@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/runtime/process/resource/native-manager.js

@@ -0,0 +1,646 @@
+import { randomUUID } from "node:crypto";
+import { Clock, Effect, Exit, Fiber, FiberSet, Option, Ref, } from "effect";
+import { makeNodeRuntimeError } from "../../errors.js";
+import { macosCooperativeProcessResourceCapability, projectProcessResourceManagerHealth, projectProcessResourceObservations, } from "./health.js";
+import { validProcessHostCapabilityForTier } from "./host-launch.js";
+import { processResourceManagerAuthorizedSpawn, processResourceManagerRevokeCodexAuthorization, processResourceManagerRevokePiRpcAuthorization, } from "./internal-spawn.js";
+import { verifyProcessLaunchAuthority } from "./launch-authority.js";
+import { nativeHostCapability, nativeHostTargetSource, } from "./native-host-capability.js";
+import { projectNativeHostSamplingDiagnostics, projectNativeHostSnapshot, } from "./native-host-projection.js";
+import { piRpcAuthorizationForRequest } from "./pi-rpc-launch-authority.js";
+import { normalizeProcessLaunch, processResourcePolicy } from "./policy.js";
+import { recordActiveTrees, recordProcessOutcome } from "./telemetry.js";
+const managerError = (message) => makeNodeRuntimeError("transport_failed", message);
+const codexDenied = () => makeNodeRuntimeError("transport_failed", "The process consumer is not source-enabled.");
+const requireAdmission = Effect.fn("ProcessResourceManager.nativeAdmit")(function* (state) {
+    const admitted = yield* Ref.modify(state.accounting, (current) => {
+        if (current.admissionUsedTrees >= processResourcePolicy.maximumActiveTrees) {
+            return [false, current];
+        }
+        return [
+            true,
+            {
+                ...current,
+                admissionUsedTrees: current.admissionUsedTrees + 1,
+            },
+        ];
+    });
+    if (!admitted) {
+        return yield* Effect.fail(managerError("The managed process capacity is exhausted."));
+    }
+    return yield* Ref.make("held");
+});
+const releasePermitEffect = Effect.fn("ProcessResourceManager.nativeRelease")(function* (state, permit) {
+    const release = yield* Ref.modify(permit, (current) => [
+        current === "held",
+        current === "held" ? "released" : current,
+    ]);
+    if (release) {
+        yield* Ref.update(state.accounting, (current) => ({
+            ...current,
+            admissionUsedTrees: current.admissionUsedTrees - 1,
+        }));
+    }
+});
+const releasePermit = (state, permit) => releasePermitEffect(state, permit).pipe(Effect.uninterruptible);
+const initialLifecycle = () => ({
+    cleanup: { state: "active" },
+    exit: { state: "running" },
+    settled: false,
+});
+const isQualifiedRuntime = (targetTriple, runtimeIdentity) => targetTriple === "darwin-arm64" &&
+    runtimeIdentity.platform === "darwin" &&
+    runtimeIdentity.architecture === "arm64";
+const selectedTierFor = (request) => {
+    switch (request.owner.kind) {
+        case "git-inspection":
+            return "vouched_runtime";
+        case "interactive-terminal":
+            return "local_user_interactive_terminal";
+        case "pi-rpc-probe":
+        case "pi-rpc-session":
+            return "cooperative_pi_rpc_conversation";
+        case "codex-probe":
+        case "codex-session":
+            return "cooperative_multi_pgid";
+    }
+};
+const isCodexOwner = (owner) => owner.kind === "codex-probe" || owner.kind === "codex-session";
+const validCodexAuthorization = (codex, request) => codex.vouchTarget.adapter === "codex" &&
+    codex.vouchTarget.executablePath === request.executable &&
+    codex.vouchTarget.ownerKinds.includes(request.owner.kind) &&
+    codex.policy.adapterVersion === codex.vouchTarget.adapterVersion &&
+    codex.policy.sandboxPolicyRevision ===
+        codex.vouchTarget.sandboxPolicyRevision &&
+    codex.policy.vouchPolicyRevision === codex.vouchTarget.vouchPolicyRevision;
+const codexAuthorizationForRequest = (request, launchAuthorization) => {
+    if (!isCodexOwner(request.owner))
+        return undefined;
+    const codex = launchAuthorization?.codex;
+    return codex !== undefined && validCodexAuthorization(codex, request)
+        ? codex
+        : undefined;
+};
+const invalidLaunch = (error) => ({
+    error,
+    state: "invalid",
+});
+const selectedAuthorization = (codex, piRpc) => {
+    if (codex !== undefined)
+        return Object.freeze({ codex });
+    if (piRpc !== undefined)
+        return Object.freeze({ piRpc });
+};
+const selectAuthorization = (request, launchAuthorization) => {
+    const codex = codexAuthorizationForRequest(request, launchAuthorization);
+    const piRpc = piRpcAuthorizationForRequest(request, launchAuthorization);
+    const invalid = (launchAuthorization?.codex !== undefined &&
+        launchAuthorization.piRpc !== undefined) ||
+        (launchAuthorization?.codex !== undefined && codex === undefined) ||
+        (launchAuthorization?.piRpc !== undefined && piRpc === undefined) ||
+        ((request.owner.kind === "pi-rpc-probe" ||
+            request.owner.kind === "pi-rpc-session") &&
+            piRpc === undefined);
+    if (invalid)
+        return { state: "invalid" };
+    const authorization = selectedAuthorization(codex, piRpc);
+    return {
+        ...(authorization === undefined ? {} : { authorization }),
+        state: "valid",
+    };
+};
+const selectNormalizedLaunch = (request, launchAuthorization) => {
+    const selection = selectAuthorization(request, launchAuthorization);
+    if (selection.state === "invalid")
+        return invalidLaunch(codexDenied());
+    return {
+        ...(selection.authorization === undefined
+            ? {}
+            : { authorization: selection.authorization }),
+        request: {
+            ...request,
+            selectedTier: selectedTierFor(request),
+        },
+        state: "valid",
+    };
+};
+const selectRegisteredLaunch = (input) => {
+    const normalized = normalizeProcessLaunch(input.request);
+    if (normalized.state === "invalid")
+        return invalidLaunch(normalized.error);
+    if (!isQualifiedRuntime(input.targetTriple, input.runtimeIdentity)) {
+        return invalidLaunch(managerError("A qualified Maia native process host is unavailable."));
+    }
+    return selectNormalizedLaunch(normalized.request, input.launchAuthorization);
+};
+const validPrepared = (prepared, state, request) => prepared.targetTriple === state.targetTriple &&
+    prepared.selectedTier === request.selectedTier &&
+    validProcessHostCapabilityForTier(prepared.capabilityBitmap, prepared.selectedTier);
+const makePreparedEntry = (input, lifecycle, treeId) => ({
+    ...(input.authorization === undefined
+        ? {}
+        : { authorization: input.authorization }),
+    capabilityBitmap: input.prepared.capabilityBitmap,
+    lifecycle,
+    permit: input.permit,
+    request: input.request,
+    treeId,
+});
+const trackRegisteredEntry = Effect.fnUntraced(function* (state, treeId) {
+    yield* Ref.update(state.accounting, (current) => ({
+        ...current,
+        activeTrees: current.activeTrees + 1,
+        trackedTreeIds: new Set(current.trackedTreeIds).add(treeId),
+    }));
+    yield* recordActiveTrees((yield* Ref.get(state.accounting)).trackedTreeIds.size);
+    yield* recordProcessOutcome("registered");
+});
+const registerPreparedEntry = Effect.fn("ProcessResourceManager.registerPrepared")(function* (input) {
+    if (!validPrepared(input.prepared, input.state, input.request)) {
+        return yield* Effect.fail(managerError("The native process-host capability is not admitted."));
+    }
+    const treeId = `process_${randomUUID().replaceAll("-", "")}`;
+    const entry = makePreparedEntry(input, yield* Ref.make(initialLifecycle()), treeId);
+    input.state.entries.set(treeId, entry);
+    yield* trackRegisteredEntry(input.state, treeId);
+    return entry;
+});
+const cleanupReason = (lifecycle, exit) => lifecycle.terminationReason ??
+    (exit.state === "failed" ? "host_failure" : "leader_exited");
+const claimSettlement = (entry, settlement) => Ref.modify(entry.lifecycle, (current) => {
+    if (current.settled)
+        return [undefined, current];
+    const reason = cleanupReason(current, settlement.exit);
+    const clean = settlement.cleanup?.state === "clean";
+    return [
+        { clean, reason },
+        {
+            ...current,
+            cleanup: clean
+                ? { reason, state: "terminated" }
+                : { reason, state: "cleanup_unknown" },
+            exit: settlement.exit,
+            settled: true,
+        },
+    ];
+});
+const authorizationTerminalReason = (claim) => {
+    if (!claim.clean)
+        return "cleanup_unknown";
+    if (claim.reason === "authorization_revoked")
+        return "revoked_after_start";
+    return claim.reason === "host_failure" ? "failed" : "completed";
+};
+const lifecycleAuthorization = (authorization) => authorization?.codex ?? authorization?.piRpc;
+const settleLaunchFailure = (authorization) => lifecycleAuthorization(authorization)?.onLaunchFailed("failed") ??
+    Effect.void;
+const settleAuthorizedLifecycle = (entry, reason) => {
+    const authorization = lifecycleAuthorization(entry.authorization);
+    if (authorization === undefined)
+        return Effect.void;
+    return authorization.onTreeSettled(reason);
+};
+const releaseCleanSettlement = Effect.fnUntraced(function* (state, entry, claim) {
+    yield* Ref.update(state.accounting, (current) => {
+        const trackedTreeIds = new Set(current.trackedTreeIds);
+        const watcherTreeIds = new Set(current.watcherTreeIds);
+        trackedTreeIds.delete(entry.treeId);
+        watcherTreeIds.delete(entry.treeId);
+        return {
+            ...current,
+            activeTrees: current.activeTrees - 1,
+            admissionUsedTrees: current.admissionUsedTrees - 1,
+            trackedTreeIds,
+            watcherTreeIds,
+        };
+    });
+    state.entries.delete(entry.treeId);
+    yield* Ref.set(entry.permit, "released");
+    yield* recordProcessOutcome(`terminated:${claim.reason}`);
+});
+const fenceUnknownSettlement = Effect.fnUntraced(function* (state, entry, claim) {
+    yield* Ref.update(state.accounting, (current) => {
+        const watcherTreeIds = new Set(current.watcherTreeIds);
+        watcherTreeIds.delete(entry.treeId);
+        return {
+            ...current,
+            activeTrees: current.activeTrees - 1,
+            cleanupUnknownTrees: current.cleanupUnknownTrees + 1,
+            fencedTrees: current.fencedTrees + 1,
+            watcherTreeIds,
+        };
+    });
+    yield* Ref.set(entry.permit, "fenced");
+    yield* recordProcessOutcome("cleanup_unknown");
+    yield* Effect.logError("maia.node.process_resource_cleanup_unknown", new Map([
+        ["ownerKind", entry.request.owner.kind],
+        ["reason", claim.reason],
+        ["treeId", entry.treeId],
+    ]));
+});
+const logAuthorizationSettlementFailure = (entry, phase) => Effect.logError("maia.node.process_resource_authorization_settlement_failed", new Map([
+    ["ownerKind", entry.request.owner.kind],
+    ["phase", phase],
+    ["treeId", entry.treeId],
+]));
+const settleCleanEntry = Effect.fnUntraced(function* (state, entry, claim) {
+    const terminalReason = authorizationTerminalReason(claim);
+    const settled = yield* Effect.result(settleAuthorizedLifecycle(entry, terminalReason));
+    if (settled._tag === "Success") {
+        yield* releaseCleanSettlement(state, entry, claim);
+        return;
+    }
+    yield* logAuthorizationSettlementFailure(entry, "tree_settled_clean");
+    yield* Effect.result(settleAuthorizedLifecycle(entry, "cleanup_unknown"));
+    yield* Ref.update(entry.lifecycle, (current) => ({
+        ...current,
+        cleanup: { reason: claim.reason, state: "cleanup_unknown" },
+    }));
+    yield* fenceUnknownSettlement(state, entry, claim);
+});
+const settleUnknownEntry = Effect.fnUntraced(function* (state, entry, claim) {
+    const settled = yield* Effect.result(settleAuthorizedLifecycle(entry, "cleanup_unknown"));
+    if (settled._tag !== "Success") {
+        yield* logAuthorizationSettlementFailure(entry, "tree_settled_cleanup_unknown");
+    }
+    yield* fenceUnknownSettlement(state, entry, claim);
+});
+const settleEntry = Effect.fn("ProcessResourceManager.settleNativeEntry")(function* (state, entry, settlement) {
+    const claim = yield* claimSettlement(entry, settlement);
+    if (claim === undefined)
+        return;
+    yield* claim.clean
+        ? settleCleanEntry(state, entry, claim)
+        : settleUnknownEntry(state, entry, claim);
+    yield* recordActiveTrees((yield* Ref.get(state.accounting)).trackedTreeIds.size);
+});
+const failedExit = (protocol) => ({
+    reason: protocol ? "host_protocol_failed" : "host_failed",
+    state: "failed",
+});
+const settlementFrom = (exit, cleanup) => ({
+    ...(cleanup._tag === "Success" ? { cleanup: cleanup.success } : {}),
+    exit: exit._tag === "Success" ? exit.success : failedExit(true),
+});
+// A watcher lives for the complete child lifetime. The adapter owns one
+// standalone scoped lifecycle span, so this waiter keeps no launch stack.
+const watchEntry = Effect.fnUntraced(function* (state, entry) {
+    yield* Ref.update(state.accounting, (current) => ({
+        ...current,
+        watcherTreeIds: new Set(current.watcherTreeIds).add(entry.treeId),
+    }));
+    return yield* Effect.gen(function* () {
+        const process_ = entry.process;
+        if (process_ === undefined)
+            return;
+        const exit = yield* Effect.result(process_.exit);
+        const cleanup = yield* Effect.result(process_.cleanup);
+        yield* settleEntry(state, entry, settlementFrom(exit, cleanup)).pipe(Effect.uninterruptible);
+    }).pipe(Effect.ensuring(Ref.update(state.accounting, (current) => {
+        const watcherTreeIds = new Set(current.watcherTreeIds);
+        watcherTreeIds.delete(entry.treeId);
+        return { ...current, watcherTreeIds };
+    })));
+});
+const setTerminationReason = (entry, reason) => Ref.update(entry.lifecycle, (current) => ({
+    ...current,
+    terminationReason: current.terminationReason ?? reason,
+}));
+const terminateRunningProcess = Effect.fn("ProcessResourceManager.terminateRunningNative")(function* (state, entry, process_) {
+    const cleanup = yield* Effect.result(process_.terminate);
+    const exit = yield* Effect.result(process_.exit);
+    if (entry.watcher !== undefined) {
+        yield* Fiber.interrupt(entry.watcher);
+    }
+    yield* settleEntry(state, entry, settlementFrom(exit, cleanup)).pipe(Effect.uninterruptible);
+    if (cleanup._tag === "Failure") {
+        return yield* Effect.fail(cleanup.failure);
+    }
+    const lifecycle = yield* Ref.get(entry.lifecycle);
+    if (lifecycle.cleanup.state === "cleanup_unknown") {
+        return { reason: "cleanup_unknown", state: "unknown" };
+    }
+    return cleanup.success;
+});
+const terminateEntry = Effect.fn("ProcessResourceManager.terminateNative")(function* (state, entry, reason) {
+    yield* setTerminationReason(entry, reason);
+    const process_ = entry.process;
+    if (process_ === undefined) {
+        yield* settleEntry(state, entry, {
+            exit: failedExit(true),
+        }).pipe(Effect.uninterruptible);
+        return { reason: "cleanup_unknown", state: "unknown" };
+    }
+    const lifecycle = yield* Ref.get(entry.lifecycle);
+    if (lifecycle.settled) {
+        if (lifecycle.cleanup.state === "cleanup_unknown") {
+            return { reason: "cleanup_unknown", state: "unknown" };
+        }
+        return yield* process_.cleanup;
+    }
+    return yield* terminateRunningProcess(state, entry, process_);
+});
+const revokeCodexAuthorization = Effect.fn("ProcessResourceManager.revokeCodexAuthorization")(function* (state, authorizationRevision) {
+    const entries = [...state.entries.values()].filter((entry) => entry.authorization?.codex?.authorizationRevision ===
+        authorizationRevision);
+    const results = yield* Effect.forEach(entries, (entry) => terminateEntry(state, entry, "authorization_revoked").pipe(Effect.result), { concurrency: 1 });
+    const clean = results.every((result) => result._tag === "Success" && result.success.state === "clean");
+    return {
+        matchedTrees: entries.length,
+        state: clean ? "clean" : "cleanup_unknown",
+    };
+});
+const revokePiRpcAuthorization = Effect.fn("ProcessResourceManager.revokePiRpcAuthorization")(function* (state, authorizationRevision) {
+    const entries = [...state.entries.values()].filter((entry) => entry.authorization?.piRpc?.authorizationRevision ===
+        authorizationRevision);
+    const results = yield* Effect.forEach(entries, (entry) => terminateEntry(state, entry, "authorization_revoked").pipe(Effect.result), { concurrency: 1 });
+    const clean = results.every((result) => result._tag === "Success" && result.success.state === "clean");
+    return {
+        matchedTrees: entries.length,
+        state: clean ? "clean" : "cleanup_unknown",
+    };
+});
+const currentSnapshot = Effect.fn("ProcessResourceManager.nativeSnapshot")(function* (state, entry, process_) {
+    const snapshot = yield* process_.latestSnapshot;
+    const lifecycle = yield* Ref.get(entry.lifecycle);
+    const observedAt = new Date(yield* Clock.currentTimeMillis).toISOString();
+    return projectNativeHostSnapshot({
+        capability: nativeHostCapability(process_.capabilityBitmap, entry.request.selectedTier, state.targetTriple),
+        lifecycle,
+        observedAt,
+        ...(snapshot === undefined ? {} : { snapshot }),
+        targetSource: nativeHostTargetSource(state.targetTriple, entry.request.selectedTier),
+        treeId: entry.treeId,
+    });
+});
+const recentSnapshots = Effect.fn("ProcessResourceManager.nativeRecentSnapshots")(function* (state, entry, process_) {
+    const snapshots = yield* process_.recentSnapshots;
+    const lifecycle = yield* Ref.get(entry.lifecycle);
+    if (snapshots.length === 0) {
+        return [yield* currentSnapshot(state, entry, process_)];
+    }
+    return snapshots.map((snapshot) => projectNativeHostSnapshot({
+        capability: nativeHostCapability(process_.capabilityBitmap, entry.request.selectedTier, state.targetTriple),
+        lifecycle,
+        observedAt: snapshot.observedAt,
+        snapshot,
+        targetSource: nativeHostTargetSource(state.targetTriple, entry.request.selectedTier),
+        treeId: entry.treeId,
+    }));
+});
+const terminalClose = Effect.fn("ProcessResourceManager.terminalClose")(function* (entry, control, input) {
+    yield* setTerminationReason(entry, "manual");
+    return yield* control.close(input);
+});
+const terminalResize = Effect.fn("ProcessResourceManager.terminalResize")(function* (control, input) {
+    return yield* control.resize(input);
+});
+const terminalSignal = Effect.fn("ProcessResourceManager.terminalSignal")(function* (control, input) {
+    return yield* control.signal(input);
+});
+const terminalWrite = Effect.fn("ProcessResourceManager.terminalWrite")(function* (control, input) {
+    return yield* control.write(input);
+});
+const managedTerminalControl = (entry, control) => ({
+    close: (input) => terminalClose(entry, control, input),
+    resize: (input) => terminalResize(control, input),
+    signal: (input) => terminalSignal(control, input),
+    write: (input) => terminalWrite(control, input),
+});
+const managedProcessBase = (state, entry, process_) => ({
+    capability: nativeHostCapability(process_.capabilityBitmap, entry.request.selectedTier, state.targetTriple),
+    exit: process_.exit,
+    latestSnapshot: currentSnapshot(state, entry, process_),
+    recentSnapshots: recentSnapshots(state, entry, process_),
+    samplingDiagnostics: process_.samplingDiagnostics.pipe(Effect.map(projectNativeHostSamplingDiagnostics)),
+    standardError: process_.standardError,
+    standardOutput: process_.standardOutput,
+    treeId: entry.treeId,
+});
+const managedInteractiveProcess = (base, entry, process_) => {
+    const { standardInput, terminalControl } = process_;
+    if (terminalControl === undefined || standardInput !== undefined)
+        return;
+    return {
+        ...base,
+        control: "interactive-terminal",
+        terminalControl: managedTerminalControl(entry, terminalControl),
+    };
+};
+const managedOrdinaryProcess = (input) => {
+    const { base, entry, process_, state } = input;
+    if (process_.terminalControl === undefined) {
+        return {
+            ...base,
+            control: "process",
+            ...(process_.standardInput === undefined
+                ? {}
+                : { standardInput: process_.standardInput }),
+            terminate: terminateEntry(state, entry, "manual"),
+        };
+    }
+};
+const managedProcess = (state, entry, process_) => {
+    const base = managedProcessBase(state, entry, process_);
+    return entry.request.owner.kind === "interactive-terminal"
+        ? managedInteractiveProcess(base, entry, process_)
+        : managedOrdinaryProcess({ base, entry, process_, state });
+};
+const failLaunch = Effect.fn("ProcessResourceManager.failNativeLaunch")(function* (input) {
+    if (input.entry === undefined) {
+        const settled = yield* Effect.result(settleLaunchFailure(input.authorization));
+        if (settled._tag === "Success") {
+            yield* releasePermit(input.state, input.permit);
+        }
+        else {
+            yield* Ref.set(input.permit, "fenced");
+            yield* Ref.update(input.state.accounting, (current) => ({
+                ...current,
+                fencedTrees: current.fencedTrees + 1,
+            }));
+        }
+        return;
+    }
+    yield* settleEntry(input.state, input.entry, {
+        exit: failedExit(true),
+    }).pipe(Effect.uninterruptible);
+});
+const registerNativePrepared = (input, prepared) => Effect.gen(function* () {
+    if (Option.isSome(yield* Ref.get(input.registered))) {
+        return yield* Effect.fail(managerError("The native process was registered more than once."));
+    }
+    const entry = yield* registerPreparedEntry({ ...input, prepared });
+    yield* Ref.set(input.registered, Option.some(entry));
+    const authorization = lifecycleAuthorization(entry.authorization);
+    if (authorization === undefined) {
+        return { treeId: entry.treeId };
+    }
+    const started = yield* Effect.result(authorization.onPreparedToStart(entry.treeId));
+    if (started._tag === "Failure") {
+        return yield* Effect.fail(started.failure);
+    }
+    return { treeId: entry.treeId };
+}).pipe(Effect.uninterruptible);
+const finishFailedLaunch = (input, failed) => failed
+    ? Ref.get(input.registered).pipe(Effect.map(Option.getOrUndefined), Effect.flatMap((entry) => failLaunch({ ...input, entry })))
+    : Effect.void;
+const launchNativeProcess = Effect.fnUntraced(function* (input) {
+    return yield* input.state.adapter
+        .launch({
+        ...(input.authorization === undefined
+            ? {}
+            : { authorization: input.authorization }),
+        registerPrepared: (prepared) => registerNativePrepared(input, prepared),
+        request: input.request,
+        targetTriple: input.state.targetTriple,
+    })
+        .pipe(Effect.onExit((exit) => finishFailedLaunch(input, Exit.isFailure(exit))));
+});
+const attachNativeProcess = Effect.fnUntraced(function* (state, entry, process_) {
+    entry.process = process_;
+    if (process_.treeId !== entry.treeId ||
+        process_.capabilityBitmap !== entry.capabilityBitmap) {
+        yield* Effect.result(terminateEntry(state, entry, "host_failure"));
+        return yield* Effect.fail(managerError("The native process did not match its registration."));
+    }
+    entry.watcher = yield* FiberSet.run(state.fibers, watchEntry(state, entry));
+    const managed = managedProcess(state, entry, process_);
+    if (managed === undefined) {
+        yield* Effect.result(terminateEntry(state, entry, "host_failure"));
+        return yield* Effect.fail(managerError("The native process exposed an invalid control authority."));
+    }
+    return managed;
+});
+const performNativeSpawn = Effect.fnUntraced(function* (input) {
+    const permit = yield* requireAdmission(input.state);
+    const registered = yield* Ref.make(Option.none());
+    yield* verifyProcessLaunchAuthority(input.request).pipe(Effect.onError(() => releasePermit(input.state, permit)));
+    const process_ = yield* input.restore(launchNativeProcess({
+        authorization: input.authorization,
+        permit,
+        registered,
+        request: input.request,
+        state: input.state,
+    }));
+    const entry = Option.getOrUndefined(yield* Ref.get(registered));
+    if (entry === undefined) {
+        yield* releasePermit(input.state, permit);
+        return yield* Effect.fail(managerError("The native process was not registered."));
+    }
+    return yield* attachNativeProcess(input.state, entry, process_);
+});
+const spawnNative = Effect.fnUntraced(function* (input) {
+    const selected = selectRegisteredLaunch({
+        launchAuthorization: input.launchAuthorization,
+        request: input.request,
+        runtimeIdentity: input.runtimeIdentity,
+        targetTriple: input.state.targetTriple,
+    });
+    if (selected.state === "invalid")
+        return yield* Effect.fail(selected.error);
+    return yield* Effect.uninterruptibleMask((restore) => performNativeSpawn({
+        authorization: selected.authorization,
+        request: selected.request,
+        restore,
+        state: input.state,
+    }));
+});
+const spawnNativeWithSpan = (input) => Effect.useSpan("maia.node.process_resource.spawn", {
+    attributes: Object.fromEntries([
+        [
+            "maia.process.authorized",
+            lifecycleAuthorization(input.authorization) === undefined
+                ? "false"
+                : "true",
+        ],
+        ["maia.process.owner_kind", input.request.owner.kind],
+        ["maia.process.target_triple", input.targetTriple],
+    ]),
+    root: true,
+}, () => spawnNative({
+    launchAuthorization: input.authorization,
+    request: input.request,
+    runtimeIdentity: input.runtimeIdentity,
+    state: input.state,
+}));
+const trackedEntries = (state, accounting) => [...accounting.trackedTreeIds].flatMap((treeId) => {
+    const entry = state.entries.get(treeId);
+    return entry === undefined ? [] : [entry];
+});
+const observeEntry = (state, entry) => entry.process === undefined
+    ? Effect.succeed({ limits: entry.request.limits })
+    : currentSnapshot(state, entry, entry.process).pipe(Effect.map((snapshot) => ({
+        limits: entry.request.limits,
+        snapshot,
+    })));
+const managerHealth = Effect.fn("ProcessResourceManager.nativeHealth")(function* (state) {
+    const accounting = yield* Ref.get(state.accounting);
+    const observations = yield* Effect.forEach(trackedEntries(state, accounting), (entry) => observeEntry(state, entry), { concurrency: 8 });
+    return projectProcessResourceManagerHealth({
+        activeTrees: accounting.activeTrees,
+        admissionCapacity: processResourcePolicy.maximumActiveTrees,
+        admissionUsedTrees: accounting.admissionUsedTrees,
+        admissionWarningAvailableTrees: processResourcePolicy.admissionWarningAvailableTrees,
+        capability: macosCooperativeProcessResourceCapability,
+        cleanupUnknownTrees: accounting.cleanupUnknownTrees,
+        fencedTrees: accounting.fencedTrees,
+        observations: projectProcessResourceObservations(observations),
+        trackedTrees: accounting.trackedTreeIds.size,
+        watcherFibers: accounting.watcherTreeIds.size,
+    });
+});
+const terminateManager = (state) => Effect.forEach([...state.entries.values()], (entry) => Effect.result(terminateEntry(state, entry, "manager_scope_closed")), { concurrency: 4, discard: true });
+const currentRuntimeIdentity = () => ({
+    architecture: process.arch,
+    platform: process.platform,
+});
+const validateManagerAdapter = (adapter) => adapter.admissionAuthority === "process_resource_manager"
+    ? Effect.void
+    : Effect.fail(managerError("The native adapter does not delegate admission to the manager."));
+const makeNativeManagerState = Effect.fnUntraced(function* (adapter, targetTriple) {
+    return {
+        accounting: yield* Ref.make({
+            activeTrees: 0,
+            admissionUsedTrees: 0,
+            cleanupUnknownTrees: 0,
+            fencedTrees: 0,
+            trackedTreeIds: new Set(),
+            watcherTreeIds: new Set(),
+        }),
+        adapter,
+        entries: new Map(),
+        fibers: yield* FiberSet.make(),
+        targetTriple,
+    };
+});
+const spawnManaged = (input) => spawnNativeWithSpan({
+    ...(input.authorization === undefined
+        ? {}
+        : { authorization: input.authorization }),
+    request: input.request,
+    runtimeIdentity: input.runtimeIdentity,
+    state: input.state,
+    targetTriple: input.state.targetTriple,
+});
+const authorizedSpawnFor = (state, runtimeIdentity) => (request, authorization) => spawnManaged({ authorization, request, runtimeIdentity, state });
+const makeNativeManagerService = (state, runtimeIdentity) => ({
+    activeCount: Ref.get(state.accounting).pipe(Effect.map(({ trackedTreeIds }) => trackedTreeIds.size)),
+    health: managerHealth(state),
+    [processResourceManagerAuthorizedSpawn]: authorizedSpawnFor(state, runtimeIdentity),
+    [processResourceManagerRevokeCodexAuthorization]: (authorizationRevision) => revokeCodexAuthorization(state, authorizationRevision),
+    [processResourceManagerRevokePiRpcAuthorization]: (authorizationRevision) => revokePiRpcAuthorization(state, authorizationRevision),
+    refresh: Ref.get(state.accounting).pipe(Effect.map(({ trackedTreeIds }) => trackedTreeIds.size), Effect.flatMap(recordActiveTrees)),
+    spawn: (request) => spawnManaged({
+        request,
+        runtimeIdentity,
+        state,
+    }),
+});
+export const makeNativeProcessResourceManager = Effect.fn("ProcessResourceManager.makeNative")(function* (adapter, targetTriple, runtimeIdentity = currentRuntimeIdentity()) {
+    yield* validateManagerAdapter(adapter);
+    const state = yield* makeNativeManagerState(adapter, targetTriple);
+    yield* Effect.addFinalizer(() => terminateManager(state));
+    yield* recordActiveTrees(0);
+    return makeNativeManagerService(state, runtimeIdentity);
+});
+//# sourceMappingURL=native-manager.js.map