app-name=${boot.app.name}`,\n    `--app-version=${boot.app.version}`,\n    ...(boot.poolSize === undefined ? [] : [`--pool-size=${boot.poolSize}`]),\n  ];\n}\n\n/** The boot a gateway was started with, or the reason it cannot start. */\nexport function gatewayBoot(argv: string[]): GatewayBoot {\n  const worker = flagValue(argv, \"worker\");\n  if (!worker) throw new Error(\"no --worker=<script>: the gateway needs a payload to relay to\");\n  const name = flagValue(argv, \"app-name\");\n  const version = flagValue(argv, \"app-version\");\n  if (!name || !version) {\n    throw new Error(\"no --app-name=<name> and --app-version=<version>: the gateway names its artifact\");\n  }\n  return {\n    app: { name, version },\n    env: flagValue(argv, \"env\") ?? \"unnamed\",\n    poolSize: positiveInt(flagValue(argv, \"pool-size\")),\n    worker,\n  };\n}\n\n/**\n * End a start that failed.  The reason has already gone out on the wire, and\n * returning is not enough: the `open()` on a fifo no payload will ever write sits\n * in the threadpool forever, so the loop never drains and the gateway would linger\n * with a dead payload on its books.\n */\nfunction abandon(): never {\n  process.exit(GATEWAY_FAILED);\n}\n\n/** Carry a failed start to the client, then let the caller exit non-zero. */\nasync function fail(wire: LineTransport, reason: string): Promise<void> {\n  process.stderr.write(`gateway: ${reason}\\n`);\n  try {\n    await wire.send(errorFrame(reason));\n  } catch {\n    /* the client is gone too — the exit code still says what happened */\n  }\n}\n\n/** Copy everything the payload prints onto the wire as output frames. */\nfunction forwardOutput(stream: NodeJS.ReadableStream, wire: LineTransport, fd: OutputFd): void {\n  stream.setEncoding(\"utf-8\");\n  stream.on(\"data\", (chunk: string) => {\n    void wire.send(outputFrame(fd, chunk)).catch(() => {\n      /* the client hung up: the payload's exit is what matters now */\n    });\n  });\n}\n\n/**\n * Serve one environment over stdin/stdout.  Returns the exit code; the caller\n * turns it into `process.exitCode`.\n */\nexport async function runGateway(argv: string[] = process.argv): Promise<number> {\n  if (argv.includes(\"--version\")) {\n    const name = flagValue(argv, \"app-name\") ?? \"posipaki\";\n    const version = flagValue(argv, \"app-version\") ?? \"-\";\n    process.stdout.write(`${versionLine({ name, version }, \"gateway\", VERSION)}\\n`);\n    return 0;\n  }\n  const wire = new Lines({ read: process.stdin, write: process.stdout });\n\n  let booted: GatewayBoot;\n  try {\n    booted = gatewayBoot(argv);\n  } catch (err) {\n    // Nothing has been started yet, so there is nothing to tear down — but the\n    // client still deserves the reason rather than a channel that closes on it,\n    // and the loop can outlive us: an open stdin nobody will close keeps the\n    // process alive, so this is an exit, not a return.\n    await fail(wire, errorText(err));\n    abandon();\n  }\n  const { env, poolSize, worker } = booted;\n\n  const dir = await mkdtemp(join(tmpdir(), `posipaki-${env.replace(/\\//g, \"-\")}-`));\n  const fifoIn = join(dir, \"in\"); // the payload writes, we read\n  const fifoOut = join(dir, \"out\"); // we write, the payload reads\n\n  let child: ChildProcess | null = null;\n  let fifo: FifoUtf8NlineTransport | null = null;\n\n  /**\n   * Everything this gateway owns, undone.  All of it is idempotent, because the\n   * exit path and the signal path can both arrive.\n   */\n  const teardown = async (): Promise<void> => {\n    child?.kill();\n    await fifo?.close().catch(() => {});\n    await rm(dir, { recursive: true, force: true }).catch(() => {});\n  };\n\n  /**\n   * A client that gives up stops us with a signal, and a gateway that died on the\n   * spot would leave its payload behind in the environment — a process holding a\n   * fifo nobody will ever write, which is a leak the environment cannot clean up\n   * for us.  So the signals do what the exit path does.\n   */\n  const onTerminate = () => {\n    void teardown()\n      .catch(() => {})\n      .then(() => process.exit(GATEWAY_FAILED));\n  };\n  for (const signal of [\"SIGTERM\", \"SIGINT\", \"SIGHUP\"] as const) process.on(signal, onTerminate);\n\n  try {\n    await run(\"mkfifo\", [\"-m\", \"600\", fifoIn, fifoOut]);\n  } catch (err) {\n    await fail(wire, `cannot create the environment's fifos: ${errorText(err)}`);\n    await teardown();\n    abandon();\n  }\n\n  // Open the read side in the background, then start the payload that unblocks\n  // it — the order the fifo handshake requires.\n  const connection = FifoUtf8NlineTransport.beginConnect(fifoIn, fifoOut);\n  const workerArgs = [\n    worker,\n    `--env=${env}`,\n    ...(poolSize === undefined ? [] : [`--pool-size=${poolSize}`]),\n    `--fifo-in=${fifoIn}`,\n    `--fifo-out=${fifoOut}`,\n  ];\n  const workerProc = spawn(process.execPath, workerArgs, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  child = workerProc;\n  forwardOutput(workerProc.stdout, wire, 1);\n  forwardOutput(workerProc.stderr, wire, 2);\n\n  const exited = new Promise<number>((settle) => {\n    // A payload killed by a signal (the client hung up, and we killed it) has no\n    // code — for us that is a clean end, not a failure.\n    workerProc.once(\"exit\", (code) => settle(code ?? 0));\n  });\n\n  try {\n    fifo = await Promise.race([\n      connection.transport,\n      exited.then((code) => {\n        throw new Error(`the payload exited with code ${code} before it opened its channel`);\n      }),\n    ]);\n  } catch (err) {\n    await fail(wire, errorText(err));\n    await teardown();\n    abandon();\n  }\n\n  // Relay: the protocol is the client's and the payload's business, not ours.\n  const relay = fifo;\n  relay.onMessage((line) => {\n    void wire.send(line).catch(() => {\n      /* client gone */\n    });\n  });\n  wire.onMessage((line) => {\n    void relay.send(line).catch(() => {\n      /* the payload is gone; its exit path cleans up */\n    });\n  });\n  wire.onClose(() => {\n    child?.kill();\n  });\n\n  const code = await exited;\n  await teardown();\n  await wire.close();\n  return code;\n}\n"],"mappings":";;;;;;;;;;;;AAUA,IAAa,yBAAb,MAAa,uBAAkD;CAY7D,YAAoB,MAAqD;EANjB,KAAA,eAAA;EACd,KAAA,aAAA;EACzB,KAAA,SAAA;EAC8B,KAAA,iBAAA;EACd,KAAA,WAAA;EAG/B,KAAK,SAAS,KAAK,UAAU;EAC7B,KAAK,UAAU,KAAK,WAAW;EAE/B,IAAI,KAAK,QAAQ;GACf,KAAK,KAAK,KAAK,OAAO,iBAAiB,EAAE,UAAU,QAAQ,CAAC;GAC5D,KAAK,KAAK,SAAS,gBAAgB,EAAE,OAAO,KAAK,GAAG,CAAC;GAErD,KAAK,GAAG,GAAG,SAAS,SAAS;IAC3B,IAAI,KAAK,gBAAgB,CAAC,KAAK,QAAQ,KAAK,aAAa,IAAI;GAC/D,CAAC;GAED,KAAK,GAAG,GAAG,eAAe;IACxB,KAAK,aAAa;IAClB,KAAK,MAAM;GACb,CAAC;GAED,KAAK,GAAG,GAAG,UAAU,QAAe;IAClC,KAAK,WAAW;IAChB,KAAK,MAAM;GACb,CAAC;EACH,OAAO;GACL,KAAK,KAAK;GACV,KAAK,KAAK;EACZ;EAEA,IAAI,KAAK,SAAS;GAChB,KAAK,KAAK,KAAK,QAAQ,kBAAkB,EAAE,UAAU,QAAQ,CAAC;GAC9D,KAAK,GAAG,GAAG,UAAU,QAAe;IAClC,KAAK,WAAW;IAChB,KAAK,MAAM;GACb,CAAC;EACH,OACE,KAAK,KAAK;CAEd;CAIA,OAAO,aAAa,QAA4C;EAC9D,OAAO,IAAI,uBAAuB,EAAE,OAAO,CAAC;CAC9C;CAEA,OAAO,aAAa,SAA6C;EAC/D,OAAO,IAAI,uBAAuB,EAAE,QAAQ,CAAC;CAC/C;CAEA,OAAO,QAAQ,QAAoB,SAA6C;EAC9E,OAAO,IAAI,uBAAuB;GAAE;GAAQ;EAAQ,CAAC;CACvD;;;;;;;;;;;;CAeA,OAAO,aACL,UACA,WACgD;EAQhD,OAAO,EAAE,WAPa,KAAK,UAAU,GAEP,CAAC,CAAC,KAAK,OAAO,WAAW;GACrD,MAAM,UAAU,MAAM,KAAK,WAAW,GAAG;GACzC,OAAO,uBAAuB,QAAQ,QAAQ,OAAO;EACvD,CAEiB,EAAE;CACrB;;;;;;;;;;;CAYA,aAAa,QAAQ,UAAkB,WAAoD;EACzF,MAAM,gBAAgB,KAAK,UAAU,GAAG;EACxC,MAAM,UAAU,MAAM,KAAK,WAAW,GAAG;EACzC,MAAM,SAAS,MAAM;EACrB,OAAO,uBAAuB,QAAQ,QAAQ,OAAO;CACvD;CAIA,IAAI,UAAmB;EACrB,OAAO,KAAK,YAAY,QAAQ,CAAC,KAAK;CACxC;CAEA,UAAU,SAAuC;EAC/C,IAAI,KAAK,QAAQ,MAAM,IAAI,MAAM,gCAAgC;EACjE,IAAI,KAAK,WAAW,MAAM,MAAM,IAAI,MAAM,sCAAsC;EAChF,IAAI,KAAK,iBAAiB,MACxB,MAAM,IAAI,MAAM,0EAA0E;EAE5F,KAAK,eAAe;CACtB;CAEA,gBAAiD;EAC/C,MAAM,OAAO,KAAK;EAClB,KAAK,eAAe;EACpB,OAAO;CACT;CAEA,QAAQ,SAA2B;EACjC,KAAK,aAAa;CACpB;CAEA,IAAI,aAAsB;EACxB,OAAO,KAAK,iBAAiB;CAC/B;CAEA,IAAI,YAA0B;EAC5B,OAAO,KAAK;CACd;CAEA,MAAM,KAAK,MAA6B;EACtC,IAAI,KAAK,QAAQ,MAAM,IAAI,MAAM,gCAAgC;EACjE,IAAI,KAAK,YAAY,MAAM,MAAM,IAAI,MAAM,sCAAsC;EACjF,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,QAAQ;EAClC,MAAM,KAAK,IAAI,MAAM,IAAI;CAC3B;CAEA,MAAM,QAAuB;EAC3B,KAAK,iBAAiB,KAAK,kBAAkB,KAAK,SAAS;EAC3D,MAAM,KAAK;EACX,KAAK,SAAS;CAChB;CAEA,MAAc,WAA0B;EAItC,MAAM,QAAQ,QAAQ;EAEtB,IAAI,KAAK,IAAI;GACX,KAAK,GAAG,MAAM;GACd,KAAK,KAAK;EACZ;EACA,IAAI,KAAK,IAAI;GACX,KAAK,GAAG,QAAQ;GAChB,KAAK,KAAK;EACZ;EACA,IAAI,KAAK,IAAI;GACX,MAAM,IAAI,SAAe,YAAY;IACnC,IAAI;KACF,KAAK,IAAI,IAAI,IAAI,OAAO;IAC1B,QAAQ;KACN,QAAQ;IACV;GACF,CAAC;GACD,KAAK,KAAK;EACZ;EAEA,IAAI,KAAK,QAAQ;GACf,IAAI;IACF,MAAM,KAAK,OAAO,MAAM;GAC1B,QAAQ,CAAC;GACT,KAAK,SAAS;EAChB;EACA,IAAI,KAAK,SAAS;GAChB,IAAI;IACF,MAAM,KAAK,QAAQ,MAAM;GAC3B,QAAQ,CAAC;GACT,KAAK,UAAU;EACjB;CACF;AACF;;;;AClKA,MAAa,uBAAuB;AAEpC,MAAM,aAAa;AAEnB,MAAM,YAAY;;AAGlB,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAUA,SAAgB,YAAY,IAAc,MAAsB;CAC9D,OAAO,KAAK,UAAU;GAAG,aAAa;EAAI;CAAK,CAAC;AAClD;;AAGA,SAAgB,iBAAiB,MAAkC;CAEjE,IAAI,CAAC,KAAK,WAAW,UAAQ,GAAG,OAAO;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,OAAO;CAC1D,MAAM,QAAQ;CACd,MAAM,KAAK,MAAM;CACjB,MAAM,OAAO,MAAM;CACnB,IAAI,OAAO,KAAK,OAAO,GAAG,OAAO;CACjC,OAAO;EAAE;EAAI,MAAM,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;CAAE;AAC5E;AAEA,SAAgB,WAAW,QAAwB;CACjD,OAAO,KAAK,UAAU,GAAG,YAAY,OAAO,CAAC;AAC/C;;AAGA,SAAgB,YAAY,OAA+C;CACzE,MAAM,SAAS,MAAM;CACrB,OAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;;AAKA,SAAS,SAAS,MAAwB;CACxC,OACE,SAAS,WACT,SAAS,0BACT,SAAS,gCACT,SAAS;AAEb;AAEA,SAASA,YAAU,KAAsB;CACvC,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;;;;;AAQA,IAAa,gBAAb,MAAsD;CAOpD,YAAY,SAAsB;EALsB,KAAA,eAAA;EACd,KAAA,aAAA;EACtB,KAAA,YAAA;EACuB,KAAA,aAAA;EAGzC,KAAK,UAAU;EACf,MAAM,QAAQ,SAAS,gBAAgB,EAAE,OAAO,QAAQ,KAAK,CAAC;EAC9D,MAAM,GAAG,SAAS,SAAS;GACzB,IAAI,KAAK,gBAAgB,CAAC,KAAK,WAAW,KAAK,aAAa,IAAI;EAClE,CAAC;EACD,MAAM,GAAG,eAAe;GACtB,KAAK,aAAa;GAClB,KAAU,MAAM;EAClB,CAAC;EAGD,QAAQ,KAAK,GAAG,eAAe;GAC7B,KAAU,MAAM;EAClB,CAAC;EACD,QAAQ,MAAM,GAAG,eAAe;GAC9B,KAAU,MAAM;EAClB,CAAC;CACH;CAEA,IAAI,SAAkB;EACpB,OAAO,KAAK;CACd;CAEA,IAAI,aAAsB;EACxB,OAAO,KAAK,iBAAiB;CAC/B;CAEA,UAAU,SAAuC;EAC/C,IAAI,KAAK,WAAW,MAAM,IAAI,eAAe,yBAAyB;EACtE,IAAI,KAAK,iBAAiB,MACxB,MAAM,IAAI,eAAe,6DAA6D;EAExF,KAAK,eAAe;CACtB;CAEA,gBAAiD;EAC/C,MAAM,WAAW,KAAK;EACtB,KAAK,eAAe;EACpB,OAAO;CACT;CAEA,QAAQ,SAA2B;EACjC,KAAK,aAAa;CACpB;CAEA,KAAK,OAA8B;EACjC,IAAI,KAAK,WACP,OAAO,QAAQ,QAAQ;EAEzB,MAAM,OAAO,MAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,MAAM;EACrD,OAAO,IAAI,SAAe,SAAS,WAAW;GAC5C,IAAI;IACF,KAAK,QAAQ,MAAM,MAAM,OAAO,QAAuB;KACrD,IAAI,CAAC,KAAK,OAAO,QAAQ;KACzB,MAAM,OAAQ,IAA2B;KAGzC,IAAI,SAAS,IAAI,GACf,OAAO,QAAQ;KAEjB,OAAO,IAAI,eAAe,oBAAoB,IAAI,SAAS,CAAC;IAC9D,CAAC;GACH,SAAS,KAAK;IACZ,OAAO,IAAI,eAAe,oBAAoBA,YAAU,GAAG,GAAG,CAAC;GACjE;EACF,CAAC;CACH;CAEA,MAAM,QAAuB;EAC3B,KAAK,eAAe,KAAK,SAAS;EAClC,MAAM,KAAK;CACb;CAEA,MAAc,WAA0B;EACtC,MAAM,QAAQ,QAAQ;EAEtB,KAAK,YAAY;EAGjB,IAAI;GACF,KAAK,QAAQ,KAAK,UAAU;EAC9B,QAAQ,CAER;EACA,IAAI;GACF,IAAI,CAAC,KAAK,QAAQ,MAAM,eAAe,KAAK,QAAQ,MAAM,IAAI;EAChE,QAAQ,CAER;CACF;AACF;;AAGA,SAAgB,UAAU,QAAgB,SAA8B;CAGtE,OAAO;EAAE,MAFI,iBAAiB,IAAI;GAAE,IAAI;GAAQ,UAAU;GAAS,WAAW;EAAM,CAExE;EAAG,OADD,kBAAkB,IAAI;GAAE,IAAI;GAAS,UAAU;GAAS,WAAW;EAAM,CACpE;CAAE;AACvB;;;;;AAMA,IAAa,eAAb,MAAqD;CAInD,YAAY,OAAwB,MAAkB;EACpD,KAAK,QAAQ;EACb,KAAK,OAAO;CACd;CAEA,KAAK,OAAqC;EACxC,OAAO,KAAK,MAAM,KAAK,KAAK;CAC9B;CAEA,UAAU,SAAwC;EAChD,KAAK,MAAM,WAAW,SAAS;GAC7B,MAAM,SAAS,iBAAiB,IAAI;GACpC,IAAI,QAAQ,KAAK,KAAK,OAAO,IAAI,OAAO,IAAI;QACvC,QAAQ,IAAI;EACnB,CAAC;CACH;CAEA,gBAAsB;EACpB,KAAK,MAAM,cAAc;CAC3B;CAEA,QAAQ,SAA2B;EACjC,KAAK,MAAM,QAAQ,OAAO;CAC5B;CAEA,QAAuB;EACrB,OAAO,KAAK,MAAM,MAAM;CAC1B;AACF;;AAKA,SAAgB,WAAW,OAAO,IAAgB;CAChD,MAAM,MAAM,OAAO,IAAI,KAAK,MAAM;CAClC,QAAQ,IAAI,SAAS;EACnB,MAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI;EACrC,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAChC,IAAI,KAAK,SAAS,GAAG,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,GAAG;CAEhE;AACF;;AAKA,eAAe,UAAU,SAAkB,WAAqD;CAC9F,OAAO,MAAM,IAAI,SAAS,SAAS,WAAW;EAC5C,MAAM,QAAQ,iBACN,OAAO,IAAI,eAAe,4BAA4B,UAAU,GAAG,CAAC,GAC1E,SACF;EACA,MAAM,QAAQ;EACd,QAAQ,WAAW,UAAU;GAC3B,aAAa,KAAK;GAClB,QAAQ,KAAK;EACf,CAAC;CACH,CAAC;AACH;;;;;;AAcA,eAAsB,cACpB,SACA,OAA6B,CAAC,GACZ;CAClB,MAAM,YAAY,IAAI,cAAc,OAAO;CAC3C,MAAM,UAAU,aAAa,IAAI,aAAa,WAAW,KAAK,YAAY,WAAW,CAAC,CAAC;CACvF,MAAM,QAAQ,MAAM,UAAU,SAAS,KAAK,aAAA,IAAiC;CAC7E,QAAQ,cAAc;CAEtB,MAAM,SAAS,YAAY,KAAK;CAChC,IAAI,QAAQ,MAAM,IAAI,eAAe,MAAM;CAC3C,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,eAAe,2BAA2B,KAAK,UAAU,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG;CAE3F,IAAI,MAAM,WAAA,WACR,MAAM,IAAI,eAAe,wBAAwB,OAAO,MAAM,MAAM,EAAE,aAAa,SAAS;CAE9F,OAAO;AACT;;AAGA,eAAsB,cAAc,SAAwC;CAC1E,MAAM,UAAU,aAAa,IAAI,cAAc,OAAO,CAAC;CACvD,MAAM,QAAQ,KAAK,EAAE,QAAQ,QAAQ,CAAC;CACtC,OAAO;AACT;;;;ACnTA,MAAa,mBAAmB;CAAC;CAAQ;CAAU;AAAK;;AAGxD,MAAa,aAAa;;AAG1B,MAAa,qBAAqB;;AAmDlC,SAAgB,UAAU,SAAsC;CAC9D,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;AAC1D;;AAGA,SAAgB,QAAQ,KAAa,cAA8B;CACjE,OAAO,GAAG,IAAI,KAAK,GAAG,IAAI,QAAQ,YAAY,YAAY,GAAG,aAAa,MAAM,GAAG,CAAC;AACtF;;;;;;AAOA,SAAgB,YAAY,KAAa,MAAoB,OAAuB;CAClF,OAAO,GAAG,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,QAAQ,YAAY,YAAY,SAAS,MAAM;AACnF;;AAGA,SAAS,QAAQ,QAAgB,QAAQ,IAAY;CACnD,MAAM,QAAkB,CAAC;CACzB,KAAK,IAAI,KAAK,GAAG,KAAK,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC;CACzF,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;AAOA,SAAgB,QACd,OACA,SACK;CACL,MAAM,MAAM,MAAM,KAAK,UAAU;EAC/B,MAAM,KAAK;EACX,OAAO,OAAO,WAAW,KAAK,OAAO;EACrC,QAAQ,UAAU,KAAK,OAAO;EAC9B,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,SAAS,QAAQ;CACrD,EAAE;CACF,MAAM,eAAe,UAAU,IAAI,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;CAC5F,MAAM,MAAW;EACf,MAAM,QAAQ,QAAQ,KAAK,YAAY;EACvC;EACA,OAAO;EACP,UAAU,CAAC,GAAI,QAAQ,YAAY,gBAAiB;EACpD,QAAQ,QAAQ,UAAA;EAChB,KAAK,QAAQ;CACf;CACA,MAAM,UAAU,OAAO,KAAK,GAAG,KAAK,UAAU,WAAW,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG;CAC3E,OAAO;EACL,GAAG;EACH,OAAO,CACL,GAAG,IAAI,OACP;GACE,MAAM;GACN,OAAO,QAAQ;GACf,QAAQ,UAAU,OAAO;GACzB,QAAQ,QAAQ,SAAS,QAAQ;EACnC,CACF;CACF;AACF;;AAGA,SAAgB,WAAW,KAAmC;CAC5D,OAAO;EACL,KAAK,IAAI;EACT,KAAK,IAAI;EACT,UAAU;EACV,QAAA;EACA,cAAc,IAAI;EAClB,OAAO,IAAI,MAAM,KAAK,UAAU;GAAE,MAAM,KAAK;GAAM,QAAQ,KAAK;GAAQ,OAAO,KAAK;EAAM,EAAE;CAC9F;AACF;;AAGA,SAAS,YAAY,MAAuB;CAC1C,OAAO,kBAAkB,KAAK,KAAK,gCAAgC,KAAK,KAAK,UAAU,KAAK,MAAM;AACpG;;AAGA,SAAS,UAAU,MAAuB;CACxC,OAAO;EACL;EACA,QAAQ,KAAK,MAAM;EACnB;EACA,yBAAyB,KAAK,KAAK,oCAAoC,KAAK,KAAK;CACnF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;;;AASA,SAAgB,gBAAgB,KAAkB;CAChD,MAAM,SAAS,IAAI,MAAM,IAAI,WAAW,CAAC,CAAC,KAAK,YAAY;CA2B3D,OAAO,GAAG;EAzBR;EACA;EACA;EACA;EACA;EACA,kBAAkB,IAAI,OAAO,GAAG,IAAI,KAAK;EACzC;EACA;EACA,oBAAoB,IAAI,SAAS,KAAK,GAAG,EAAE;EAC3C;EACA;EACA,4DAA4D,IAAI,SAAS,KAAK,GAAG,EAAE;EACnF;EACA;EACA,MAAM,OAAO;EACb;EACA;EACA;EACA;EACA,GAAG,IAAI,MAAM,IAAI,SAAS;EAC1B;EACA;EACA;EACA;CAEY,CAAC,CAAC,KAAK,IAAI,EAAE;AAC7B;;AAGA,SAAgB,qBAAqB,QAAiC;CACpE,IAAI,SAAS;CACb,IAAI,UAAU;CACd,IAAI,SAAyB;CAC7B,KAAK,MAAM,OAAO,OAAO,MAAM,IAAI,GAAG;EACpC,MAAM,OAAO,IAAI,KAAK;EACtB,IAAI,SAAS,IAAI;EACjB,IAAI,KAAK,WAAW,QAAQ,GAAG,OAAO;GAAE,MAAM;GAAS,QAAQ,KAAK,MAAM,CAAe;EAAE;EAC3F,IAAI,SAAS,UAAU;GACrB,SAAS;GACT;EACF;EACA,IAAI,SAAS,WAAW;GACtB,SAAS;GACT;EACF;EACA,IAAI,KAAK,WAAW,MAAM,GAAG;GAC3B,SAAS,KAAK,MAAM,CAAa;GACjC;EACF;EACA,IAAI,KAAK,WAAW,UAAU,GAAG;GAC/B,UAAU,KAAK,MAAM,CAAiB;GACtC;EACF;CACF;CACA,IAAI,WAAW,MAAM,YAAY,MAAM,WAAW,MAAM;EACtD,MAAM,OAAO,OAAO,KAAK;EACzB,OAAO;GACL,MAAM;GACN,QAAQ,SAAS,KAAK,qBAAqB,sBAAsB;EACnE;CACF;CACA,OAAO;EAAE,MAAM;EAAS;EAAQ;EAAS;CAAO;AAClD;;;AC1MA,MAAM,MAAM,UAAU,QAAQ;;AAG9B,MAAa,iBAAiB;;;;;;AAO9B,MAAa,iBAAiB,KAC5B,QAAQ,cAAc,YAAY,GAAG,CAAC,GACtC,cAAc,QAAQ,cAAc,YAAY,GAAG,CAAC,KAAK,OAC3D;AAaA,SAAS,UAAU,KAAsB;CACvC,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,UAAU,MAAgB,MAAkC;CACnE,MAAM,SAAS,KAAK,KAAK;CACzB,OAAO,KAAK,MAAM,MAAM,EAAE,WAAW,MAAM,CAAC,CAAC,EAAE,MAAM,OAAO,MAAM;AACpE;;AAGA,SAAS,YAAY,OAA+C;CAClE,MAAM,IAAI,OAAO,KAAK;CACtB,OAAO,UAAU,KAAA,KAAa,OAAO,SAAS,CAAC,KAAK,KAAK,IAAI,KAAK,MAAM,CAAC,IAAI,KAAA;AAC/E;;;;;AAMA,SAAgB,YAAY,MAA6B;CACvD,OAAO;EACL,YAAY,KAAK;EACjB,SAAS,KAAK;EACd,cAAc,KAAK,IAAI;EACvB,iBAAiB,KAAK,IAAI;EAC1B,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU;CACxE;AACF;;AAGA,SAAgB,YAAY,MAA6B;CACvD,MAAM,SAAS,UAAU,MAAM,QAAQ;CACvC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,+DAA+D;CAC5F,MAAM,OAAO,UAAU,MAAM,UAAU;CACvC,MAAM,UAAU,UAAU,MAAM,aAAa;CAC7C,IAAI,CAAC,QAAQ,CAAC,SACZ,MAAM,IAAI,MAAM,kFAAkF;CAEpG,OAAO;EACL,KAAK;GAAE;GAAM;EAAQ;EACrB,KAAK,UAAU,MAAM,KAAK,KAAK;EAC/B,UAAU,YAAY,UAAU,MAAM,WAAW,CAAC;EAClD;CACF;AACF;;;;;;;AAQA,SAAS,UAAiB;CACxB,QAAQ,KAAA,CAAmB;AAC7B;;AAGA,eAAe,KAAK,MAAqB,QAA+B;CACtE,QAAQ,OAAO,MAAM,YAAY,OAAO,GAAG;CAC3C,IAAI;EACF,MAAM,KAAK,KAAK,WAAW,MAAM,CAAC;CACpC,QAAQ,CAER;AACF;;AAGA,SAAS,cAAc,QAA+B,MAAqB,IAAoB;CAC7F,OAAO,YAAY,OAAO;CAC1B,OAAO,GAAG,SAAS,UAAkB;EACnC,KAAU,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,CAEnD,CAAC;CACH,CAAC;AACH;;;;;AAMA,eAAsB,WAAW,OAAiB,QAAQ,MAAuB;CAC/E,IAAI,KAAK,SAAS,WAAW,GAAG;EAC9B,MAAM,OAAO,UAAU,MAAM,UAAU,KAAK;EAC5C,MAAM,UAAU,UAAU,MAAM,aAAa,KAAK;EAClD,QAAQ,OAAO,MAAM,GAAG,YAAY;GAAE;GAAM;EAAQ,GAAG,WAAW,OAAO,EAAE,GAAG;EAC9E,OAAO;CACT;CACA,MAAM,OAAO,IAAIC,cAAM;EAAE,MAAM,QAAQ;EAAO,OAAO,QAAQ;CAAO,CAAC;CAErE,IAAI;CACJ,IAAI;EACF,SAAS,YAAY,IAAI;CAC3B,SAAS,KAAK;EAKZ,MAAM,KAAK,MAAM,UAAU,GAAG,CAAC;EAC/B,QAAQ;CACV;CACA,MAAM,EAAE,KAAK,UAAU,WAAW;CAElC,MAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,GAAG,YAAY,IAAI,QAAQ,OAAO,GAAG,EAAE,EAAE,CAAC;CAChF,MAAM,SAAS,KAAK,KAAK,IAAI;CAC7B,MAAM,UAAU,KAAK,KAAK,KAAK;CAE/B,IAAI,QAA6B;CACjC,IAAI,OAAsC;;;;;CAM1C,MAAM,WAAW,YAA2B;EAC1C,OAAO,KAAK;EACZ,MAAM,MAAM,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAClC,MAAM,GAAG,KAAK;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAChE;;;;;;;CAQA,MAAM,oBAAoB;EACxB,SAAc,CAAC,CACZ,YAAY,CAAC,CAAC,CAAC,CACf,WAAW,QAAQ,KAAA,CAAmB,CAAC;CAC5C;CACA,KAAK,MAAM,UAAU;EAAC;EAAW;EAAU;CAAQ,GAAY,QAAQ,GAAG,QAAQ,WAAW;CAE7F,IAAI;EACF,MAAM,IAAI,UAAU;GAAC;GAAM;GAAO;GAAQ;EAAO,CAAC;CACpD,SAAS,KAAK;EACZ,MAAM,KAAK,MAAM,0CAA0C,UAAU,GAAG,GAAG;EAC3E,MAAM,SAAS;EACf,QAAQ;CACV;CAIA,MAAM,aAAa,uBAAuB,aAAa,QAAQ,OAAO;CACtE,MAAM,aAAa;EACjB;EACA,SAAS;EACT,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,eAAe,UAAU;EAC5D,aAAa;EACb,cAAc;CAChB;CACA,MAAM,aAAa,MAAM,QAAQ,UAAU,YAAY,EAAE,OAAO;EAAC;EAAU;EAAQ;CAAM,EAAE,CAAC;CAC5F,QAAQ;CACR,cAAc,WAAW,QAAQ,MAAM,CAAC;CACxC,cAAc,WAAW,QAAQ,MAAM,CAAC;CAExC,MAAM,SAAS,IAAI,SAAiB,WAAW;EAG7C,WAAW,KAAK,SAAS,SAAS,OAAO,QAAQ,CAAC,CAAC;CACrD,CAAC;CAED,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,WAAW,WACX,OAAO,MAAM,SAAS;GACpB,MAAM,IAAI,MAAM,gCAAgC,KAAK,8BAA8B;EACrF,CAAC,CACH,CAAC;CACH,SAAS,KAAK;EACZ,MAAM,KAAK,MAAM,UAAU,GAAG,CAAC;EAC/B,MAAM,SAAS;EACf,QAAQ;CACV;CAGA,MAAM,QAAQ;CACd,MAAM,WAAW,SAAS;EACxB,KAAU,KAAK,IAAI,CAAC,CAAC,YAAY,CAEjC,CAAC;CACH,CAAC;CACD,KAAK,WAAW,SAAS;EACvB,MAAW,KAAK,IAAI,CAAC,CAAC,YAAY,CAElC,CAAC;CACH,CAAC;CACD,KAAK,cAAc;EACjB,OAAO,KAAK;CACd,CAAC;CAED,MAAM,OAAO,MAAM;CACnB,MAAM,SAAS;CACf,MAAM,KAAK,MAAM;CACjB,OAAO;AACT"}
+{"version":3,"file":"gateway-BytuRl_6.js","names":["errorText","Lines"],"sources":["../src/remote/transports/fifo.ts","../src/remote/stdio.ts","../src/remote/kit.ts","../src/remote/gateway.ts"],"sourcesContent":["// ── FIFO transport ─────────────────────────────────────────────────────────\n//\n// Newline-delimited UTF-8 over named fifos.  Strict handler lifecycle:\n// onMessage() throws if a handler is already set; call removeHandler() first.\n\nimport { open, type FileHandle } from \"node:fs/promises\";\nimport type { ReadStream, WriteStream } from \"node:fs\";\nimport * as readline from \"node:readline\";\nimport type { StringTransport } from \"../channel.js\";\n\nexport class FifoUtf8NlineTransport implements StringTransport {\n  private readFd: FileHandle | null;\n  private writeFd: FileHandle | null;\n  private rl: readline.Interface | null;\n  private rs: ReadStream | null;\n  private ws: WriteStream | null;\n  private pvtOnMessage: ((line: string) => void) | null = null;\n  private pvtOnClose: (() => void) | null = null;\n  private closed = false;\n  private closingPromise: Promise<void> | null = null;\n  private pvtError: Error | null = null;\n\n  private constructor(opts: { readFd?: FileHandle; writeFd?: FileHandle }) {\n    this.readFd = opts.readFd ?? null;\n    this.writeFd = opts.writeFd ?? null;\n\n    if (this.readFd) {\n      this.rs = this.readFd.createReadStream({ encoding: \"utf-8\" });\n      this.rl = readline.createInterface({ input: this.rs });\n\n      this.rl.on(\"line\", (line) => {\n        if (this.pvtOnMessage && !this.closed) this.pvtOnMessage(line);\n      });\n\n      this.rl.on(\"close\", () => {\n        this.pvtOnClose?.();\n        this.close();\n      });\n\n      this.rs.on(\"error\", (err: Error) => {\n        this.pvtError = err;\n        this.close();\n      });\n    } else {\n      this.rs = null;\n      this.rl = null;\n    }\n\n    if (this.writeFd) {\n      this.ws = this.writeFd.createWriteStream({ encoding: \"utf-8\" });\n      this.ws.on(\"error\", (err: Error) => {\n        this.pvtError = err;\n        this.close();\n      });\n    } else {\n      this.ws = null;\n    }\n  }\n\n  // ── factories ──────────────────────────────────────────────────────────\n\n  static openReaderFd(readFd: FileHandle): FifoUtf8NlineTransport {\n    return new FifoUtf8NlineTransport({ readFd });\n  }\n\n  static openWriterFd(writeFd: FileHandle): FifoUtf8NlineTransport {\n    return new FifoUtf8NlineTransport({ writeFd });\n  }\n\n  static fromFds(readFd: FileHandle, writeFd: FileHandle): FifoUtf8NlineTransport {\n    return new FifoUtf8NlineTransport({ readFd, writeFd });\n  }\n\n  // ── bidirectional connection ───────────────────────────────────────────\n\n  /**\n   * Start opening a bidirectional connection.  Opens readPath for reading\n   * in the background, returns a promise.  The caller should do whatever\n   * setup is needed to unblock the read (e.g. spawn a process that opens\n   * readPath for writing), then await the returned transport.\n   *\n   * The transport itself is built only once both directions are open.  A read\n   * stream created while no writer exists on its fifo is handed an immediate\n   * end-of-stream by some runtimes (bun), which closes a channel that has not\n   * carried a byte yet — so the writes side is opened before the reader exists.\n   */\n  static beginConnect(\n    readPath: string,\n    writePath: string,\n  ): { transport: Promise<FifoUtf8NlineTransport> } {\n    const readFdPromise = open(readPath, \"r\");\n\n    const transport = readFdPromise.then(async (readFd) => {\n      const writeFd = await open(writePath, \"w\");\n      return FifoUtf8NlineTransport.fromFds(readFd, writeFd);\n    });\n\n    return { transport };\n  }\n\n  /**\n   * Open a bidirectional connection.  Opens writePath for writing first\n   * (unblocking the peer's read), starts reading readPath in the\n   * background, then awaits both.\n   *\n   * Use this when you are the side that responds to the peer's beginConnect\n   * (i.e. you don't need to interleave any setup between the read and write\n   * opens).  Built like `beginConnect`: the transport exists only after both\n   * directions do.\n   */\n  static async connect(readPath: string, writePath: string): Promise<FifoUtf8NlineTransport> {\n    const readFdPromise = open(readPath, \"r\");\n    const writeFd = await open(writePath, \"w\");\n    const readFd = await readFdPromise;\n    return FifoUtf8NlineTransport.fromFds(readFd, writeFd);\n  }\n\n  // ── public API ─────────────────────────────────────────────────────────\n\n  get canSend(): boolean {\n    return this.writeFd !== null && !this.closed;\n  }\n\n  onMessage(handler: (line: string) => void): void {\n    if (this.closed) throw new Error(\"FifoUtf8NlineTransport: closed\");\n    if (this.readFd === null) throw new Error(\"FifoUtf8NlineTransport: not a reader\");\n    if (this.pvtOnMessage !== null) {\n      throw new Error(\"FifoUtf8NlineTransport: handler already set — call removeHandler() first\");\n    }\n    this.pvtOnMessage = handler;\n  }\n\n  removeHandler(): ((line: string) => void) | null {\n    const prev = this.pvtOnMessage;\n    this.pvtOnMessage = null;\n    return prev;\n  }\n\n  onClose(handler: () => void): void {\n    this.pvtOnClose = handler;\n  }\n\n  get hasHandler(): boolean {\n    return this.pvtOnMessage !== null;\n  }\n\n  get lastError(): Error | null {\n    return this.pvtError;\n  }\n\n  async send(line: string): Promise<void> {\n    if (this.closed) throw new Error(\"FifoUtf8NlineTransport: closed\");\n    if (this.writeFd === null) throw new Error(\"FifoUtf8NlineTransport: not a writer\");\n    if (!line.endsWith(\"\\n\")) line += \"\\n\";\n    await this.ws?.write(line);\n  }\n\n  async close(): Promise<void> {\n    this.closingPromise = this.closingPromise || this.pvtClose();\n    await this.closingPromise;\n    this.closed = true;\n  }\n\n  private async pvtClose(): Promise<void> {\n    // tranfser control back to caller\n    // so they can capture the promise reference\n    // and prevent reentry\n    await Promise.resolve();\n\n    if (this.rl) {\n      this.rl.close();\n      this.rl = null;\n    }\n    if (this.rs) {\n      this.rs.destroy();\n      this.rs = null;\n    }\n    if (this.ws) {\n      await new Promise<void>((resolve) => {\n        try {\n          this.ws?.end(\"\", resolve);\n        } catch {\n          resolve();\n        }\n      });\n      this.ws = null;\n    }\n\n    if (this.readFd) {\n      try {\n        await this.readFd.close();\n      } catch {}\n      this.readFd = null;\n    }\n    if (this.writeFd) {\n      try {\n        await this.writeFd.close();\n      } catch {}\n      this.writeFd = null;\n    }\n  }\n}\n","// ── stdio wire ─────────────────────────────────────────────────────────────\n//\n// A newline-delimited JSON channel over a pair of streams: the one wire every\n// way into a foreign execution context can carry.  Two callers rely on it, and\n// they are two halves of the same thing:\n//\n//   * the client of a spawn we make ourselves, on fds handed to the child (see\n//     `fdStreams`) — private fds, so the child's own stdout stays free;\n//   * a first-stage command on its own stdin/stdout, over ssh, under `sudo`, in\n//     a container — where stdio is the only channel there is.\n//\n// Frames are one JSON object per line.  Whatever the far end prints is carried\n// as an *output frame* (`$fd`), so it can never be mistaken for a frame of the\n// protocol itself; a failed start is carried as an `$error` frame.\n//\n// Why the client filters output frames before handing the transport to the\n// seam: `json1Channel` decodes every line it sees, and the first frame of a\n// session is the peer's `$proto`.  Stripping output frames in the transport\n// keeps the protocol view clean without the seam knowing anything about them.\n\nimport { createReadStream, createWriteStream } from \"node:fs\";\nimport * as readline from \"node:readline\";\nimport type { Readable, Writable } from \"node:stream\";\nimport { isProto, type Channel, type StringTransport } from \"./channel.js\";\nimport { VERSION, json1Channel } from \"./protocols/json1.js\";\n\n/** The stream pair a line transport talks over. */\nexport interface LineStreams {\n  read: Readable;\n  write: Writable;\n}\n\n/** A stream of the far end's process: its stdout or its stderr. */\nexport type OutputFd = 1 | 2;\n\n/** Where the far end's own output goes. */\nexport type OutputSink = (fd: OutputFd, data: string) => void;\n\n/** How long to wait for the far end's first protocol frame. */\nexport const HANDSHAKE_TIMEOUT_MS = 15_000;\n\nconst OUTPUT_KEY = \"$fd\";\n\nconst ERROR_KEY = \"$error\";\n\n/** Raised when the wire itself fails: no frame, the wrong protocol, a peer that went away. */\nexport class StdioWireError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"StdioWireError\";\n  }\n}\n\n// ── output frames ──────────────────────────────────────────────────────────\n\n/** One frame of the far end's own output. */\nexport interface OutputFrame {\n  fd: OutputFd;\n  data: string;\n}\n\nexport function outputFrame(fd: OutputFd, data: string): string {\n  return JSON.stringify({ [OUTPUT_KEY]: fd, data });\n}\n\n/** The output frame a line carries, or null when it carries something else. */\nexport function parseOutputFrame(line: string): OutputFrame | null {\n  // Cheap reject first: almost every line of a session is protocol traffic.\n  if (!line.startsWith('{\"$fd\"')) return null;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return null;\n  }\n  if (typeof parsed !== \"object\" || parsed === null) return null;\n  const frame = parsed as Record<string, unknown>;\n  const fd = frame[OUTPUT_KEY];\n  const data = frame.data;\n  if (fd !== 1 && fd !== 2) return null;\n  return { fd, data: typeof data === \"string\" ? data : JSON.stringify(data) };\n}\n\nexport function errorFrame(reason: string): string {\n  return JSON.stringify({ [ERROR_KEY]: reason });\n}\n\n/** The reason an `$error` frame carries, or null when it is not one. */\nexport function errorReason(frame: Record<string, unknown>): string | null {\n  const reason = frame[ERROR_KEY];\n  return typeof reason === \"string\" ? reason : null;\n}\n\n// ── transports ─────────────────────────────────────────────────────────────\n\n/** Is this write error just a peer that already left? */\nfunction peerGone(code: unknown): boolean {\n  return (\n    code === \"EPIPE\" ||\n    code === \"ERR_STREAM_DESTROYED\" ||\n    code === \"ERR_STREAM_WRITE_AFTER_END\" ||\n    code === \"ERR_STREAM_ALREADY_FINISHED\"\n  );\n}\n\nfunction errorText(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\n/**\n * A `StringTransport` over a read/write stream pair, one JSON frame per line.\n *\n * `close()` is idempotent and never throws: teardown races are normal here —\n * the peer exits, the read side ends, and a write arrives a moment later.\n */\nexport class LineTransport implements StringTransport {\n  private readonly streams: LineStreams;\n  private pvtOnMessage: ((line: string) => void) | null = null;\n  private pvtOnClose: (() => void) | null = null;\n  private pvtClosed = false;\n  private pvtClosing: Promise<void> | null = null;\n\n  constructor(streams: LineStreams) {\n    this.streams = streams;\n    const lines = readline.createInterface({ input: streams.read });\n    lines.on(\"line\", (line) => {\n      if (this.pvtOnMessage && !this.pvtClosed) this.pvtOnMessage(line);\n    });\n    lines.on(\"close\", () => {\n      this.pvtOnClose?.();\n      void this.close();\n    });\n    // A stream error is a peer that went away, not a reason to take the process\n    // down with an unhandled 'error' event.\n    streams.read.on(\"error\", () => {\n      void this.close();\n    });\n    streams.write.on(\"error\", () => {\n      void this.close();\n    });\n  }\n\n  get closed(): boolean {\n    return this.pvtClosed;\n  }\n\n  get hasHandler(): boolean {\n    return this.pvtOnMessage !== null;\n  }\n\n  onMessage(handler: (line: string) => void): void {\n    if (this.pvtClosed) throw new StdioWireError(\"stdio transport: closed\");\n    if (this.pvtOnMessage !== null) {\n      throw new StdioWireError(\"stdio transport: handler already set — call removeHandler()\");\n    }\n    this.pvtOnMessage = handler;\n  }\n\n  removeHandler(): ((line: string) => void) | null {\n    const previous = this.pvtOnMessage;\n    this.pvtOnMessage = null;\n    return previous;\n  }\n\n  onClose(handler: () => void): void {\n    this.pvtOnClose = handler;\n  }\n\n  send(frame: string): Promise<void> {\n    if (this.pvtClosed) {\n      return Promise.resolve();\n    }\n    const line = frame.endsWith(\"\\n\") ? frame : `${frame}\\n`;\n    return new Promise<void>((resolve, reject) => {\n      try {\n        this.streams.write.write(line, (err?: Error | null) => {\n          if (!err) return resolve();\n          const code = (err as { code?: unknown }).code;\n          // A peer that has hung up cannot be told anything; the write that\n          // races its exit is not an error in this transport.\n          if (peerGone(code)) {\n            return resolve();\n          }\n          reject(new StdioWireError(`stdio transport: ${err.message}`));\n        });\n      } catch (err) {\n        reject(new StdioWireError(`stdio transport: ${errorText(err)}`));\n      }\n    });\n  }\n\n  async close(): Promise<void> {\n    this.pvtClosing ??= this.pvtClose();\n    await this.pvtClosing;\n  }\n\n  private async pvtClose(): Promise<void> {\n    await Promise.resolve();\n\n    this.pvtClosed = true;\n    // Best effort: a half-open stream (the peer is already gone) must not turn\n    // teardown into an exception.\n    try {\n      this.streams.read.destroy?.();\n    } catch {\n      /* already gone */\n    }\n    try {\n      if (!this.streams.write.writableEnded) this.streams.write.end();\n    } catch {\n      /* already gone */\n    }\n  }\n}\n\n/** Streams over two fds of *our own* process — the child side of an fd wire. */\nexport function fdStreams(readFd: number, writeFd: number): LineStreams {\n  const read = createReadStream(\"\", { fd: readFd, encoding: \"utf-8\", autoClose: false });\n  const write = createWriteStream(\"\", { fd: writeFd, encoding: \"utf-8\", autoClose: false });\n  return { read, write };\n}\n\n/**\n * A transport that lifts output frames out of the stream: everything else is\n * passed through untouched, so the protocol sees frames and only frames.\n */\nexport class OutputFilter implements StringTransport {\n  private readonly inner: StringTransport;\n  private readonly sink: OutputSink;\n\n  constructor(inner: StringTransport, sink: OutputSink) {\n    this.inner = inner;\n    this.sink = sink;\n  }\n\n  send(frame: string): void | Promise<void> {\n    return this.inner.send(frame);\n  }\n\n  onMessage(handler: (frame: string) => void): void {\n    this.inner.onMessage((line) => {\n      const output = parseOutputFrame(line);\n      if (output) this.sink(output.fd, output.data);\n      else handler(line);\n    });\n  }\n\n  removeHandler(): void {\n    this.inner.removeHandler();\n  }\n\n  onClose(handler: () => void): void {\n    this.inner.onClose(handler);\n  }\n\n  close(): Promise<void> {\n    return this.inner.close();\n  }\n}\n\n// ── sinks ──────────────────────────────────────────────────────────────────\n\n/** Write the far end's output to our stderr, tagged with its name. */\nexport function stderrSink(name = \"\"): OutputSink {\n  const tag = name ? `[${name}] ` : \"\";\n  return (fd, data) => {\n    const lead = fd === 1 ? tag : `${tag}err: `;\n    for (const line of data.split(\"\\n\")) {\n      if (line.length > 0) process.stderr.write(`${lead}${line}\\n`);\n    }\n  };\n}\n\n// ── handshakes ─────────────────────────────────────────────────────────────\n\n/** The next frame that arrives, or a timeout. */\nasync function nextFrame(channel: Channel, timeoutMs: number): Promise<Record<string, unknown>> {\n  return await new Promise((resolve, reject) => {\n    const timer = setTimeout(\n      () => reject(new StdioWireError(`no protocol frame within ${timeoutMs}ms`)),\n      timeoutMs,\n    );\n    timer.unref?.();\n    channel.onMessage((frame) => {\n      clearTimeout(timer);\n      resolve(frame);\n    });\n  });\n}\n\nexport interface ClientChannelOptions {\n  /** Where the far end's own output goes.  Defaults to our stderr. */\n  onOutput?: OutputSink;\n  /** How long to wait for the peer's protocol frame.  Defaults to {@link HANDSHAKE_TIMEOUT_MS}. */\n  timeoutMs?: number;\n}\n\n/**\n * The client end of the wire: hand the streams to the seam (minus output\n * frames) and wait for the peer's `$proto`.  A first stage reports a failed\n * start as an `$error` frame instead.\n */\nexport async function clientChannel(\n  streams: LineStreams,\n  opts: ClientChannelOptions = {},\n): Promise<Channel> {\n  const transport = new LineTransport(streams);\n  const channel = json1Channel(new OutputFilter(transport, opts.onOutput ?? stderrSink()));\n  const frame = await nextFrame(channel, opts.timeoutMs ?? HANDSHAKE_TIMEOUT_MS);\n  channel.removeHandler();\n\n  const reason = errorReason(frame);\n  if (reason) throw new StdioWireError(reason);\n  if (!isProto(frame)) {\n    throw new StdioWireError(`unexpected first frame: ${JSON.stringify(frame).slice(0, 120)}`);\n  }\n  if (frame.$proto !== VERSION) {\n    throw new StdioWireError(`unsupported protocol ${String(frame.$proto)}, expected ${VERSION}`);\n  }\n  return channel;\n}\n\n/** The server end of the wire — a payload speaking stdio itself. */\nexport async function serverChannel(streams: LineStreams): Promise<Channel> {\n  const channel = json1Channel(new LineTransport(streams));\n  await channel.send({ $proto: VERSION });\n  return channel;\n}\n","// ── Kit ────────────────────────────────────────────────────────────────────\n//\n// Getting a payload onto a host we know nothing about.  A way in gives us a\n// shell; from there one script runs everywhere: probe what is really there, write\n// the kit only if it is not, and report every step as one machine-readable line.\n// The script always arrives on stdin, never in argv — and since stdin *is* the\n// script, the payload gets its own channel into the same environment (a second\n// `ssh`, an `exec` on a container that is already running).\n//\n// The script assumes POSIX sh and nothing else: `command -v`, `mkdir -p`,\n// `wc -c`, `base64 -d`.  A broken environment therefore reaches the client as a\n// readable reason instead of a channel that just closes.\n//\n// A kit is named after the build that made it and the posipaki it speaks, so two\n// consumers, two builds or two releases cannot land on each other's files.\n\nimport { createHash } from \"node:crypto\";\nimport { LIB_VERSION } from \"../version.js\";\n\n/** Runtimes a kit is happy to be run with, best first.  A caller may override. */\nexport const DEFAULT_RUNTIMES = [\"node\", \"nodejs\", \"bun\"];\n\n/** Layout of a staged kit — the contract's own version, recorded in `version.json`. */\nexport const KIT_LAYOUT = 1;\n\n/** Where kits live on a host, relative to `$HOME`, unless the caller says otherwise. */\nexport const DEFAULT_KIT_PARENT = \"bin/posipaki\";\n\nexport interface KitFile {\n  /** Name inside the kit directory, e.g. `payload.js`. */\n  name: string;\n  /** The file's bytes, base64 — what the script writes. */\n  base64: string;\n  /** Byte count, for the cheap presence check. */\n  bytes: number;\n  /** sha256 of the file, recorded in `version.json`. */\n  sha256: string;\n}\n\n/** Who is staging this kit: the consumer's own name and build version. */\nexport interface KitApp {\n  name: string;\n  version: string;\n}\n\nexport interface Kit {\n  /** Directory name: `<app>-<app version>-posipaki-<posipaki version>-<manifest8>`. */\n  name: string;\n  /** sha256 over the manifest of the kit's own files. */\n  manifestHash: string;\n  /** Everything the kit installs, `version.json` last. */\n  files: KitFile[];\n  /** Runtime candidates, in order; the first one found wins. */\n  runtimes: string[];\n  /** Directory the kit lands in, relative to the host's `$HOME`. */\n  parent: string;\n  /** The consumer this kit belongs to. */\n  app: KitApp;\n}\n\nexport interface MakeKitOptions {\n  /** Required: a kit with no owner cannot be told apart from another's. */\n  app: KitApp;\n  /** Defaults to {@link DEFAULT_RUNTIMES}. */\n  runtimes?: string[];\n  /** Defaults to {@link DEFAULT_KIT_PARENT}. */\n  parent?: string;\n}\n\nexport type BootstrapReport =\n  | { kind: \"ready\"; kitDir: string; runtime: string; staged: boolean }\n  | { kind: \"error\"; reason: string };\n\n/** The part an artifact plays when it names itself. */\nexport type ArtifactRole = \"gateway\" | \"payload\";\n\n/** Hex sha256 of some content. */\nexport function sha256Hex(content: string | Uint8Array): string {\n  return createHash(\"sha256\").update(content).digest(\"hex\");\n}\n\n/** The directory name a kit with these contents, this owner and this posipaki gets. */\nexport function kitName(app: KitApp, manifestHash: string): string {\n  return `${app.name}-${app.version}-posipaki-${LIB_VERSION}-${manifestHash.slice(0, 8)}`;\n}\n\n/**\n * One line naming a staged artifact: what it is, which posipaki it speaks, which\n * kit layout it was built for.  A client that staged it can judge compatibility\n * from this alone — nothing else is claimed.\n */\nexport function versionLine(app: KitApp, role: ArtifactRole, proto: string): string {\n  return `${app.name}-${role} ${app.version} posipaki ${LIB_VERSION} proto ${proto} layout ${KIT_LAYOUT}`;\n}\n\n/** Wrap base64 at a comfortable width; `base64 -d` ignores the newlines. */\nfunction wrapped(base64: string, width = 76): string {\n  const lines: string[] = [];\n  for (let at = 0; at < base64.length; at += width) lines.push(base64.slice(at, at + width));\n  return lines.join(\"\\n\");\n}\n\n/**\n * Describe a kit around its files.  The manifest hash covers the files only, so\n * `version.json` — which records that hash — can be one of them without chasing\n * its own tail.\n */\nexport function makeKit(\n  files: { name: string; content: string | Uint8Array }[],\n  options: MakeKitOptions,\n): Kit {\n  const raw = files.map((file) => ({\n    name: file.name,\n    bytes: Buffer.byteLength(file.content),\n    sha256: sha256Hex(file.content),\n    base64: Buffer.from(file.content).toString(\"base64\"),\n  }));\n  const manifestHash = sha256Hex(raw.map((f) => `${f.name} ${f.sha256} ${f.bytes}`).join(\"\\n\"));\n  const kit: Kit = {\n    name: kitName(options.app, manifestHash),\n    manifestHash,\n    files: raw,\n    runtimes: [...(options.runtimes ?? DEFAULT_RUNTIMES)],\n    parent: options.parent ?? DEFAULT_KIT_PARENT,\n    app: options.app,\n  };\n  const version = Buffer.from(`${JSON.stringify(kitVersion(kit), null, 2)}\\n`);\n  return {\n    ...kit,\n    files: [\n      ...kit.files,\n      {\n        name: \"version.json\",\n        bytes: version.byteLength,\n        sha256: sha256Hex(version),\n        base64: version.toString(\"base64\"),\n      },\n    ],\n  };\n}\n\n/** What `version.json` says: identity, versions, and the exact content hashes. */\nexport function kitVersion(kit: Kit): Record<string, unknown> {\n  return {\n    kit: kit.name,\n    app: kit.app,\n    posipaki: LIB_VERSION,\n    layout: KIT_LAYOUT,\n    manifestHash: kit.manifestHash,\n    files: kit.files.map((file) => ({ name: file.name, sha256: file.sha256, bytes: file.bytes })),\n  };\n}\n\n/** The `[ -f … ] && [ \"$(wc -c < …)\" -eq … ]` test for one file. */\nfunction presentTest(file: KitFile): string {\n  return `[ -f \"$kit_dir/${file.name}\" ] && [ \"$(wc -c < \"$kit_dir/${file.name}\")\" -eq ${file.bytes} ]`;\n}\n\n/** One file: write it to a temp name, then move it into place. */\nfunction writeFile(file: KitFile): string {\n  return [\n    `  base64 -d > \"$tmp\" <<'KIT_FILE'`,\n    wrapped(file.base64),\n    \"KIT_FILE\",\n    `  mv \"$tmp\" \"$kit_dir/${file.name}\" || { echo \"error cannot install ${file.name}\"; exit 73; }`,\n  ].join(\"\\n\");\n}\n\n/**\n * The bootstrap, as one POSIX sh script.\n *\n * Staging is the whole job.  The script always arrives on stdin, never in argv,\n * and that is also why it cannot carry the wire: the caller runs the payload on a\n * second channel into the same environment once this one has reported.\n */\nexport function bootstrapScript(kit: Kit): string {\n  const checks = kit.files.map(presentTest).join(\" && \\\\\\n  \");\n  const lines = [\n    \"# ── kit bootstrap ─────────────────────────────────────────────────────────\",\n    \"# probe, stage what is missing, report every step as one machine-readable line.\",\n    \"set -u\",\n    \"\",\n    'if [ -z \"${HOME:-}\" ]; then echo \"error HOME is not set\"; exit 74; fi',\n    `kit_dir=\"$HOME/${kit.parent}/${kit.name}\"`,\n    \"\",\n    'runtime=\"\"',\n    `for candidate in ${kit.runtimes.join(\" \")}; do`,\n    '  if command -v \"$candidate\" >/dev/null 2>&1; then runtime=\"$(command -v \"$candidate\")\"; break; fi',\n    \"done\",\n    `if [ -z \"$runtime\" ]; then echo \"error no runtime among: ${kit.runtimes.join(\" \")}\"; exit 75; fi`,\n    'if ! command -v base64 >/dev/null 2>&1; then echo \"error base64 is missing\"; exit 76; fi',\n    \"\",\n    `if ${checks}; then`,\n    '  echo \"present\"',\n    \"else\",\n    `  mkdir -p \"$kit_dir\" || { echo \"error cannot create $kit_dir\"; exit 73; }`,\n    '  tmp=\"$kit_dir/.staging.$$\"',\n    ...kit.files.map(writeFile),\n    '  echo \"staged\"',\n    \"fi\",\n    'echo \"kit $kit_dir\"',\n    'echo \"runtime $runtime\"',\n  ];\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\n/** Read the script's report back.  Missing or unknown lines are an error. */\nexport function parseBootstrapReport(stdout: string): BootstrapReport {\n  let kitDir = \"\";\n  let runtime = \"\";\n  let staged: boolean | null = null;\n  for (const raw of stdout.split(\"\\n\")) {\n    const line = raw.trim();\n    if (line === \"\") continue;\n    if (line.startsWith(\"error \")) return { kind: \"error\", reason: line.slice(\"error \".length) };\n    if (line === \"staged\") {\n      staged = true;\n      continue;\n    }\n    if (line === \"present\") {\n      staged = false;\n      continue;\n    }\n    if (line.startsWith(\"kit \")) {\n      kitDir = line.slice(\"kit \".length);\n      continue;\n    }\n    if (line.startsWith(\"runtime \")) {\n      runtime = line.slice(\"runtime \".length);\n      continue;\n    }\n  }\n  if (kitDir === \"\" || runtime === \"\" || staged === null) {\n    const seen = stdout.trim();\n    return {\n      kind: \"error\",\n      reason: seen === \"\" ? \"no report at all\" : `incomplete report: ${seen}`,\n    };\n  }\n  return { kind: \"ready\", kitDir, runtime, staged };\n}\n","// ── Gateway ────────────────────────────────────────────────────────────────\n//\n// The first-stage command.  Run this *inside* a foreign environment — directly,\n// under `sudo`, over ssh, in a container — and it:\n//\n//   1. creates the channel to the payload (fifo paths it makes itself, in a\n//      private temp dir, so they belong to the uid that will open them),\n//   2. starts the payload (`--worker=<script>`, required) and relays frames\n//      between stdin/stdout,\n//   3. carries whatever the payload prints to the client as output frames\n//      (`$fd`), so the payload's own stdout can never be mistaken for protocol.\n//\n// Why a gateway at all: a fifo path created on the client side is useless when the\n// payload runs as another uid (it cannot open it) or on another host (the path is\n// not there).  stdio is the one channel every way into an environment gives us, so\n// the wire is stdio and the fifo stays inside the environment.\n//\n// Directories and processes are cleaned up on every exit path, which is also why\n// the client never sees a transport being closed twice.\n//\n// It imports nothing but node builtins and this package, so the payload behind it\n// can be anything the runtime there can start.\n\nimport { execFile, spawn } from \"node:child_process\";\nimport type { ChildProcess } from \"node:child_process\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { promisify } from \"node:util\";\nimport type { KitApp } from \"./kit.js\";\nimport { versionLine } from \"./kit.js\";\nimport { VERSION } from \"./protocols/json1.js\";\nimport { errorFrame, outputFrame } from \"./stdio.js\";\nimport type { LineTransport, OutputFd } from \"./stdio.js\";\nimport { LineTransport as Lines } from \"./stdio.js\";\nimport { FifoUtf8NlineTransport } from \"./transports/fifo.js\";\n\nconst run = promisify(execFile);\n\n/** Exit code for \"this environment could not be set up\". */\nexport const GATEWAY_FAILED = 1;\n\nexport interface GatewayBoot {\n  /** Who staged this payload.  Names the artifact in its `--version` line. */\n  app: KitApp;\n  /** A label for logs and the tree name; the payload may have its own default. */\n  env: string;\n  /** Forwarded to the payload when given. */\n  poolSize?: number;\n  /** The payload to relay to.  Required — the gateway has no opinion of its own. */\n  worker: string;\n}\n\nfunction errorText(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n\nfunction flagValue(argv: string[], name: string): string | undefined {\n  const prefix = `--${name}=`;\n  return argv.find((a) => a.startsWith(prefix))?.slice(prefix.length);\n}\n\n/** A `--flag=<positive integer>` argument, or undefined. */\nfunction positiveInt(value: string | undefined): number | undefined {\n  const n = Number(value);\n  return value !== undefined && Number.isFinite(n) && n >= 1 ? Math.floor(n) : undefined;\n}\n\n/**\n * The argv that boots this gateway — built by the client, read by\n * {@link gatewayBoot}, so the two halves cannot drift apart.\n */\nexport function gatewayArgs(boot: GatewayBoot): string[] {\n  return [\n    `--worker=${boot.worker}`,\n    `--env=${boot.env}`,\n    `--app-name=${boot.app.name}`,\n    `--app-version=${boot.app.version}`,\n    ...(boot.poolSize === undefined ? [] : [`--pool-size=${boot.poolSize}`]),\n  ];\n}\n\n/** The boot a gateway was started with, or the reason it cannot start. */\nexport function gatewayBoot(argv: string[]): GatewayBoot {\n  const worker = flagValue(argv, \"worker\");\n  if (!worker) throw new Error(\"no --worker=<script>: the gateway needs a payload to relay to\");\n  const name = flagValue(argv, \"app-name\");\n  const version = flagValue(argv, \"app-version\");\n  if (!name || !version) {\n    throw new Error(\"no --app-name=<name> and --app-version=<version>: the gateway names its artifact\");\n  }\n  return {\n    app: { name, version },\n    env: flagValue(argv, \"env\") ?? \"unnamed\",\n    poolSize: positiveInt(flagValue(argv, \"pool-size\")),\n    worker,\n  };\n}\n\n/**\n * End a start that failed.  The reason has already gone out on the wire, and\n * returning is not enough: the `open()` on a fifo no payload will ever write sits\n * in the threadpool forever, so the loop never drains and the gateway would linger\n * with a dead payload on its books.\n */\nfunction abandon(): never {\n  process.exit(GATEWAY_FAILED);\n}\n\n/** Carry a failed start to the client, then let the caller exit non-zero. */\nasync function fail(wire: LineTransport, reason: string): Promise<void> {\n  process.stderr.write(`gateway: ${reason}\\n`);\n  try {\n    await wire.send(errorFrame(reason));\n  } catch {\n    /* the client is gone too — the exit code still says what happened */\n  }\n}\n\n/** Copy everything the payload prints onto the wire as output frames. */\nfunction forwardOutput(stream: NodeJS.ReadableStream, wire: LineTransport, fd: OutputFd): void {\n  stream.setEncoding(\"utf-8\");\n  stream.on(\"data\", (chunk: string) => {\n    void wire.send(outputFrame(fd, chunk)).catch(() => {\n      /* the client hung up: the payload's exit is what matters now */\n    });\n  });\n}\n\n/**\n * Serve one environment over stdin/stdout.  Returns the exit code; the caller\n * turns it into `process.exitCode`.\n */\nexport async function runGateway(argv: string[] = process.argv): Promise<number> {\n  if (argv.includes(\"--version\")) {\n    const name = flagValue(argv, \"app-name\") ?? \"posipaki\";\n    const version = flagValue(argv, \"app-version\") ?? \"-\";\n    process.stdout.write(`${versionLine({ name, version }, \"gateway\", VERSION)}\\n`);\n    return 0;\n  }\n  const wire = new Lines({ read: process.stdin, write: process.stdout });\n\n  let booted: GatewayBoot;\n  try {\n    booted = gatewayBoot(argv);\n  } catch (err) {\n    // Nothing has been started yet, so there is nothing to tear down — but the\n    // client still deserves the reason rather than a channel that closes on it,\n    // and the loop can outlive us: an open stdin nobody will close keeps the\n    // process alive, so this is an exit, not a return.\n    await fail(wire, errorText(err));\n    abandon();\n  }\n  const { env, poolSize, worker } = booted;\n\n  const dir = await mkdtemp(join(tmpdir(), `posipaki-${env.replace(/\\//g, \"-\")}-`));\n  const fifoIn = join(dir, \"in\"); // the payload writes, we read\n  const fifoOut = join(dir, \"out\"); // we write, the payload reads\n\n  let child: ChildProcess | null = null;\n  let fifo: FifoUtf8NlineTransport | null = null;\n\n  /**\n   * Everything this gateway owns, undone.  All of it is idempotent, because the\n   * exit path and the signal path can both arrive.\n   */\n  const teardown = async (): Promise<void> => {\n    child?.kill();\n    await fifo?.close().catch(() => {});\n    await rm(dir, { recursive: true, force: true }).catch(() => {});\n  };\n\n  /**\n   * A client that gives up stops us with a signal, and a gateway that died on the\n   * spot would leave its payload behind in the environment — a process holding a\n   * fifo nobody will ever write, which is a leak the environment cannot clean up\n   * for us.  So the signals do what the exit path does.\n   */\n  const onTerminate = () => {\n    void teardown()\n      .catch(() => {})\n      .then(() => process.exit(GATEWAY_FAILED));\n  };\n  for (const signal of [\"SIGTERM\", \"SIGINT\", \"SIGHUP\"] as const) process.on(signal, onTerminate);\n\n  try {\n    await run(\"mkfifo\", [\"-m\", \"600\", fifoIn, fifoOut]);\n  } catch (err) {\n    await fail(wire, `cannot create the environment's fifos: ${errorText(err)}`);\n    await teardown();\n    abandon();\n  }\n\n  // Open the read side in the background, then start the payload that unblocks\n  // it — the order the fifo handshake requires.\n  const connection = FifoUtf8NlineTransport.beginConnect(fifoIn, fifoOut);\n  const workerArgs = [\n    worker,\n    `--env=${env}`,\n    ...(poolSize === undefined ? [] : [`--pool-size=${poolSize}`]),\n    `--fifo-in=${fifoIn}`,\n    `--fifo-out=${fifoOut}`,\n  ];\n  const workerProc = spawn(process.execPath, workerArgs, { stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  child = workerProc;\n  forwardOutput(workerProc.stdout, wire, 1);\n  forwardOutput(workerProc.stderr, wire, 2);\n\n  const exited = new Promise<number>((settle) => {\n    // A payload killed by a signal (the client hung up, and we killed it) has no\n    // code — for us that is a clean end, not a failure.\n    workerProc.once(\"exit\", (code) => settle(code ?? 0));\n  });\n\n  try {\n    fifo = await Promise.race([\n      connection.transport,\n      exited.then((code) => {\n        throw new Error(`the payload exited with code ${code} before it opened its channel`);\n      }),\n    ]);\n  } catch (err) {\n    await fail(wire, errorText(err));\n    await teardown();\n    abandon();\n  }\n\n  // Relay: the protocol is the client's and the payload's business, not ours.\n  const relay = fifo;\n  relay.onMessage((line) => {\n    void wire.send(line).catch(() => {\n      /* client gone */\n    });\n  });\n  wire.onMessage((line) => {\n    void relay.send(line).catch(() => {\n      /* the payload is gone; its exit path cleans up */\n    });\n  });\n  wire.onClose(() => {\n    child?.kill();\n  });\n\n  const code = await exited;\n  await teardown();\n  await wire.close();\n  return code;\n}\n"],"mappings":";;;;;;;;;;;AAUA,IAAa,yBAAb,MAAa,uBAAkD;CAY7D,YAAoB,MAAqD;EANjB,KAAA,eAAA;EACd,KAAA,aAAA;EACzB,KAAA,SAAA;EAC8B,KAAA,iBAAA;EACd,KAAA,WAAA;EAG/B,KAAK,SAAS,KAAK,UAAU;EAC7B,KAAK,UAAU,KAAK,WAAW;EAE/B,IAAI,KAAK,QAAQ;GACf,KAAK,KAAK,KAAK,OAAO,iBAAiB,EAAE,UAAU,QAAQ,CAAC;GAC5D,KAAK,KAAK,SAAS,gBAAgB,EAAE,OAAO,KAAK,GAAG,CAAC;GAErD,KAAK,GAAG,GAAG,SAAS,SAAS;IAC3B,IAAI,KAAK,gBAAgB,CAAC,KAAK,QAAQ,KAAK,aAAa,IAAI;GAC/D,CAAC;GAED,KAAK,GAAG,GAAG,eAAe;IACxB,KAAK,aAAa;IAClB,KAAK,MAAM;GACb,CAAC;GAED,KAAK,GAAG,GAAG,UAAU,QAAe;IAClC,KAAK,WAAW;IAChB,KAAK,MAAM;GACb,CAAC;EACH,OAAO;GACL,KAAK,KAAK;GACV,KAAK,KAAK;EACZ;EAEA,IAAI,KAAK,SAAS;GAChB,KAAK,KAAK,KAAK,QAAQ,kBAAkB,EAAE,UAAU,QAAQ,CAAC;GAC9D,KAAK,GAAG,GAAG,UAAU,QAAe;IAClC,KAAK,WAAW;IAChB,KAAK,MAAM;GACb,CAAC;EACH,OACE,KAAK,KAAK;CAEd;CAIA,OAAO,aAAa,QAA4C;EAC9D,OAAO,IAAI,uBAAuB,EAAE,OAAO,CAAC;CAC9C;CAEA,OAAO,aAAa,SAA6C;EAC/D,OAAO,IAAI,uBAAuB,EAAE,QAAQ,CAAC;CAC/C;CAEA,OAAO,QAAQ,QAAoB,SAA6C;EAC9E,OAAO,IAAI,uBAAuB;GAAE;GAAQ;EAAQ,CAAC;CACvD;;;;;;;;;;;;CAeA,OAAO,aACL,UACA,WACgD;EAQhD,OAAO,EAAE,WAPa,KAAK,UAAU,GAEP,CAAC,CAAC,KAAK,OAAO,WAAW;GACrD,MAAM,UAAU,MAAM,KAAK,WAAW,GAAG;GACzC,OAAO,uBAAuB,QAAQ,QAAQ,OAAO;EACvD,CAEiB,EAAE;CACrB;;;;;;;;;;;CAYA,aAAa,QAAQ,UAAkB,WAAoD;EACzF,MAAM,gBAAgB,KAAK,UAAU,GAAG;EACxC,MAAM,UAAU,MAAM,KAAK,WAAW,GAAG;EACzC,MAAM,SAAS,MAAM;EACrB,OAAO,uBAAuB,QAAQ,QAAQ,OAAO;CACvD;CAIA,IAAI,UAAmB;EACrB,OAAO,KAAK,YAAY,QAAQ,CAAC,KAAK;CACxC;CAEA,UAAU,SAAuC;EAC/C,IAAI,KAAK,QAAQ,MAAM,IAAI,MAAM,gCAAgC;EACjE,IAAI,KAAK,WAAW,MAAM,MAAM,IAAI,MAAM,sCAAsC;EAChF,IAAI,KAAK,iBAAiB,MACxB,MAAM,IAAI,MAAM,0EAA0E;EAE5F,KAAK,eAAe;CACtB;CAEA,gBAAiD;EAC/C,MAAM,OAAO,KAAK;EAClB,KAAK,eAAe;EACpB,OAAO;CACT;CAEA,QAAQ,SAA2B;EACjC,KAAK,aAAa;CACpB;CAEA,IAAI,aAAsB;EACxB,OAAO,KAAK,iBAAiB;CAC/B;CAEA,IAAI,YAA0B;EAC5B,OAAO,KAAK;CACd;CAEA,MAAM,KAAK,MAA6B;EACtC,IAAI,KAAK,QAAQ,MAAM,IAAI,MAAM,gCAAgC;EACjE,IAAI,KAAK,YAAY,MAAM,MAAM,IAAI,MAAM,sCAAsC;EACjF,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,QAAQ;EAClC,MAAM,KAAK,IAAI,MAAM,IAAI;CAC3B;CAEA,MAAM,QAAuB;EAC3B,KAAK,iBAAiB,KAAK,kBAAkB,KAAK,SAAS;EAC3D,MAAM,KAAK;EACX,KAAK,SAAS;CAChB;CAEA,MAAc,WAA0B;EAItC,MAAM,QAAQ,QAAQ;EAEtB,IAAI,KAAK,IAAI;GACX,KAAK,GAAG,MAAM;GACd,KAAK,KAAK;EACZ;EACA,IAAI,KAAK,IAAI;GACX,KAAK,GAAG,QAAQ;GAChB,KAAK,KAAK;EACZ;EACA,IAAI,KAAK,IAAI;GACX,MAAM,IAAI,SAAe,YAAY;IACnC,IAAI;KACF,KAAK,IAAI,IAAI,IAAI,OAAO;IAC1B,QAAQ;KACN,QAAQ;IACV;GACF,CAAC;GACD,KAAK,KAAK;EACZ;EAEA,IAAI,KAAK,QAAQ;GACf,IAAI;IACF,MAAM,KAAK,OAAO,MAAM;GAC1B,QAAQ,CAAC;GACT,KAAK,SAAS;EAChB;EACA,IAAI,KAAK,SAAS;GAChB,IAAI;IACF,MAAM,KAAK,QAAQ,MAAM;GAC3B,QAAQ,CAAC;GACT,KAAK,UAAU;EACjB;CACF;AACF;;;;AClKA,MAAa,uBAAuB;AAEpC,MAAM,aAAa;AAEnB,MAAM,YAAY;;AAGlB,IAAa,iBAAb,cAAoC,MAAM;CACxC,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,KAAK,OAAO;CACd;AACF;AAUA,SAAgB,YAAY,IAAc,MAAsB;CAC9D,OAAO,KAAK,UAAU;GAAG,aAAa;EAAI;CAAK,CAAC;AAClD;;AAGA,SAAgB,iBAAiB,MAAkC;CAEjE,IAAI,CAAC,KAAK,WAAW,UAAQ,GAAG,OAAO;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM,OAAO;CAC1D,MAAM,QAAQ;CACd,MAAM,KAAK,MAAM;CACjB,MAAM,OAAO,MAAM;CACnB,IAAI,OAAO,KAAK,OAAO,GAAG,OAAO;CACjC,OAAO;EAAE;EAAI,MAAM,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;CAAE;AAC5E;AAEA,SAAgB,WAAW,QAAwB;CACjD,OAAO,KAAK,UAAU,GAAG,YAAY,OAAO,CAAC;AAC/C;;AAGA,SAAgB,YAAY,OAA+C;CACzE,MAAM,SAAS,MAAM;CACrB,OAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;;AAKA,SAAS,SAAS,MAAwB;CACxC,OACE,SAAS,WACT,SAAS,0BACT,SAAS,gCACT,SAAS;AAEb;AAEA,SAASA,YAAU,KAAsB;CACvC,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;;;;;;;AAQA,IAAa,gBAAb,MAAsD;CAOpD,YAAY,SAAsB;EALsB,KAAA,eAAA;EACd,KAAA,aAAA;EACtB,KAAA,YAAA;EACuB,KAAA,aAAA;EAGzC,KAAK,UAAU;EACf,MAAM,QAAQ,SAAS,gBAAgB,EAAE,OAAO,QAAQ,KAAK,CAAC;EAC9D,MAAM,GAAG,SAAS,SAAS;GACzB,IAAI,KAAK,gBAAgB,CAAC,KAAK,WAAW,KAAK,aAAa,IAAI;EAClE,CAAC;EACD,MAAM,GAAG,eAAe;GACtB,KAAK,aAAa;GAClB,KAAU,MAAM;EAClB,CAAC;EAGD,QAAQ,KAAK,GAAG,eAAe;GAC7B,KAAU,MAAM;EAClB,CAAC;EACD,QAAQ,MAAM,GAAG,eAAe;GAC9B,KAAU,MAAM;EAClB,CAAC;CACH;CAEA,IAAI,SAAkB;EACpB,OAAO,KAAK;CACd;CAEA,IAAI,aAAsB;EACxB,OAAO,KAAK,iBAAiB;CAC/B;CAEA,UAAU,SAAuC;EAC/C,IAAI,KAAK,WAAW,MAAM,IAAI,eAAe,yBAAyB;EACtE,IAAI,KAAK,iBAAiB,MACxB,MAAM,IAAI,eAAe,6DAA6D;EAExF,KAAK,eAAe;CACtB;CAEA,gBAAiD;EAC/C,MAAM,WAAW,KAAK;EACtB,KAAK,eAAe;EACpB,OAAO;CACT;CAEA,QAAQ,SAA2B;EACjC,KAAK,aAAa;CACpB;CAEA,KAAK,OAA8B;EACjC,IAAI,KAAK,WACP,OAAO,QAAQ,QAAQ;EAEzB,MAAM,OAAO,MAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,MAAM;EACrD,OAAO,IAAI,SAAe,SAAS,WAAW;GAC5C,IAAI;IACF,KAAK,QAAQ,MAAM,MAAM,OAAO,QAAuB;KACrD,IAAI,CAAC,KAAK,OAAO,QAAQ;KACzB,MAAM,OAAQ,IAA2B;KAGzC,IAAI,SAAS,IAAI,GACf,OAAO,QAAQ;KAEjB,OAAO,IAAI,eAAe,oBAAoB,IAAI,SAAS,CAAC;IAC9D,CAAC;GACH,SAAS,KAAK;IACZ,OAAO,IAAI,eAAe,oBAAoBA,YAAU,GAAG,GAAG,CAAC;GACjE;EACF,CAAC;CACH;CAEA,MAAM,QAAuB;EAC3B,KAAK,eAAe,KAAK,SAAS;EAClC,MAAM,KAAK;CACb;CAEA,MAAc,WAA0B;EACtC,MAAM,QAAQ,QAAQ;EAEtB,KAAK,YAAY;EAGjB,IAAI;GACF,KAAK,QAAQ,KAAK,UAAU;EAC9B,QAAQ,CAER;EACA,IAAI;GACF,IAAI,CAAC,KAAK,QAAQ,MAAM,eAAe,KAAK,QAAQ,MAAM,IAAI;EAChE,QAAQ,CAER;CACF;AACF;;AAGA,SAAgB,UAAU,QAAgB,SAA8B;CAGtE,OAAO;EAAE,MAFI,iBAAiB,IAAI;GAAE,IAAI;GAAQ,UAAU;GAAS,WAAW;EAAM,CAExE;EAAG,OADD,kBAAkB,IAAI;GAAE,IAAI;GAAS,UAAU;GAAS,WAAW;EAAM,CACpE;CAAE;AACvB;;;;;AAMA,IAAa,eAAb,MAAqD;CAInD,YAAY,OAAwB,MAAkB;EACpD,KAAK,QAAQ;EACb,KAAK,OAAO;CACd;CAEA,KAAK,OAAqC;EACxC,OAAO,KAAK,MAAM,KAAK,KAAK;CAC9B;CAEA,UAAU,SAAwC;EAChD,KAAK,MAAM,WAAW,SAAS;GAC7B,MAAM,SAAS,iBAAiB,IAAI;GACpC,IAAI,QAAQ,KAAK,KAAK,OAAO,IAAI,OAAO,IAAI;QACvC,QAAQ,IAAI;EACnB,CAAC;CACH;CAEA,gBAAsB;EACpB,KAAK,MAAM,cAAc;CAC3B;CAEA,QAAQ,SAA2B;EACjC,KAAK,MAAM,QAAQ,OAAO;CAC5B;CAEA,QAAuB;EACrB,OAAO,KAAK,MAAM,MAAM;CAC1B;AACF;;AAKA,SAAgB,WAAW,OAAO,IAAgB;CAChD,MAAM,MAAM,OAAO,IAAI,KAAK,MAAM;CAClC,QAAQ,IAAI,SAAS;EACnB,MAAM,OAAO,OAAO,IAAI,MAAM,GAAG,IAAI;EACrC,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAChC,IAAI,KAAK,SAAS,GAAG,QAAQ,OAAO,MAAM,GAAG,OAAO,KAAK,GAAG;CAEhE;AACF;;AAKA,eAAe,UAAU,SAAkB,WAAqD;CAC9F,OAAO,MAAM,IAAI,SAAS,SAAS,WAAW;EAC5C,MAAM,QAAQ,iBACN,OAAO,IAAI,eAAe,4BAA4B,UAAU,GAAG,CAAC,GAC1E,SACF;EACA,MAAM,QAAQ;EACd,QAAQ,WAAW,UAAU;GAC3B,aAAa,KAAK;GAClB,QAAQ,KAAK;EACf,CAAC;CACH,CAAC;AACH;;;;;;AAcA,eAAsB,cACpB,SACA,OAA6B,CAAC,GACZ;CAClB,MAAM,YAAY,IAAI,cAAc,OAAO;CAC3C,MAAM,UAAU,aAAa,IAAI,aAAa,WAAW,KAAK,YAAY,WAAW,CAAC,CAAC;CACvF,MAAM,QAAQ,MAAM,UAAU,SAAS,KAAK,aAAA,IAAiC;CAC7E,QAAQ,cAAc;CAEtB,MAAM,SAAS,YAAY,KAAK;CAChC,IAAI,QAAQ,MAAM,IAAI,eAAe,MAAM;CAC3C,IAAI,CAAC,QAAQ,KAAK,GAChB,MAAM,IAAI,eAAe,2BAA2B,KAAK,UAAU,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG;CAE3F,IAAI,MAAM,WAAA,WACR,MAAM,IAAI,eAAe,wBAAwB,OAAO,MAAM,MAAM,EAAE,aAAa,SAAS;CAE9F,OAAO;AACT;;AAGA,eAAsB,cAAc,SAAwC;CAC1E,MAAM,UAAU,aAAa,IAAI,cAAc,OAAO,CAAC;CACvD,MAAM,QAAQ,KAAK,EAAE,QAAQ,QAAQ,CAAC;CACtC,OAAO;AACT;;;;ACnTA,MAAa,mBAAmB;CAAC;CAAQ;CAAU;AAAK;;AAGxD,MAAa,aAAa;;AAG1B,MAAa,qBAAqB;;AAmDlC,SAAgB,UAAU,SAAsC;CAC9D,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;AAC1D;;AAGA,SAAgB,QAAQ,KAAa,cAA8B;CACjE,OAAO,GAAG,IAAI,KAAK,GAAG,IAAI,QAAQ,YAAY,YAAY,GAAG,aAAa,MAAM,GAAG,CAAC;AACtF;;;;;;AAOA,SAAgB,YAAY,KAAa,MAAoB,OAAuB;CAClF,OAAO,GAAG,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,QAAQ,YAAY,YAAY,SAAS,MAAM;AACnF;;AAGA,SAAS,QAAQ,QAAgB,QAAQ,IAAY;CACnD,MAAM,QAAkB,CAAC;CACzB,KAAK,IAAI,KAAK,GAAG,KAAK,OAAO,QAAQ,MAAM,OAAO,MAAM,KAAK,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC;CACzF,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;AAOA,SAAgB,QACd,OACA,SACK;CACL,MAAM,MAAM,MAAM,KAAK,UAAU;EAC/B,MAAM,KAAK;EACX,OAAO,OAAO,WAAW,KAAK,OAAO;EACrC,QAAQ,UAAU,KAAK,OAAO;EAC9B,QAAQ,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,SAAS,QAAQ;CACrD,EAAE;CACF,MAAM,eAAe,UAAU,IAAI,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;CAC5F,MAAM,MAAW;EACf,MAAM,QAAQ,QAAQ,KAAK,YAAY;EACvC;EACA,OAAO;EACP,UAAU,CAAC,GAAI,QAAQ,YAAY,gBAAiB;EACpD,QAAQ,QAAQ,UAAA;EAChB,KAAK,QAAQ;CACf;CACA,MAAM,UAAU,OAAO,KAAK,GAAG,KAAK,UAAU,WAAW,GAAG,GAAG,MAAM,CAAC,EAAE,GAAG;CAC3E,OAAO;EACL,GAAG;EACH,OAAO,CACL,GAAG,IAAI,OACP;GACE,MAAM;GACN,OAAO,QAAQ;GACf,QAAQ,UAAU,OAAO;GACzB,QAAQ,QAAQ,SAAS,QAAQ;EACnC,CACF;CACF;AACF;;AAGA,SAAgB,WAAW,KAAmC;CAC5D,OAAO;EACL,KAAK,IAAI;EACT,KAAK,IAAI;EACT,UAAU;EACV,QAAA;EACA,cAAc,IAAI;EAClB,OAAO,IAAI,MAAM,KAAK,UAAU;GAAE,MAAM,KAAK;GAAM,QAAQ,KAAK;GAAQ,OAAO,KAAK;EAAM,EAAE;CAC9F;AACF;;AAGA,SAAS,YAAY,MAAuB;CAC1C,OAAO,kBAAkB,KAAK,KAAK,gCAAgC,KAAK,KAAK,UAAU,KAAK,MAAM;AACpG;;AAGA,SAAS,UAAU,MAAuB;CACxC,OAAO;EACL;EACA,QAAQ,KAAK,MAAM;EACnB;EACA,yBAAyB,KAAK,KAAK,oCAAoC,KAAK,KAAK;CACnF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;;;AASA,SAAgB,gBAAgB,KAAkB;CAChD,MAAM,SAAS,IAAI,MAAM,IAAI,WAAW,CAAC,CAAC,KAAK,YAAY;CA2B3D,OAAO,GAAG;EAzBR;EACA;EACA;EACA;EACA;EACA,kBAAkB,IAAI,OAAO,GAAG,IAAI,KAAK;EACzC;EACA;EACA,oBAAoB,IAAI,SAAS,KAAK,GAAG,EAAE;EAC3C;EACA;EACA,4DAA4D,IAAI,SAAS,KAAK,GAAG,EAAE;EACnF;EACA;EACA,MAAM,OAAO;EACb;EACA;EACA;EACA;EACA,GAAG,IAAI,MAAM,IAAI,SAAS;EAC1B;EACA;EACA;EACA;CAEY,CAAC,CAAC,KAAK,IAAI,EAAE;AAC7B;;AAGA,SAAgB,qBAAqB,QAAiC;CACpE,IAAI,SAAS;CACb,IAAI,UAAU;CACd,IAAI,SAAyB;CAC7B,KAAK,MAAM,OAAO,OAAO,MAAM,IAAI,GAAG;EACpC,MAAM,OAAO,IAAI,KAAK;EACtB,IAAI,SAAS,IAAI;EACjB,IAAI,KAAK,WAAW,QAAQ,GAAG,OAAO;GAAE,MAAM;GAAS,QAAQ,KAAK,MAAM,CAAe;EAAE;EAC3F,IAAI,SAAS,UAAU;GACrB,SAAS;GACT;EACF;EACA,IAAI,SAAS,WAAW;GACtB,SAAS;GACT;EACF;EACA,IAAI,KAAK,WAAW,MAAM,GAAG;GAC3B,SAAS,KAAK,MAAM,CAAa;GACjC;EACF;EACA,IAAI,KAAK,WAAW,UAAU,GAAG;GAC/B,UAAU,KAAK,MAAM,CAAiB;GACtC;EACF;CACF;CACA,IAAI,WAAW,MAAM,YAAY,MAAM,WAAW,MAAM;EACtD,MAAM,OAAO,OAAO,KAAK;EACzB,OAAO;GACL,MAAM;GACN,QAAQ,SAAS,KAAK,qBAAqB,sBAAsB;EACnE;CACF;CACA,OAAO;EAAE,MAAM;EAAS;EAAQ;EAAS;CAAO;AAClD;;;AC3MA,MAAM,MAAM,UAAU,QAAQ;;AAG9B,MAAa,iBAAiB;AAa9B,SAAS,UAAU,KAAsB;CACvC,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD;AAEA,SAAS,UAAU,MAAgB,MAAkC;CACnE,MAAM,SAAS,KAAK,KAAK;CACzB,OAAO,KAAK,MAAM,MAAM,EAAE,WAAW,MAAM,CAAC,CAAC,EAAE,MAAM,OAAO,MAAM;AACpE;;AAGA,SAAS,YAAY,OAA+C;CAClE,MAAM,IAAI,OAAO,KAAK;CACtB,OAAO,UAAU,KAAA,KAAa,OAAO,SAAS,CAAC,KAAK,KAAK,IAAI,KAAK,MAAM,CAAC,IAAI,KAAA;AAC/E;;;;;AAMA,SAAgB,YAAY,MAA6B;CACvD,OAAO;EACL,YAAY,KAAK;EACjB,SAAS,KAAK;EACd,cAAc,KAAK,IAAI;EACvB,iBAAiB,KAAK,IAAI;EAC1B,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU;CACxE;AACF;;AAGA,SAAgB,YAAY,MAA6B;CACvD,MAAM,SAAS,UAAU,MAAM,QAAQ;CACvC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,+DAA+D;CAC5F,MAAM,OAAO,UAAU,MAAM,UAAU;CACvC,MAAM,UAAU,UAAU,MAAM,aAAa;CAC7C,IAAI,CAAC,QAAQ,CAAC,SACZ,MAAM,IAAI,MAAM,kFAAkF;CAEpG,OAAO;EACL,KAAK;GAAE;GAAM;EAAQ;EACrB,KAAK,UAAU,MAAM,KAAK,KAAK;EAC/B,UAAU,YAAY,UAAU,MAAM,WAAW,CAAC;EAClD;CACF;AACF;;;;;;;AAQA,SAAS,UAAiB;CACxB,QAAQ,KAAA,CAAmB;AAC7B;;AAGA,eAAe,KAAK,MAAqB,QAA+B;CACtE,QAAQ,OAAO,MAAM,YAAY,OAAO,GAAG;CAC3C,IAAI;EACF,MAAM,KAAK,KAAK,WAAW,MAAM,CAAC;CACpC,QAAQ,CAER;AACF;;AAGA,SAAS,cAAc,QAA+B,MAAqB,IAAoB;CAC7F,OAAO,YAAY,OAAO;CAC1B,OAAO,GAAG,SAAS,UAAkB;EACnC,KAAU,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,CAEnD,CAAC;CACH,CAAC;AACH;;;;;AAMA,eAAsB,WAAW,OAAiB,QAAQ,MAAuB;CAC/E,IAAI,KAAK,SAAS,WAAW,GAAG;EAC9B,MAAM,OAAO,UAAU,MAAM,UAAU,KAAK;EAC5C,MAAM,UAAU,UAAU,MAAM,aAAa,KAAK;EAClD,QAAQ,OAAO,MAAM,GAAG,YAAY;GAAE;GAAM;EAAQ,GAAG,WAAW,OAAO,EAAE,GAAG;EAC9E,OAAO;CACT;CACA,MAAM,OAAO,IAAIC,cAAM;EAAE,MAAM,QAAQ;EAAO,OAAO,QAAQ;CAAO,CAAC;CAErE,IAAI;CACJ,IAAI;EACF,SAAS,YAAY,IAAI;CAC3B,SAAS,KAAK;EAKZ,MAAM,KAAK,MAAM,UAAU,GAAG,CAAC;EAC/B,QAAQ;CACV;CACA,MAAM,EAAE,KAAK,UAAU,WAAW;CAElC,MAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,GAAG,YAAY,IAAI,QAAQ,OAAO,GAAG,EAAE,EAAE,CAAC;CAChF,MAAM,SAAS,KAAK,KAAK,IAAI;CAC7B,MAAM,UAAU,KAAK,KAAK,KAAK;CAE/B,IAAI,QAA6B;CACjC,IAAI,OAAsC;;;;;CAM1C,MAAM,WAAW,YAA2B;EAC1C,OAAO,KAAK;EACZ,MAAM,MAAM,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAClC,MAAM,GAAG,KAAK;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CAChE;;;;;;;CAQA,MAAM,oBAAoB;EACxB,SAAc,CAAC,CACZ,YAAY,CAAC,CAAC,CAAC,CACf,WAAW,QAAQ,KAAA,CAAmB,CAAC;CAC5C;CACA,KAAK,MAAM,UAAU;EAAC;EAAW;EAAU;CAAQ,GAAY,QAAQ,GAAG,QAAQ,WAAW;CAE7F,IAAI;EACF,MAAM,IAAI,UAAU;GAAC;GAAM;GAAO;GAAQ;EAAO,CAAC;CACpD,SAAS,KAAK;EACZ,MAAM,KAAK,MAAM,0CAA0C,UAAU,GAAG,GAAG;EAC3E,MAAM,SAAS;EACf,QAAQ;CACV;CAIA,MAAM,aAAa,uBAAuB,aAAa,QAAQ,OAAO;CACtE,MAAM,aAAa;EACjB;EACA,SAAS;EACT,GAAI,aAAa,KAAA,IAAY,CAAC,IAAI,CAAC,eAAe,UAAU;EAC5D,aAAa;EACb,cAAc;CAChB;CACA,MAAM,aAAa,MAAM,QAAQ,UAAU,YAAY,EAAE,OAAO;EAAC;EAAU;EAAQ;CAAM,EAAE,CAAC;CAC5F,QAAQ;CACR,cAAc,WAAW,QAAQ,MAAM,CAAC;CACxC,cAAc,WAAW,QAAQ,MAAM,CAAC;CAExC,MAAM,SAAS,IAAI,SAAiB,WAAW;EAG7C,WAAW,KAAK,SAAS,SAAS,OAAO,QAAQ,CAAC,CAAC;CACrD,CAAC;CAED,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,WAAW,WACX,OAAO,MAAM,SAAS;GACpB,MAAM,IAAI,MAAM,gCAAgC,KAAK,8BAA8B;EACrF,CAAC,CACH,CAAC;CACH,SAAS,KAAK;EACZ,MAAM,KAAK,MAAM,UAAU,GAAG,CAAC;EAC/B,MAAM,SAAS;EACf,QAAQ;CACV;CAGA,MAAM,QAAQ;CACd,MAAM,WAAW,SAAS;EACxB,KAAU,KAAK,IAAI,CAAC,CAAC,YAAY,CAEjC,CAAC;CACH,CAAC;CACD,KAAK,WAAW,SAAS;EACvB,MAAW,KAAK,IAAI,CAAC,CAAC,YAAY,CAElC,CAAC;CACH,CAAC;CACD,KAAK,cAAc;EACjB,OAAO,KAAK;CACd,CAAC;CAED,MAAM,OAAO,MAAM;CACnB,MAAM,SAAS;CACf,MAAM,KAAK,MAAM;CACjB,OAAO;AACT"}

package/dist/index.d.ts

@@ -20,7 +20,7 @@ declare function defineActor<Args, InternalState, InMsg extends Message, OutMsg
 //#endregion
 //#region src/version.d.ts
 /** posipaki's release version.  Must equal package.json's `version`. */
-declare const LIB_VERSION = "0.33.0";
+declare const LIB_VERSION = "0.34.0";
 //#endregion
 export { type ActorConfig, type ActorContext, type ActorDecorated, type ActorDefinition, type ActorPlugin, type ActorReflection, type AnyProcess, AsyncProcess, type AsyncProcessFn, type ExitMessage, type HandlerFn, type HandlerOptions, type HookResult, LIB_VERSION, type Message, type MethodOptions, type PluginTransform, Process, type ProcessCtx, type ProcessFn, type SenderInfo, type SenderOrigin, type SpawnedFrom, type StopMessage, type WithSender, type WithoutSender, asyncify, callHook, chainHook, defineActor, defineMessages, mergeConfigs, propagateError, runDispatch, runDispatchAsync, spawn, spawnAsync, stopPropagation };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,7 +1,7 @@
 import { i as runDispatch } from "./util-Brtfgv68.js";
 import { a as spawnAsync, i as runDispatchAsync, n as defineMessages, o as asyncify, r as AsyncProcess, t as defineActor } from "./define-actor-DqOW2StX.js";
 import { n as chainHook, o as propagateError, r as mergeConfigs, s as stopPropagation, t as callHook } from "./hooks-CgXhmY4r.js";
-import { t as LIB_VERSION } from "./version-W7guWJeR.js";
+import { t as LIB_VERSION } from "./version-DLA1LhFe.js";
 //#region src/process.ts
 /** @deprecated Use {@link spawnAsync} instead. */
 function spawn(fn, pname, tp) {

package/dist/remote/gateway-cli.js

@@ -1,4 +1,4 @@
-import { a as runGateway } from "../gateway-BGdUHktZ.js";
+import { i as runGateway } from "../gateway-BytuRl_6.js";
 //#region src/remote/gateway-cli.ts
 (async () => {
 	try {

package/dist/remote/gateway-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-cli.js","names":[],"sources":["../../src/remote/gateway-cli.ts"],"sourcesContent":["// ── The gateway, as a program ──────────────────────────────────────────────\n//\n// A gateway is something a client runs: the first-stage command that makes a fifo\n// inside a foreign environment and relays frames between its own stdin/stdout and\n// the payload.  That is this file's whole job — it always serves, and it exits with\n// the code the run ended in.\n//\n// Serving lives in ./gateway.js and starts nothing by itself.  A file cannot decide\n// \"am I the program?\" from where it is: a consumer that bundles the node surface\n// into its own program carries this code along, and there the bundle *is* the\n// program — a payload would find a gateway booting on its wire.  So the decision is\n// in the layout instead: importing a module never starts anything, and running this\n// one always does.\n\nimport { GATEWAY_FAILED, runGateway } from \"./gateway.js\";\n\nvoid (async () => {\n  try {\n    process.exitCode = await runGateway();\n  } catch (err) {\n    process.stderr.write(`gateway: ${err instanceof Error ? err.message : String(err)}\\n`);\n    process.exitCode = GATEWAY_FAILED;\n  }\n})();\n"],"mappings":";;CAgBM,YAAY;CAChB,IAAI;EACF,QAAQ,WAAW,MAAM,WAAW;CACtC,SAAS,KAAK;EACZ,QAAQ,OAAO,MAAM,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,GAAG;EACrF,QAAQ,WAAA;CACV;AACF,EAAA,CAAG"}
+{"version":3,"file":"gateway-cli.js","names":[],"sources":["../../src/remote/gateway-cli.ts"],"sourcesContent":["// ── The gateway, as a program ──────────────────────────────────────────────\n//\n// A gateway is something a client runs: the first-stage command that makes a fifo\n// inside a foreign environment and relays frames between its own stdin/stdout and\n// the payload.  That is this file's whole job — it always serves, and it exits with\n// the code the run ended in.\n//\n// Serving lives in ./gateway.js and starts nothing by itself.  A file cannot decide\n// \"am I the program?\" from where it is: a consumer that bundles the node surface\n// into its own program carries this code along, and there the bundle *is* the\n// program — a payload would find a gateway booting on its wire.  So the decision is\n// in the layout instead: importing a module never starts anything, and running this\n// one always does.\n//\n// The client names it either way: `posipaki/remote/gateway-cli.js` is a published\n// specifier, so `import.meta.resolve` answers with the built file, and a consumer\n// with a program of its own stages that instead.  Nothing here works out its own\n// location — a path derived from `import.meta.url` is a guess about a layout the\n// bundler owns, and the guess is wrong the moment the module moves into a chunk.\n\nimport { GATEWAY_FAILED, runGateway } from \"./gateway.js\";\n\nvoid (async () => {\n  try {\n    process.exitCode = await runGateway();\n  } catch (err) {\n    process.stderr.write(`gateway: ${err instanceof Error ? err.message : String(err)}\\n`);\n    process.exitCode = GATEWAY_FAILED;\n  }\n})();\n"],"mappings":";;CAsBM,YAAY;CAChB,IAAI;EACF,QAAQ,WAAW,MAAM,WAAW;CACtC,SAAS,KAAK;EACZ,QAAQ,OAAO,MAAM,YAAY,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,GAAG;EACrF,QAAQ,WAAA;CACV;AACF,EAAA,CAAG"}

package/dist/remote/node.d.ts

@@ -244,12 +244,6 @@ declare function parseBootstrapReport(stdout: string): BootstrapReport;
 //#region src/remote/gateway.d.ts
 /** Exit code for "this environment could not be set up". */
 declare const GATEWAY_FAILED = 1;
-/**
- * Absolute path to the gateway's entry point — the file a client runs as a
- * program.  It is this module's sibling, under whatever name this module has:
- * `gateway-cli.ts` from source, `gateway-cli.js` in a build.
- */
-declare const GATEWAY_SCRIPT: string;
 interface GatewayBoot {
   /** Who staged this payload.  Names the artifact in its `--version` line. */
   app: KitApp;
@@ -273,5 +267,5 @@ declare function gatewayBoot(argv: string[]): GatewayBoot;
  */
 declare function runGateway(argv?: string[]): Promise<number>;
 //#endregion
-export { type ArtifactRole, type BootstrapReport, type ClientChannelOptions, DEFAULT_KIT_PARENT, DEFAULT_RUNTIMES, FifoUtf8NlineTransport, GATEWAY_FAILED, GATEWAY_SCRIPT, type GatewayBoot, HANDSHAKE_TIMEOUT_MS, KIT_LAYOUT, type Kit, type KitApp, type KitFile, type LineStreams, LineTransport, type MakeKitOptions, type OutputFd, OutputFilter, type OutputFrame, type OutputSink, StdioWireError, type SubprocessActorBundle, type SubprocessActorOptions, bootstrapScript, clientChannel, commandSpawner, defineSubprocessActor, errorFrame, errorReason, fdStreams, fifoArgvSpawner, gatewayArgs, gatewayBoot, kitName, kitVersion, makeKit, outputFrame, parseBootstrapReport, parseOutputFrame, runGateway, serverChannel, sha256Hex, stderrSink, versionLine };
+export { type ArtifactRole, type BootstrapReport, type ClientChannelOptions, DEFAULT_KIT_PARENT, DEFAULT_RUNTIMES, FifoUtf8NlineTransport, GATEWAY_FAILED, type GatewayBoot, HANDSHAKE_TIMEOUT_MS, KIT_LAYOUT, type Kit, type KitApp, type KitFile, type LineStreams, LineTransport, type MakeKitOptions, type OutputFd, OutputFilter, type OutputFrame, type OutputSink, StdioWireError, type SubprocessActorBundle, type SubprocessActorOptions, bootstrapScript, clientChannel, commandSpawner, defineSubprocessActor, errorFrame, errorReason, fdStreams, fifoArgvSpawner, gatewayArgs, gatewayBoot, kitName, kitVersion, makeKit, outputFrame, parseBootstrapReport, parseOutputFrame, runGateway, serverChannel, sha256Hex, stderrSink, versionLine };
 //# sourceMappingURL=node.d.ts.map

package/dist/remote/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","names":[],"sources":["../../src/remote/transports/fifo.ts","../../src/remote/spawners/fifo-command.ts","../../src/remote/spawners/fifo-argv.ts","../../src/remote/define-subprocess.ts","../../src/remote/stdio.ts","../../src/remote/kit.ts","../../src/remote/gateway.ts"],"mappings":";;;;;;cAUa,kCAAkC;UACrC;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAED;SAuCA,aAAa,QAAQ,aAAa;SAIlC,aAAa,SAAS,aAAa;SAInC,QAAQ,QAAQ,YAAY,SAAS,aAAa;;;;;;;;;;;;SAiBlD,aACL,kBACA;IACG,WAAW,QAAQ;;;;;;;;;;;;SAqBX,QAAQ,kBAAkB,oBAAoB,QAAQ;MAS/D;EAIJ,UAAU,UAAU;EASpB,mBAAmB;EAMnB,QAAQ;MAIJ;MAIA,aAAa;EAIX,KAAK,eAAe;EAOpB,SAAS;UAMD;;;;iBCpJA,eAAe,0BAA0B,QAAQ;;;iBCN3C,mBAAmB,QAAQ;;;UCOhC;EACf;;UAGe,sBACf,MACA,OACA,cAAc,SACd,eAAe,SACf,UAAU;EAEV,OAAO,gBAAgB,MAAM,OAAO,OAAO,QAAQ;EACnD,iBAAiB;EACjB;;iBASc,sBACd,MACA,OACA,cAAc,SACd,eAAe,SACf,gBAAgB,eAChB,iBAAiB,eAAe,QAChC,UAAU,mBAEV,OAAO,gBAAgB,MAAM,OAAO,OAAO,QAAQ,IACnD,aACA,OAAM,yBACL,sBAAsB,MAAM,OAAO,OAAO,QAAQ;;;;UCvBpC;EACf,MAAM;EACN,OAAO;;;KAIG;;KAGA,cAAc,IAAI,UAAU;;cAG3B;;cAOA,uBAAuB;EAClC,YAAY;;;UASG;EACf,IAAI;EACJ;;iBAGc,YAAY,IAAI,UAAU;;iBAK1B,iBAAiB,eAAe;iBAiBhC,WAAW;;iBAKX,YAAY,OAAO;;;;;;;cA2BtB,yBAAyB;mBACnB;UACT;UACA;UACA;UACA;EAER,YAAY,SAAS;MAoBjB;MAIA;EAIJ,UAAU,UAAU;EAQpB,mBAAmB;EAMnB,QAAQ;EAIR,KAAK,gBAAgB;EAuBf,SAAS;UAKD;;;iBAoBA,UAAU,gBAAgB,kBAAkB;;;;;cAU/C,wBAAwB;mBAClB;mBACA;EAEjB,YAAY,OAAO,iBAAiB,MAAM;EAK1C,KAAK,uBAAuB;EAI5B,UAAU,UAAU;EAQpB;EAIA,QAAQ;EAIR,SAAS;;;iBAQK,WAAW,gBAAY;UA2BtB;;EAEf,WAAW;;EAEX;;;;;;;iBAQoB,cACpB,SAAS,aACT,OAAM,uBACL,QAAQ;;iBAkBW,cAAc,SAAS,cAAc,QAAQ;;;;cC/StD;;cAGA;;cAGA;UAEI;;EAEf;;EAEA;;EAEA;;EAEA;;;UAIe;EACf;EACA;;UAGe;;EAEf;;EAEA;;EAEA,OAAO;;EAEP;;EAEA;;EAEA,KAAK;;UAGU;;EAEf,KAAK;;EAEL;;EAEA;;KAGU;EACN;EAAe;EAAgB;EAAiB;;EAChD;EAAe;;;KAGT;;iBAGI,UAAU,kBAAkB;;iBAK5B,QAAQ,KAAK,QAAQ;;;;;;iBASrB,YAAY,KAAK,QAAQ,MAAM,cAAc;;;;;;iBAgB7C,QACd;EAAS;EAAc,kBAAkB;KACzC,SAAS,iBACR;;iBAgCa,WAAW,KAAK,MAAM;;;;;;;;iBAiCtB,gBAAgB,KAAK;;iBAgCrB,qBAAqB,iBAAiB;;;;cCtKzC;;;;;;cAOA;UAKI;;EAEf,KAAK;;EAEL;;EAEA;;EAEA;;;;;;iBAsBc,YAAY,MAAM;;iBAWlB,YAAY,iBAAiB;;;;;iBAkDvB,WAAW,kBAAgC"}
+{"version":3,"file":"node.d.ts","names":[],"sources":["../../src/remote/transports/fifo.ts","../../src/remote/spawners/fifo-command.ts","../../src/remote/spawners/fifo-argv.ts","../../src/remote/define-subprocess.ts","../../src/remote/stdio.ts","../../src/remote/kit.ts","../../src/remote/gateway.ts"],"mappings":";;;;;;cAUa,kCAAkC;UACrC;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAED;SAuCA,aAAa,QAAQ,aAAa;SAIlC,aAAa,SAAS,aAAa;SAInC,QAAQ,QAAQ,YAAY,SAAS,aAAa;;;;;;;;;;;;SAiBlD,aACL,kBACA;IACG,WAAW,QAAQ;;;;;;;;;;;;SAqBX,QAAQ,kBAAkB,oBAAoB,QAAQ;MAS/D;EAIJ,UAAU,UAAU;EASpB,mBAAmB;EAMnB,QAAQ;MAIJ;MAIA,aAAa;EAIX,KAAK,eAAe;EAOpB,SAAS;UAMD;;;;iBCpJA,eAAe,0BAA0B,QAAQ;;;iBCN3C,mBAAmB,QAAQ;;;UCOhC;EACf;;UAGe,sBACf,MACA,OACA,cAAc,SACd,eAAe,SACf,UAAU;EAEV,OAAO,gBAAgB,MAAM,OAAO,OAAO,QAAQ;EACnD,iBAAiB;EACjB;;iBASc,sBACd,MACA,OACA,cAAc,SACd,eAAe,SACf,gBAAgB,eAChB,iBAAiB,eAAe,QAChC,UAAU,mBAEV,OAAO,gBAAgB,MAAM,OAAO,OAAO,QAAQ,IACnD,aACA,OAAM,yBACL,sBAAsB,MAAM,OAAO,OAAO,QAAQ;;;;UCvBpC;EACf,MAAM;EACN,OAAO;;;KAIG;;KAGA,cAAc,IAAI,UAAU;;cAG3B;;cAOA,uBAAuB;EAClC,YAAY;;;UASG;EACf,IAAI;EACJ;;iBAGc,YAAY,IAAI,UAAU;;iBAK1B,iBAAiB,eAAe;iBAiBhC,WAAW;;iBAKX,YAAY,OAAO;;;;;;;cA2BtB,yBAAyB;mBACnB;UACT;UACA;UACA;UACA;EAER,YAAY,SAAS;MAoBjB;MAIA;EAIJ,UAAU,UAAU;EAQpB,mBAAmB;EAMnB,QAAQ;EAIR,KAAK,gBAAgB;EAuBf,SAAS;UAKD;;;iBAoBA,UAAU,gBAAgB,kBAAkB;;;;;cAU/C,wBAAwB;mBAClB;mBACA;EAEjB,YAAY,OAAO,iBAAiB,MAAM;EAK1C,KAAK,uBAAuB;EAI5B,UAAU,UAAU;EAQpB;EAIA,QAAQ;EAIR,SAAS;;;iBAQK,WAAW,gBAAY;UA2BtB;;EAEf,WAAW;;EAEX;;;;;;;iBAQoB,cACpB,SAAS,aACT,OAAM,uBACL,QAAQ;;iBAkBW,cAAc,SAAS,cAAc,QAAQ;;;;cC/StD;;cAGA;;cAGA;UAEI;;EAEf;;EAEA;;EAEA;;EAEA;;;UAIe;EACf;EACA;;UAGe;;EAEf;;EAEA;;EAEA,OAAO;;EAEP;;EAEA;;EAEA,KAAK;;UAGU;;EAEf,KAAK;;EAEL;;EAEA;;KAGU;EACN;EAAe;EAAgB;EAAiB;;EAChD;EAAe;;;KAGT;;iBAGI,UAAU,kBAAkB;;iBAK5B,QAAQ,KAAK,QAAQ;;;;;;iBASrB,YAAY,KAAK,QAAQ,MAAM,cAAc;;;;;;iBAgB7C,QACd;EAAS;EAAc,kBAAkB;KACzC,SAAS,iBACR;;iBAgCa,WAAW,KAAK,MAAM;;;;;;;;iBAiCtB,gBAAgB,KAAK;;iBAgCrB,qBAAqB,iBAAiB;;;;cCvKzC;UAEI;;EAEf,KAAK;;EAEL;;EAEA;;EAEA;;;;;;iBAsBc,YAAY,MAAM;;iBAWlB,YAAY,iBAAiB;;;;;iBAkDvB,WAAW,kBAAgC"}

package/dist/remote/node.js

@@ -1,6 +1,6 @@
 import { c as isProto, i as json1Channel, t as VERSION } from "../json1-DS3xxg13.js";
 import { r as serveRemoteActor, t as remoteClient } from "../client-D23TlXPf.js";
-import { C as fdStreams, D as stderrSink, E as serverChannel, O as FifoUtf8NlineTransport, S as errorReason, T as parseOutputFrame, _ as LineTransport, a as runGateway, b as clientChannel, c as KIT_LAYOUT, d as kitVersion, f as makeKit, g as HANDSHAKE_TIMEOUT_MS, h as versionLine, i as gatewayBoot, l as bootstrapScript, m as sha256Hex, n as GATEWAY_SCRIPT, o as DEFAULT_KIT_PARENT, p as parseBootstrapReport, r as gatewayArgs, s as DEFAULT_RUNTIMES, t as GATEWAY_FAILED, u as kitName, v as OutputFilter, w as outputFrame, x as errorFrame, y as StdioWireError } from "../gateway-BGdUHktZ.js";
+import { C as outputFrame, D as FifoUtf8NlineTransport, E as stderrSink, S as fdStreams, T as serverChannel, _ as OutputFilter, a as DEFAULT_KIT_PARENT, b as errorFrame, c as bootstrapScript, d as makeKit, f as parseBootstrapReport, g as LineTransport, h as HANDSHAKE_TIMEOUT_MS, i as runGateway, l as kitName, m as versionLine, n as gatewayArgs, o as DEFAULT_RUNTIMES, p as sha256Hex, r as gatewayBoot, s as KIT_LAYOUT, t as GATEWAY_FAILED, u as kitVersion, v as StdioWireError, w as parseOutputFrame, x as errorReason, y as clientChannel } from "../gateway-BytuRl_6.js";
 import { unlink } from "node:fs/promises";
 import { execSync, spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
@@ -84,6 +84,6 @@ function defineSubprocessActor(actor, url, opts = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_KIT_PARENT, DEFAULT_RUNTIMES, FifoUtf8NlineTransport, GATEWAY_FAILED, GATEWAY_SCRIPT, HANDSHAKE_TIMEOUT_MS, KIT_LAYOUT, LineTransport, OutputFilter, StdioWireError, bootstrapScript, clientChannel, commandSpawner, defineSubprocessActor, errorFrame, errorReason, fdStreams, fifoArgvSpawner, gatewayArgs, gatewayBoot, kitName, kitVersion, makeKit, outputFrame, parseBootstrapReport, parseOutputFrame, runGateway, serverChannel, sha256Hex, stderrSink, versionLine };
+export { DEFAULT_KIT_PARENT, DEFAULT_RUNTIMES, FifoUtf8NlineTransport, GATEWAY_FAILED, HANDSHAKE_TIMEOUT_MS, KIT_LAYOUT, LineTransport, OutputFilter, StdioWireError, bootstrapScript, clientChannel, commandSpawner, defineSubprocessActor, errorFrame, errorReason, fdStreams, fifoArgvSpawner, gatewayArgs, gatewayBoot, kitName, kitVersion, makeKit, outputFrame, parseBootstrapReport, parseOutputFrame, runGateway, serverChannel, sha256Hex, stderrSink, versionLine };
 
 //# sourceMappingURL=node.js.map

package/dist/{version-W7guWJeR.js → version-DLA1LhFe.js}

@@ -1,7 +1,7 @@
 //#region src/version.ts
 /** posipaki's release version.  Must equal package.json's `version`. */
-const LIB_VERSION = "0.33.0";
+const LIB_VERSION = "0.34.0";
 //#endregion
 export { LIB_VERSION as t };
 
-//# sourceMappingURL=version-W7guWJeR.js.map
+//# sourceMappingURL=version-DLA1LhFe.js.map

package/dist/{version-W7guWJeR.js.map → version-DLA1LhFe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"version-W7guWJeR.js","names":[],"sources":["../src/version.ts"],"sourcesContent":["// ── Library identity ───────────────────────────────────────────────────────\n//\n// posipaki's own release version, as a plain inlined string.  A consumer that\n// stages artifacts onto a host it knows nothing about has to name those\n// artifacts after which posipaki they speak, and the bundle that runs there has\n// no node_modules and no posipaki on disk — it can never read a file to find out.\n//\n// It is not the protocol version: that is `VERSION` in ./remote (`json.v1`), and\n// it does not move between releases.  The two answer different questions.\n//\n// version.test.ts pins this to package.json, so a release that forgets to bump it\n// fails the suite rather than shipping a lie.\n\n/** posipaki's release version.  Must equal package.json's `version`. */\nexport const LIB_VERSION = \"0.33.0\";\n"],"mappings":";;AAcA,MAAa,cAAc"}
+{"version":3,"file":"version-DLA1LhFe.js","names":[],"sources":["../src/version.ts"],"sourcesContent":["// ── Library identity ───────────────────────────────────────────────────────\n//\n// posipaki's own release version, as a plain inlined string.  A consumer that\n// stages artifacts onto a host it knows nothing about has to name those\n// artifacts after which posipaki they speak, and the bundle that runs there has\n// no node_modules and no posipaki on disk — it can never read a file to find out.\n//\n// It is not the protocol version: that is `VERSION` in ./remote (`json.v1`), and\n// it does not move between releases.  The two answer different questions.\n//\n// version.test.ts pins this to package.json, so a release that forgets to bump it\n// fails the suite rather than shipping a lie.\n\n/** posipaki's release version.  Must equal package.json's `version`. */\nexport const LIB_VERSION = \"0.34.0\";\n"],"mappings":";;AAcA,MAAa,cAAc"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posipaki",
-  "version": "0.33.1",
+  "version": "0.34.0",
   "homepage": "https://posipaki-docs.muromec.nl/",
   "repository": {
     "type": "git",
@@ -43,6 +43,7 @@
       "types": "./dist/remote/node.d.ts",
       "default": "./dist/remote/node.js"
     },
+    "./remote/gateway-cli.js": "./dist/remote/gateway-cli.js",
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"