@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/ProcessReaper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessReaper.js","sourceRoot":"","sources":["../../src/ProcessReaper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,gBAAgB,MAAM,iCAAiC,CAAA;AACnE,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,mBAAmB,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,6CAA6C,CAAA;AACtG,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAA;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAA;AAC1E,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAC1D,OAAO,KAAK,cAAc,MAAM,8BAA8B,CAAA;AAC9D,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAgF1D,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAE,KAA2C,EAAE,IAAI,CAAA;AAE5G,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAY,EAAE;IACzC,IAAI,CAAC;QACH,yEAAyE;QACzE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,CAAC;AACH,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAA;AAEzE;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,CAAC,GAAW,EAAa,EAAE;IACrE,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,qDAAqD;QACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,MAAM,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AAClG,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAE5C,6EAA6E;AAC7E,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB;;GAEG;AACH,MAAM,WAAW,GAAG,GAAW,EAAE;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;IACzC,OAAO,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAA;AAC9F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,GAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;AAE9F,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,IAAY,EAAuC,EAAE;IAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE;QACtF,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;KACvD,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACjG,IAAI,GAAuB,CAAA;IAC3B,MAAM,OAAO,GAAiC,EAAE,CAAA;IAChD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAChF,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;YAAE,GAAG,GAAG,KAAK,CAAA;QACpC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AAC/E,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAyD,EAAE,CAC1G,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAA;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE;IACnD,qEAAqE;IACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAA;IACrC,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,SAAS,CAAC;IACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC5C,MAAM,EAAE,WAAW;CACpB,CAAC,CAAA;AAYF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAAwB,EAC8C,EAAE;IACxE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,CAAC,CAAA;IACrH,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CACvC,YAAY,CAAC,KAAK,CAAC,OAAuC,EAAE,SAAS,EAAE,IAAI,CAAC,CAC7E,CAAA;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;AAC/E,CAAC,CAAA;AAED,4EAA4E;AAC5E,MAAM,OAAO,GAAG,UAAU,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,EAAE,GAAG,CACT,UAAkB,EAClB,MAAc,EACd,GAAW,EACsD,EAAE;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;QAC5E,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,WAAW;QACpB,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,wCAAwC;QACxC,UAAU,EAAE,SAAS;QACrB,6DAA6D;QAC7D,2EAA2E;QAC3E,4EAA4E;QAC5E,kEAAkE;QAClE,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE;KACvD,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AACtF,CAAC,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,GAAkB,EAAE;IAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACnE,CAAC,CAAA;AA8BD;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CAAC,MAAmC,EAAuB,EAAE;IACrF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,UAAU,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACjF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACnF,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AAClE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAmC,EAAuB,EAAE;IACvF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,gBAAgB,CAAA;IACjD,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAA;AACvH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAuB,EAAU,EAAE,CACjE,eAAe,CAAC;IACd,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC;IACtE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC;IAChE,UAAU;CACX,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA;AAgBtC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA2B,EAAU,EAAE;IACpE,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAA;IAC9D,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IAChD,OAAO,eAAe,CAAC;QACrB,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC7B,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;QAC9F,CAAC;QACD,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrC,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE;KAC5D,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,eAAe,GAAG,CACtB,MAA+D,EAC/D,QAAgB,EACR,EAAE;IACV,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAA;IACpC,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,yEAAyE;YACzE,wEAAwE;YACxE,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YAC5D,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YACxE,MAAM,KAAK,GAAG,YAAY,EAAE,CAAA;YAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAA;YACpF,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAE,MAAM,CAAC,IAAe,EAAE,SAAS,CAAC,CAAA;gBACjD,OAAO,WAAW,CAAA;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uEAAuE;gBACvE,yEAAyE;gBACzE,6DAA6D;gBAC7D,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAA;YACjE,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAW,eAAe,EAAE,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAuB,EAAU,EAAE;IACnE,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAA;IACjD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAa,EAAE;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;QAC/F,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,OAAO,EAAE,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAA;YAChG,MAAM,UAAU,GAAG,UAAU,KAAK,SAAS;gBACzC,CAAC,CAAC,wBAAwB,CAAC,WAAW,EAAE,SAAS,CAAC;gBAClD,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;YAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBACpE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI;gBACjC,GAAG,EAAE,EAAE;gBACP,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;YAC/G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAyE,CAAA;YAC/G,IAAI,KAAK,EAAE,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YACrD,OAAO,KAAK,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;gBACvE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC;gBACnE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;gBACrD,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;QAChC,CAAC;IACH,CAAC,CAAA;IACD,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,WAAW;QACX,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;QACpB,UAAU;QACV,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7F,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YAC9D,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;gBACvF,mEAAmE;gBACnE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI;gBACjC,GAAG,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE;gBAClC,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAA;YAC/C,uEAAuE;YACvE,4BAA4B;YAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,WAAW,CAAA;YAC3C,OAAO,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAW,iBAAiB,EAAE,CAAA;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,cAAc,EAAE,CAAA;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAU,EAAE,CACpD,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAA;AAExF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AA2CvC;;;;;;;;;GASG;AACH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAU;IACtD,aAAa;IACb,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAA;AA4BF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,MAAmC,EACnC,MAAc,EACO,EAAE;IACvB,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,YAAY;IACZ,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,GAAG,mBAAmB;QAAE,OAAO,UAAU,CAAA;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC9C,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAA;IACpD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAA;IAClD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,qBAAqB,CAAA;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,mBAAmB;QAC9E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,mBAAmB,CAAA;AACzB,CAAC,CAAA;AAED,4EAA4E;AAC5E,MAAM,MAAM,GAAG,CACb,MAAc,EACd,MAAmC,EACnC,QAAgB,EAChB,QAAuB,EACvB,MAAc,EACO,EAAE;IACvB,2EAA2E;IAC3E,2EAA2E;IAC3E,0BAA0B;IAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAA;IAC3E,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAA;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACvC,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,yCAAyC;IACzC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,mBAAmB,CAAA;IACzE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,aAAa,CAAA;IACpE,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,OAAiB,EAC0F,EAAE,CAC7G,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,aAAa,CAAA;IACjD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAA;IACrC,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QAClE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,0DAA0D;gBAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;gBAC/D,SAAQ;YACV,CAAC;YACD,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YACtC,SAAQ;QACV,CAAC;QACD,0EAA0E;QAC1E,oCAAoC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,MAAM,GAAG,CACb,KAAmC,EACnC,GAAW,EACX,IAAY,EACS,EAAE,CACvB,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,oCAAoC,IAAI,QAAQ,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,CACzG,CAAA;AAEH;;;GAGG;AACH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAU,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC,CAAA;AAEpH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,+BAA+B,EAAE;IACtE,WAAW,EAAE,+DAA+D;CAC7E,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAA8B,EAAuB,EAAE,CAC5E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAChC,MAAM,MAAM,GAAqC,EAAE,CAAA;IACnD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,CAAA;YACX,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC1D,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,WAAW,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAA;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IACtF,MAAM,IAAI,GAAG,wCAAwC,CAAA;IACrD,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;AAC3G,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAiB,EAA0D,EAAE,CACjG,KAAK,CAAC,aAAa,CACjB,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAChB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EACtB,MAAM,CAAC,QAAQ,CACb,yCAAyC,EACzC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,mEAAmE,EAAE,KAAK,CAAC,CACvG,CACF,CACF,CAAA","sourcesContent":["/**\n * Reaping the processes a dead host incarnation abandoned.\n *\n * Scope closure cleans up work a live host still owns. On POSIX, a prepared\n * supervisor also receives private-channel EOF when its host disappears and\n * independently requests group cleanup. The durable ledger remains the fallback\n * when that cleanup is incomplete or cannot be verified; the next incarnation\n * uses this module to examine the recorded process identities before acting.\n *\n * The rules are narrow on purpose, because the input is a durable record that\n * outlived the process that wrote it and a pid is reused. A record is signalled\n * only when ALL of these hold:\n *\n * - it belongs to a DIFFERENT incarnation of the SAME `hostId`\n *   ({@link ProcessLedger.Service.orphans} already filters that);\n * - its owner is gone. A pid that exists but belongs to another user counts as\n *   alive, exactly as {@link HostLiveness} counts it, so only `ESRCH` reads as\n *   dead and every other answer keeps the record;\n * - it names a target the platform can actually signal. On POSIX that is a\n *   process group the child leads itself, so `pgid` has to be a safe integer\n *   above 1 and equal to `pid`; on Windows it is a pid, so `pgid` has to be\n *   absent. The check is made against the DURABLE record rather than trusted\n *   from it: `process.kill(-0, \"SIGKILL\")` signals this host's own process\n *   group, and `@smthrs/kernel`'s ledger schema admits zero;\n * - that group is not THIS process's group, and its pid is not this process's\n *   pid. The host's real process group is read from the operating system,\n *   because a stored number can claim anything and the shell that started this\n *   host shares its group. A host that cannot read its own group keeps the\n *   record rather than signalling it on a guard that did not run;\n * - the number still names the process the record describes. A record written\n *   before this machine booted names a pid from a pid space that no longer\n *   exists, and within one boot the recorded start time has to match the start\n *   time the operating system reports for that pid. A host that cannot ASK the\n *   question answers {@link StartTime} `unavailable`, which refuses the kill\n *   and keeps the record; no evidence never authorizes a signal.\n *\n * The outcome of the signal is part of the record. A kill that succeeds, or\n * that reports the group is already gone, retires the record through\n * {@link ProcessLedger.Service.reaped}; a kill that FAILS for any other reason\n * leaves the record inherited so the next incarnation tries again. A record\n * refused on grounds the operating system will not revisit — a number no\n * platform can signal, a pid that is gone, a start time that does not match — is\n * retired through {@link ProcessLedger.Service.skipped}, which says in the\n * journal that nothing was signalled and stops every later incarnation\n * re-examining a number the operating system has moved on from. The three\n * refusals a later incarnation CAN answer differently — `owner-alive`,\n * `identity-unverified`, and `own-group-unknown` — retire nothing.\n *\n * @since 0.1.0\n */\n\nimport * as ContainedSpawner from \"@smthrs/kernel/ContainedSpawner\"\nimport * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Metric from \"effect/Metric\"\nimport type * as ChildProcess from \"effect/unstable/process/ChildProcess\"\nimport { ChildProcessSpawner, make as makeSpawner } from \"effect/unstable/process/ChildProcessSpawner\"\nimport { spawnSync } from \"node:child_process\"\nimport { uptime } from \"node:os\"\nimport { parse, win32 } from \"node:path\"\nimport { packageRoot, resolveDefaultExecutable } from \"./internal/AtomicFileSystemExecutable.ts\"\nimport { usableExecutable } from \"./internal/AtomicFileSystemTransport.ts\"\nimport * as PipedProcess from \"./internal/PipedProcess.ts\"\nimport * as ProcessCleanup from \"./internal/ProcessCleanup.ts\"\nimport * as ProcSnapshot from \"./internal/ProcSnapshot.ts\"\n\n/**\n * What the operating system can say about a pid.\n *\n * `unknown` is not `dead`. A pid this host may not signal answers `EPERM`, and\n * a reaper that read that as \"gone\" would kill another user's children on the\n * strength of a record it cannot verify.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Liveness = \"alive\" | \"dead\" | \"unknown\"\n\n/**\n * What happened when a process group was signalled.\n *\n * @category models\n * @since 0.1.0\n */\nexport type KillOutcome =\n  /** The signal was delivered. */\n  | \"signalled\"\n  /** There was nothing left to signal, which is the same end state. */\n  | \"already-gone\"\n  /** The signal was refused, and the record must be tried again later. */\n  | \"failed\"\n\n/**\n * What the operating system can say about when a pid started.\n *\n * The three negative answers are deliberately distinct, because they authorize\n * three different decisions. `gone` is evidence — the pid does not exist, so\n * the record describes nothing and is retired unsignalled. `unavailable` is the\n * ABSENCE of evidence: `ps` is missing, unanswerable, or printed something no\n * clock can read, so the record is kept for an incarnation that can ask.\n * `unsupported` is a platform that has no such column at all, which falls back\n * to the boot-time comparison alone.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type StartTime =\n  /** The operating system reports this start time, in epoch milliseconds. */\n  | { readonly _tag: \"started\"; readonly startedAtMs: number }\n  /** The pid names no process. */\n  | { readonly _tag: \"gone\" }\n  /** The question could not be asked on this host. */\n  | { readonly _tag: \"unavailable\" }\n  /** The platform has no start-time column at all. */\n  | { readonly _tag: \"unsupported\" }\n\n/**\n * The operating-system operations reaping needs.\n *\n * It is a seam, not an abstraction: `flows` ships exactly the two\n * implementations below and a test drives the Windows one on a POSIX host,\n * which is the only way that path is ever exercised in this repository.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface System {\n  /** Whether a pid names a process that still exists. */\n  readonly isAlive: (pid: number) => Liveness\n  /** When the process behind a pid started. */\n  readonly startedAtMs: (pid: number) => StartTime\n  /** The process group THIS process belongs to, or `null` where there are none. */\n  readonly ownGroup: () => number | null\n  /** When this machine booted, in epoch milliseconds. */\n  readonly bootedAtMs: () => number\n  /**\n   * Whether the numbers in a record name something this platform may signal,\n   * checked before any other guard consults them.\n   */\n  readonly refuseTarget: (record: ProcessLedger.ProcessRecord) => Refusal | undefined\n  /** Ends an abandoned process and everything below it. */\n  readonly killTree: (record: ProcessLedger.ProcessRecord) => KillOutcome\n}\n\nconst errorCode = (cause: unknown): string | undefined => (cause as { readonly code?: string } | null)?.code\n\nconst liveness = (pid: number): Liveness => {\n  try {\n    // Signal 0 delivers nothing; it only asks whether the pid is signalable.\n    process.kill(pid, 0)\n    return \"alive\"\n  } catch (cause) {\n    // ESRCH is the only answer that means gone. EPERM means the process\n    // exists and belongs to another user; anything else is a question this\n    // host could not ask, and both keep the record rather than kill on it.\n    return errorCode(cause) === \"ESRCH\" ? \"dead\" : \"unknown\"\n  }\n}\n\nconst bootedAtMs = (): number => Date.now() - Math.round(uptime() * 1000)\n\n/**\n * The start time `ps` reports for a pid.\n *\n * `lstart` is the one start-time column both BSD (macOS) and procps (Linux)\n * spell the same way, and it prints an absolute time rather than an elapsed\n * one, so the answer does not drift between reading it and comparing it. It is\n * also a LOCALIZED column, so the probe pins `LC_ALL=C` and `TZ=UTC`.\n * Its text has no zone; parsing explicitly as UTC keeps the identity independent\n * of the host runtime's timezone.\n */\nconst startedAtMs = (executable: string) => (pid: number): StartTime => {\n  const answer = ps(executable, \"lstart\", pid)\n  if (answer._tag === \"gone\") {\n    // A nonzero exit is `ps` saying the pid does not exist, but it is also what\n    // a `ps` that rejected the column, or one that is not the `ps` this probe\n    // expects, says about a pid that is very much alive. The kernel is asked\n    // directly before a live process is retired as gone.\n    return liveness(pid) === \"dead\" ? answer : { _tag: \"unavailable\" }\n  }\n  if (answer._tag !== \"printed\") return answer\n  const parsed = Date.parse(`${answer.text} UTC`)\n  return Number.isNaN(parsed) ? { _tag: \"unavailable\" } : { _tag: \"started\", startedAtMs: parsed }\n}\n\n/**\n * The absolute path the process probe is run from.\n *\n * Never a `PATH` lookup. The inherited environment belongs to whoever started\n * this host, and a planted `ps` that prints a fabricated start time — or none\n * at all — would decide whether a `SIGKILL` is authorized.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const defaultPsExecutable = \"/bin/ps\"\n\n/** How long the probe may take before it counts as an answer nobody gave. */\nconst psTimeoutMs = 5000\n\n/**\n * The Windows directory the host was started with, when it names one.\n */\nconst windowsRoot = (): string => {\n  const systemRoot = process.env.SystemRoot\n  return systemRoot !== undefined && win32.isAbsolute(systemRoot) ? systemRoot : \"C:\\\\Windows\"\n}\n\n/**\n * The system `taskkill`, by absolute path. Windows resolves a bare name from\n * the current directory before `PATH`, so a flow that wrote `taskkill.exe`\n * into the host's working directory would otherwise run as the host.\n */\nconst taskkillExecutable = (): string => win32.join(windowsRoot(), \"System32\", \"taskkill.exe\")\n\n/** A live-release probe has its own short bound within the shutdown deadline. */\nconst cleanupProbeTimeoutMs = 2000\n\n/**\n * One fixed-path snapshot supplies group membership, start identities and our\n * own group together. Only numeric fields and C-locale lstart are read; command\n * text and the caller's PATH never influence signal authority.\n */\nconst psGroupSnapshot = (pgid: number): ProcessCleanup.Snapshot | undefined => {\n  const result = spawnSync(defaultPsExecutable, [\"-A\", \"-o\", \"pid=,pgid=,stat=,lstart=\"], {\n    encoding: \"utf8\",\n    timeout: cleanupProbeTimeoutMs,\n    killSignal: \"SIGKILL\",\n    env: { LC_ALL: \"C\", TZ: \"UTC\", PATH: \"/usr/bin:/bin\" }\n  })\n  if (result.error !== undefined || result.signal !== null || result.status !== 0) return undefined\n  let own: number | undefined\n  const members: Array<ProcessCleanup.Member> = []\n  for (const line of result.stdout.trim().split(\"\\n\")) {\n    const match = /^\\s*([0-9]+)\\s+([0-9]+)\\s+(\\S+)\\s+(.+)$/.exec(line)\n    if (match === null) return undefined\n    const pid = Number(match[1])\n    const group = Number(match[2])\n    if (!Number.isSafeInteger(pid) || !Number.isSafeInteger(group)) return undefined\n    if (pid === process.pid) own = group\n    if (group !== pgid) continue\n    const started = Date.parse(`${match[4]!} UTC`)\n    if (Number.isNaN(started)) return undefined\n    members.push({ pid, startedAtMs: started, zombie: match[3]!.startsWith(\"Z\") })\n  }\n  return own === undefined || own <= 0 ? undefined : { ownGroup: own, members }\n}\n\n/**\n * The observation the supervisor polls, from the source that platform has.\n *\n * Linux publishes the whole process table as files under `/proc`, which is\n * where `ps` itself reads it, so the kernel is asked directly. That needs no\n * `procps` in the image, cannot be answered by a planted binary, and costs no\n * fork on a poll that runs every 10ms. A missing `/bin/ps` is not a\n * hypothetical: `procps` is not in `debian:bookworm-slim`, and on Cloud CI run\n * 11727 every spawned target in every task finished its work and then failed\n * cleanup verification with `Unknown: ChildProcess.kill`, because this\n * observation could not be made.\n *\n * Every other POSIX host keeps the `ps` reading, which is the only portable\n * spelling of this question off Linux.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const groupSnapshotFor = (platform: string): (pgid: number) => ProcessCleanup.Snapshot | undefined =>\n  platform === \"linux\" ? ProcSnapshot.snapshot(ProcSnapshot.defaultProcRoot) : psGroupSnapshot\n\n/**\n * Whether the kernel reports no process at all in a group.\n *\n * Signal 0 delivers nothing; it only asks the kernel whether the group has a\n * member. `ESRCH` is the one answer that proves the group empty, with no fork\n * and no process table to parse, so it still answers on a loaded host where a\n * `ps` snapshot cannot be taken. A live member, a zombie (macOS answers\n * `EPERM`, Linux succeeds), another user's member or any other error answers\n * `false`, which leaves the question to the snapshot.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const groupVacant = (pgid: number): boolean => {\n  // kill(0) and kill(-1) address the caller's group and every process.\n  if (!Number.isSafeInteger(pgid) || pgid <= 1) return false\n  try {\n    process.kill(-pgid, 0)\n    return false\n  } catch (cause) {\n    return errorCode(cause) === \"ESRCH\"\n  }\n}\n\n/**\n * Live cleanup for Node and Bun contained spawners.\n *\n * A trusted supervisor remains the group owner after the target exits. It\n * enforces cleanup on target completion, parent loss and explicit release; the\n * target starts only after its owner is durably recorded. Host observations\n * never signal a pid: they only shorten the owner's deadline or verify an empty\n * group before retiring its record. Failed verification retains the record.\n *\n * @category constructors\n * @since 1.0.0\n */\nexport const processLifecycle = ProcessCleanup.lifecycle({\n  platform: process.platform,\n  snapshot: groupSnapshotFor(process.platform),\n  vacant: groupVacant\n})\n\n/**\n * The default grace period for a contained host spawner.\n *\n * The platform is always the running platform; callers cannot describe a\n * Windows ledger identity for a process that actually leads a POSIX group.\n * @category models\n * @since 1.0.0\n */\nexport type SpawnerOptions = Omit<ContainedSpawner.Options, \"platform\">\n\n/**\n * Provides a ledger-backed spawner with this platform's prepared cleanup.\n *\n * Native pipe listeners live until their descriptors close, including writes\n * interrupted by owner loss. The kernel expands pipelines before this private\n * standard-command adapter is called. Windows owners join a native job before\n * activation; POSIX owners enforce their process-group cleanup deadline.\n *\n * The caller supplies the durable or in-memory ledger. This layer records new\n * owners; {@link layer} separately reaps\n * records inherited from a previous host incarnation.\n * @category layers\n * @since 1.0.0\n */\nexport const layerSpawner = (\n  options?: SpawnerOptions\n): Layer.Layer<ChildProcessSpawner, never, ProcessLedger.ProcessLedger> => {\n  const contained = ContainedSpawner.layer({ graceMs: options?.graceMs, platform: process.platform }, processLifecycle)\n  const standard = makeSpawner((command) =>\n    PipedProcess.spawn(command as ChildProcess.StandardCommand, undefined, true)\n  )\n  return Layer.provide(contained, Layer.succeed(ChildProcessSpawner)(standard))\n}\n\n/** A whole number and nothing else, which is all a `pgid` column may be. */\nconst decimal = /^[0-9]+$/\n\n/**\n * One `ps` column for one pid.\n *\n * `printed` is an answer; every other tag is the absence of one. A nonzero exit\n * with no error is `ps` saying the pid does not exist, which is evidence; a\n * spawn that failed, a signal, or a timeout is not.\n */\nconst ps = (\n  executable: string,\n  column: string,\n  pid: number\n): { readonly _tag: \"printed\"; readonly text: string } | StartTime => {\n  const result = spawnSync(executable, [\"-o\", `${column}=`, \"-p\", String(pid)], {\n    encoding: \"utf8\",\n    timeout: psTimeoutMs,\n    // `SIGKILL` rather than the default `SIGTERM`, because this call blocks the\n    // event loop while a host is being built: `spawnSync` keeps waiting past\n    // the deadline for a process that ignores the signal, so a `TERM` the probe\n    // can decline is not a deadline at all.\n    killSignal: \"SIGKILL\",\n    // An empty-ish environment for the same reason the helper in\n    // `AtomicFileSystem` gets one: nothing the caller exported may change what\n    // this answers. Pin both the column's spelling and its timezone; the parser\n    // supplies UTC explicitly because `lstart` does not print a zone.\n    env: { LC_ALL: \"C\", TZ: \"UTC\", PATH: \"/usr/bin:/bin\" }\n  })\n  if (result.error !== undefined || result.signal !== null || result.status === null) {\n    return { _tag: \"unavailable\" }\n  }\n  if (result.status !== 0) return { _tag: \"gone\" }\n  const printed = result.stdout.trim()\n  return printed === \"\" ? { _tag: \"unavailable\" } : { _tag: \"printed\", text: printed }\n}\n\n/**\n * This process's own process group.\n *\n * Node exposes no `getpgrp`, so the answer comes from `ps`, which both BSD and\n * procps spell `pgid`. A host that cannot read it answers `null` and loses one\n * guard, which is why the pid comparison below is kept as well.\n *\n * The text is required to be one run of decimal digits naming a real group,\n * rather than run through `Number.parseInt`, which reads a PREFIX: `\"12 34\"`,\n * `\"12abc\"`, and `\"0x10\"` all become a number that is not this host's group. A\n * wrong number is worse here than no number at all. It silently passes the\n * own-group comparison in {@link refuse}, and because it is not `null` it also\n * suppresses the `own-group-unknown` refusal that exists to say the comparison\n * could not be made, so the guard neither runs nor reports that it did not run\n * and a `SIGKILL` goes out on it. Anything else answers `null`, which refuses.\n */\nconst ownGroup = (executable: string) => (): number | null => {\n  const answer = ps(executable, \"pgid\", process.pid)\n  if (answer._tag !== \"printed\") return null\n  if (!decimal.test(answer.text)) return null\n  const parsed = Number(answer.text)\n  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null\n}\n\n/**\n * How a {@link System} asks the operating system its questions, and whose\n * identity it must never signal.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface SystemOptions {\n  /**\n   * The absolute `ps` the identity probe runs. Default\n   * {@link defaultPsExecutable}. It is configuration for a host that installs\n   * `ps` somewhere else, and the seam the probe's own parsing is driven\n   * through; it is never a `PATH` lookup. Windows has no such probe and\n   * ignores it.\n   */\n  readonly psExecutable?: string | undefined\n  /** Absolute native helper for Windows process identity queries; never a PATH lookup. */\n  readonly processExecutable?: string | undefined\n  /**\n   * The pid this system must never signal, nor signal the group of. Default\n   * `process.pid`. {@link Options.ownerPid} is the same identity at the sweep\n   * level; this one is what {@link System.killTree} enforces on its own,\n   * because that function is exported and a caller can reach it without going\n   * through {@link reap}.\n   */\n  readonly ownerPid?: number | undefined\n}\n\n/**\n * Whether a durable record names a POSIX process group this host may signal.\n *\n * `process.kill(-pgid, ...)` turns the stored number into a target directly, so\n * every value that is not a real foreign group has to be refused before it gets\n * there: `0` signals THIS process's group, a negative value stops naming a\n * group at all and names a single pid, and a `pgid` that differs from `pid`\n * describes a child that does not lead the group it claims —\n * `ContainedSpawner.groupOf` writes `pgid === pid` for every detached POSIX\n * child, so anything else is a record no writer in this repository produced.\n */\nconst refusePosixTarget = (record: ProcessLedger.ProcessRecord): Refusal | undefined => {\n  if (record.pgid === null) return \"no-group\"\n  if (!Number.isSafeInteger(record.pid) || record.pid <= 1) return \"invalid-record\"\n  if (!Number.isSafeInteger(record.pgid) || record.pgid <= 1) return \"invalid-record\"\n  return record.pgid === record.pid ? undefined : \"invalid-record\"\n}\n\n/**\n * Whether a durable record names a Windows process tree this host may signal.\n *\n * Windows has no process groups, so `ContainedSpawner.groupOf` records `null`\n * there and `taskkill /T` walks the tree from the pid instead. A win32 record\n * carrying a number is therefore a record some other platform wrote.\n */\nconst refuseWindowsTarget = (record: ProcessLedger.ProcessRecord): Refusal | undefined => {\n  if (record.pgid !== null) return \"invalid-record\"\n  return Number.isSafeInteger(record.pid) && record.pid > 1 && record.pid <= 0xffff_ffff ? undefined : \"invalid-record\"\n}\n\n/**\n * Reaping on a POSIX host, with the identity probe configured.\n *\n * The group is killed outright rather than asked politely first. `SIGTERM`\n * buys a graceful shutdown only when someone is left to wait for it, and the\n * incarnation that owned these processes is by definition gone.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const posixSystemWith = (options?: SystemOptions): System =>\n  posixSystemFrom({\n    startedAtMs: startedAtMs(options?.psExecutable ?? defaultPsExecutable),\n    ownGroup: ownGroup(options?.psExecutable ?? defaultPsExecutable),\n    bootedAtMs\n  }, options?.ownerPid ?? process.pid)\n\n/**\n * Where a Linux {@link System} reads the process table, and whose identity it\n * must never signal.\n *\n * @category models\n * @since 1.0.0-rc.1\n */\nexport interface ProcSystemOptions {\n  /** The `/proc` mount the probes read. Default `/proc`. */\n  readonly procRoot?: string | undefined\n  /** The pid this system must never signal, nor signal the group of. Default `process.pid`. */\n  readonly ownerPid?: number | undefined\n}\n\n/**\n * Reaping on Linux, with every identity question read from `/proc` rather\n * than from `ps`.\n *\n * `procps` is not in `debian:bookworm-slim` (Cloud CI run 11727), and a\n * `ps`-based reaper on such a host can read neither its own group nor any\n * start time, so it refuses every orphan as `own-group-unknown` on every\n * restart. The live-cleanup observation ({@link groupSnapshotFor}) already\n * reads `/proc` for the same reason; this is the crash-recovery half.\n *\n * A pid with no `/proc/<pid>/stat` is `gone` only when the kernel also says so,\n * because a `hidepid` mount hides another user's live process the same way.\n *\n * @category constructors\n * @since 1.0.0-rc.1\n */\nexport const procSystemWith = (options?: ProcSystemOptions): System => {\n  const root = options?.procRoot ?? ProcSnapshot.defaultProcRoot\n  const readStart = ProcSnapshot.startedAtMs(root)\n  return posixSystemFrom({\n    startedAtMs: (pid) => {\n      const answer = readStart(pid)\n      return answer._tag === \"gone\" && liveness(pid) !== \"dead\" ? { _tag: \"unavailable\" } : answer\n    },\n    ownGroup: ProcSnapshot.ownGroup(root),\n    bootedAtMs: () => ProcSnapshot.bootMs(root) ?? bootedAtMs()\n  }, options?.ownerPid ?? process.pid)\n}\n\n/** The POSIX kill path over whichever probes the platform answers with. */\nconst posixSystemFrom = (\n  probes: Pick<System, \"startedAtMs\" | \"ownGroup\" | \"bootedAtMs\">,\n  ownerPid: number\n): System => {\n  const readOwnGroup = probes.ownGroup\n  return {\n    isAlive: liveness,\n    startedAtMs: probes.startedAtMs,\n    ownGroup: readOwnGroup,\n    bootedAtMs: probes.bootedAtMs,\n    refuseTarget: refusePosixTarget,\n    killTree: (record) => {\n      // Repeated here and not only in `refuse`: this function is exported, and\n      // the negation below is the one place a stored number becomes a signal.\n      if (refusePosixTarget(record) !== undefined) return \"failed\"\n      // The host's own identity, repeated for the same reason. `refuse` holds\n      // one `ownGroup` reading for the whole sweep; a caller that reaches this\n      // function directly has made no such reading, and `process.kill(-pgid)`\n      // does not care which way the number arrived. A group that cannot be\n      // read is a comparison that did not happen, so nothing is signalled.\n      if (record.pid === ownerPid || record.pgid === ownerPid) return \"failed\"\n      const group = readOwnGroup()\n      if (group === null || record.pid === group || record.pgid === group) return \"failed\"\n      try {\n        process.kill(-(record.pgid as number), \"SIGKILL\")\n        return \"signalled\"\n      } catch (cause) {\n        // The group settled between the liveness check and the signal: the end\n        // state is the one that was wanted. Anything else is a kill that did NOT\n        // happen, and saying so is what gets the record tried again.\n        return errorCode(cause) === \"ESRCH\" ? \"already-gone\" : \"failed\"\n      }\n    }\n  }\n}\n\n/**\n * Reaping on a POSIX host: one `SIGKILL` to the abandoned process group, with\n * the identity probe at {@link defaultPsExecutable}.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const posixSystem: System = posixSystemWith()\n\n/**\n * Reaping on Windows, with the identity the sweep must never signal\n * configured.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const windowsSystemWith = (options?: SystemOptions): System => {\n  const ownerPid = options?.ownerPid ?? process.pid\n  const startedAtMs = (pid: number): StartTime => {\n    if (!Number.isSafeInteger(pid) || pid <= 1 || pid > 0xffff_ffff) return { _tag: \"unavailable\" }\n    try {\n      const configured = options?.processExecutable ?? process.env.SMITHERS_WORKSPACE_JJ_EXPORT_BINARY\n      const executable = configured === undefined\n        ? resolveDefaultExecutable(packageRoot, undefined)\n        : usableExecutable(configured, undefined)\n      const result = spawnSync(executable, [\"--process-info\", String(pid)], {\n        cwd: parse(process.execPath).root,\n        env: {},\n        encoding: \"utf8\",\n        timeout: psTimeoutMs,\n        killSignal: \"SIGKILL\",\n        maxBuffer: 4096\n      })\n      if (result.error !== undefined || result.signal !== null || result.status !== 0) return { _tag: \"unavailable\" }\n      const value = JSON.parse(result.stdout) as { readonly status?: unknown; readonly startedAtMs?: unknown } | null\n      if (value?.status === \"gone\") return { _tag: \"gone\" }\n      return value?.status === \"started\" && typeof value.startedAtMs === \"number\" &&\n          Number.isSafeInteger(value.startedAtMs) && value.startedAtMs >= 0\n        ? { _tag: \"started\", startedAtMs: value.startedAtMs }\n        : { _tag: \"unavailable\" }\n    } catch {\n      return { _tag: \"unavailable\" }\n    }\n  }\n  return {\n    isAlive: liveness,\n    startedAtMs,\n    ownGroup: () => null,\n    bootedAtMs,\n    refuseTarget: (record) => record.pid === ownerPid ? \"own-group\" : refuseWindowsTarget(record),\n    killTree: (record) => {\n      if (refuseWindowsTarget(record) !== undefined) return \"failed\"\n      // `taskkill /T` walks the tree DOWN from the pid it is given, so a record\n      // naming this host takes the host and everything it started with it.\n      if (record.pid === ownerPid) return \"failed\"\n      const result = spawnSync(taskkillExecutable(), [\"/pid\", String(record.pid), \"/T\", \"/F\"], {\n        // An inert cwd and only the variable Windows system binaries need.\n        cwd: parse(process.execPath).root,\n        env: { SystemRoot: windowsRoot() },\n        stdio: \"ignore\"\n      })\n      if (result.error !== undefined) return \"failed\"\n      // 128 is `taskkill`'s \"no such process\", which is the same end state a\n      // successful kill produces.\n      if (result.status === 0) return \"signalled\"\n      return result.status === 128 ? \"already-gone\" : \"failed\"\n    }\n  }\n}\n\n/**\n * Reaping on Windows, which has no process groups: `taskkill /T /F` by pid.\n *\n * **Windows is outside the 1.0.0-rc.0 support contract**\n * (`docs/pages/installation.md`). Full Windows process containment remains\n * under verification. It is kept — and reachable through {@link reap} rather than only\n * by calling it directly — because a reaper that silently retired every win32\n * record would be the \"excluded feature that appears to work partially\" the\n * release policy forbids. Treat it as unsupported best-effort.\n *\n * The packaged native helper reads creation time from a pinned process handle.\n * A missing helper, malformed reply, or denied query keeps the durable record\n * for retry. Windows has no process groups, so own-group refusal uses the pid.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const windowsSystem: System = windowsSystemWith()\n\n/**\n * Reaping on Linux from the kernel's own `/proc`.\n *\n * @category constructors\n * @since 1.0.0-rc.1\n */\nexport const procSystem: System = procSystemWith()\n\n/**\n * Selects the reaping implementation a platform needs.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const systemFor = (platform: string): System =>\n  platform === \"win32\" ? windowsSystem : platform === \"linux\" ? procSystem : posixSystem\n\n/**\n * How far apart a recorded start time and the operating system's may be and\n * still describe the same process.\n *\n * `lstart` has one-second granularity and the ledger writes its record just\n * after the spawn returns, so the two never agree exactly. Two seconds covers\n * the gap; a pid the operating system handed to somebody else is minutes or\n * hours away from it, not milliseconds.\n *\n * @category models\n * @since 0.1.0\n */\nexport const identityToleranceMs = 2000\n\n/**\n * Reaper configuration.\n *\n * @category models\n * @since 0.1.0\n */\nexport interface Options {\n  /** The pid this host must never signal a group for. Default `process.pid`. */\n  readonly ownerPid?: number | undefined\n  /** The operating-system seam. Default {@link systemFor} of `process.platform`. */\n  readonly system?: System | undefined\n}\n\n/**\n * Why a record was not signalled.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Refusal =\n  /** The incarnation that started it is still running and will contain it. */\n  | \"owner-alive\"\n  /** It shared its owner's process group, so there is no group to signal. */\n  | \"no-group\"\n  /** It named this host's own process group or pid. */\n  | \"own-group\"\n  /** This host could not read its OWN process group, so it cannot rule that out. */\n  | \"own-group-unknown\"\n  /** Its numbers do not name anything this platform may signal. */\n  | \"invalid-record\"\n  /** It was written before this machine booted, so the pid space is not the same. */\n  | \"pre-boot\"\n  /** The pid it names does not exist, so there is no identity to confirm. */\n  | \"process-gone\"\n  /** The pid exists but did not start when the record says it did. */\n  | \"identity-mismatch\"\n  /** This host could not ask when the pid started, so it must not signal it. */\n  | \"identity-unverified\"\n  /** The signal was refused, so the record stays for the next incarnation. */\n  | \"kill-failed\"\n\n/**\n * The refusals that leave a record inherited instead of retiring it.\n *\n * A refusal is final when the operating system has moved on from the number:\n * saying so in the journal is what stops every later incarnation re-examining\n * it. These three are not final. `owner-alive` means the incarnation that owns\n * the record will contain its own children; `identity-unverified` and\n * `own-group-unknown` mean this host could not ask a question at all — a host\n * that CAN ask has to get the chance.\n */\nconst retained: ReadonlySet<Refusal> = new Set<Refusal>([\n  \"owner-alive\",\n  \"identity-unverified\",\n  \"own-group-unknown\"\n])\n\n/**\n * One record, and what the reaper decided about it.\n *\n * The two outcomes are a union rather than one shape with an optional field so\n * that `killed` narrows the reason: after `if (!entry.killed)` the\n * {@link Refusal} is there to read, and a killed record cannot be built\n * carrying a reason it never had. The runtime objects are unchanged — a killed\n * entry simply omits `refusal`.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Reaped =\n  | {\n    readonly record: ProcessLedger.ProcessRecord\n    readonly killed: true\n    /** Never present when `killed` is `true`. */\n    readonly refusal?: never\n  }\n  | {\n    readonly record: ProcessLedger.ProcessRecord\n    readonly killed: false\n    /** Present exactly when `killed` is `false`. */\n    readonly refusal: Refusal\n  }\n\n/** The identity half of the decision, split out because it reads as a list. */\nconst refuseOnIdentity = (\n  system: System,\n  record: ProcessLedger.ProcessRecord,\n  bootMs: number\n): Refusal | undefined => {\n  // A record older than this boot names a pid from a pid space that no longer\n  // exists. The tolerance points BACKWARDS from the boot instant on purpose:\n  // `uptime` is second-granular, so a record written moments after boot could\n  // otherwise be read as predating it, and refusing to kill is the safe way to\n  // be wrong.\n  //\n  // The consequence is a narrow, deliberate leak, and it is a leak rather than\n  // a retry: `reap` retires a `pre-boot` refusal through `ledger.skipped`, so a\n  // group spawned within `identityToleranceMs` of the computed boot instant is\n  // never reaped by any later incarnation either. That is the price of refusing\n  // to kill on an instant `uptime` can only place to the nearest second.\n  if (record.startedAtMs < bootMs + identityToleranceMs) return \"pre-boot\"\n  const started = system.startedAtMs(record.pid)\n  // A platform with no start-time column at all has already been checked\n  // against this boot, which is the whole of its documented weaker guarantee.\n  if (started._tag === \"unsupported\") return undefined\n  if (started._tag === \"gone\") return \"process-gone\"\n  if (started._tag === \"unavailable\") return \"identity-unverified\"\n  return Math.abs(started.startedAtMs - record.startedAtMs) <= identityToleranceMs\n    ? undefined\n    : \"identity-mismatch\"\n}\n\n/** Everything the reaper checks before it is willing to signal a record. */\nconst refuse = (\n  system: System,\n  record: ProcessLedger.ProcessRecord,\n  ownerPid: number,\n  ownGroup: number | null,\n  bootMs: number\n): Refusal | undefined => {\n  // The host's own identity comes first, before the platform is consulted at\n  // all: a record naming this process is refused on every platform, whatever\n  // shape its numbers have.\n  if (record.pgid === ownerPid || record.pid === ownerPid) return \"own-group\"\n  if (ownGroup !== null && (record.pgid === ownGroup || record.pid === ownGroup)) return \"own-group\"\n  const target = system.refuseTarget(record)\n  if (target !== undefined) return target\n  // A record naming a group can only be cleared of naming THIS host's group by\n  // reading that group. When the probe cannot answer, the comparison above was\n  // not made rather than made and passed, so the record is kept instead of\n  // signalled on a guard that did not run.\n  if (record.pgid !== null && ownGroup === null) return \"own-group-unknown\"\n  if (system.isAlive(record.ownerPid) !== \"dead\") return \"owner-alive\"\n  return refuseOnIdentity(system, record, bootMs)\n}\n\n/**\n * Kills the process groups a previous incarnation of this host abandoned.\n *\n * Returns one entry per inherited record so a caller can log what it decided;\n * `killed: false` carries the {@link Refusal} that produced it. Fails with\n * {@link ProcessLedger.ProcessLedgerReplayError} when the inherited history\n * cannot be read to its end: nothing is signalled or retired, so the next\n * sweep inherits every record again.\n *\n * @category constructors\n * @since 0.1.0\n */\nexport const reap = (\n  options?: Options\n): Effect.Effect<ReadonlyArray<Reaped>, ProcessLedger.ProcessLedgerReplayError, ProcessLedger.ProcessLedger> =>\n  Effect.gen(function*() {\n    const ledger = yield* ProcessLedger.ProcessLedger\n    const system = options?.system ?? systemFor(process.platform)\n    const ownerPid = options?.ownerPid ?? process.pid\n    const ownGroup = system.ownGroup()\n    const bootMs = system.bootedAtMs()\n    const orphans = yield* ledger.orphans\n    const decided: Array<Reaped> = []\n    for (const record of orphans) {\n      const refusal = refuse(system, record, ownerPid, ownGroup, bootMs)\n      if (refusal === undefined) {\n        const outcome = system.killTree(record)\n        if (outcome === \"failed\") {\n          // Nothing was killed, so nothing is retired: leaving the record\n          // inherited is what makes the next incarnation try again.\n          decided.push({ record, killed: false, refusal: \"kill-failed\" })\n          continue\n        }\n        yield* retire(ledger.reaped(record), record.pid, \"reaped\")\n        decided.push({ record, killed: true })\n        continue\n      }\n      // A retained refusal is not this host's to retire; every other refusal is\n      // final and says so in the journal.\n      if (!retained.has(refusal)) {\n        yield* retire(ledger.skipped(record, refusal), record.pid, \"reap-skipped\")\n      }\n      decided.push({ record, killed: false, refusal })\n    }\n    return decided\n  })\n\n/**\n * Writes one ledger retirement, logging rather than failing the sweep.\n *\n * A retirement that does not commit is not a lost kill: the process is already\n * dead and the record stays inherited, so the next incarnation reads it, finds\n * the pid gone, and retires it then. Failing the whole sweep over it would\n * take the host down for a bookkeeping write.\n */\nconst retire = (\n  write: Effect.Effect<void, unknown>,\n  pid: number,\n  what: string\n): Effect.Effect<void> =>\n  write.pipe(\n    Effect.catch((error) => Effect.logWarning(`process reaper could not journal ${what} for ${pid}`, error))\n  )\n\n/**\n * Refusals that leave a dead incarnation's process running with no live owner\n * to contain it: the host could not ask, or its signal failed.\n */\nconst unreaped: ReadonlySet<Refusal> = new Set<Refusal>([\"identity-unverified\", \"own-group-unknown\", \"kill-failed\"])\n\n/**\n * Counter over inherited records the reaper did not kill, with a `refusal`\n * attribute naming why.\n *\n * @category metrics\n * @since 1.0.0-rc.1\n */\nexport const refusals = Metric.counter(\"flows_process_reaper_refusals\", {\n  description: \"Inherited process records the reaper did not kill, by refusal\"\n})\n\n/**\n * Reports one sweep: a counter update per refusal and one summary line. The\n * line is a warning when a record stays inherited (a retained refusal) or a\n * signal failed, because either leaves a crashed incarnation's processes\n * running with nothing else to say so.\n *\n * @category layers\n * @since 1.0.0-rc.1\n */\nexport const report = (decided: ReadonlyArray<Reaped>): Effect.Effect<void> =>\n  Effect.gen(function*() {\n    if (decided.length === 0) return\n    const counts: Partial<Record<Refusal, number>> = {}\n    let killed = 0\n    for (const entry of decided) {\n      if (entry.killed) {\n        killed += 1\n        continue\n      }\n      counts[entry.refusal] = (counts[entry.refusal] ?? 0) + 1\n    }\n    for (const [refusal, count] of Object.entries(counts)) {\n      yield* Metric.update(Metric.withAttributes(refusals, { refusal }), count)\n    }\n    const annotations = { killed, ...counts }\n    const alarming = decided.some((entry) => !entry.killed && unreaped.has(entry.refusal))\n    const line = \"process reaper swept inherited records\"\n    yield* (alarming ? Effect.logWarning(line) : Effect.logInfo(line)).pipe(Effect.annotateLogs(annotations))\n  })\n\n/**\n * Runs {@link reap} once while the layer is built.\n *\n * Compose it into a host layer so standing a host up is also what cleans up\n * after the incarnation that crashed. A history that cannot be read refuses\n * the sweep with an error log and leaves every record inherited; the host\n * still starts, because the processes it will spawn are recorded and\n * contained regardless. Every decision is {@link report}ed.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer = (options?: Options): Layer.Layer<never, never, ProcessLedger.ProcessLedger> =>\n  Layer.effectDiscard(\n    reap(options).pipe(\n      Effect.flatMap(report),\n      Effect.catchTag(\n        \"@smthrs/kernel/ProcessLedgerReplayError\",\n        (error) => Effect.logError(\"process reaper refused to sweep: the ledger history is incomplete\", error)\n      )\n    )\n  )\n"]}

package/dist/esm/ProcessSandbox.d.ts

@@ -0,0 +1,391 @@
+/**
+ * The one operating-system sandbox every confined process goes through.
+ *
+ * A caller resolves what a run may touch, a {@link Request}: the network
+ * posture, the read and write sets, and optionally which mechanism it wants.
+ * This module turns the request into an argv the host enforces, or into an
+ * {@link Unenforceable} refusal naming what the host lacks. Two callers share
+ * it: the build graph confines every target's tool run under its declared
+ * inputs and outputs (`@smthrs/targets/ExecSandbox`), and the Node
+ * `ProcessConfinement` confines every approved agent command under the
+ * grants in force.
+ *
+ * Three mechanisms, one contract:
+ *
+ * - Linux: bubblewrap. An empty root contains only enumerated system/runtime
+ *   paths and declared reads and writes. The workspace and root are remounted
+ *   read-only after mounting grants. A private tmp supplies HOME. The network
+ *   namespace is unshared unless explicitly opened; loopback-only is refused.
+ * - macOS: seatbelt (`sandbox-exec`). Host reads are denied except enumerated
+ *   system/runtime paths, declared inputs, external reads, writes and private
+ *   tmp. Host credential locations are re-closed under broad grants. Writes
+ *   and network access are denied except what the request opens.
+ * - Docker: `docker run` with a read-only root, declared reads mounted
+ *   read-only at their host paths, declared writes read-write, `--network
+ *   none` unless the request opens it. The image supplies the toolchain. It is
+ *   the path on Windows and on any host without the native mechanism.
+ *
+ * Every declared confinement is enforced or the caller fails closed. Nothing
+ * here logs "unenforced" and carries on; the one caller that may run
+ * unconfined when no mechanism exists, `ProcessConfinement`, says so in its
+ * own options and never on this module's behalf.
+ *
+ * @since 1.0.0-rc.1
+ */
+/**
+ * The network posture a run is confined to. `"none"` closes IP networking.
+ * Build tools retain host Unix sockets by default. Native agent confinement
+ * additionally closes host Unix sockets regardless of the IP posture, except
+ * macOS's system DNS resolver endpoint when IP networking is open, and
+ * refuses all Linux socket creation when IP networking is closed;
+ * socketpair remains available for communication inside the process family.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export type Network = "none" | "loopback" | "open";
+/**
+ * Which mechanism a request asks for. Absent means the platform's native
+ * mechanism: bubblewrap on Linux, seatbelt on macOS.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export type Selection = {
+    readonly _tag: "bubblewrap";
+} | {
+    readonly _tag: "docker";
+    readonly image: string;
+};
+/**
+ * What a caller asks for: the network posture, the mechanism choice, and the
+ * read and write sets. Every path is workspace-relative and posix-shaped;
+ * a read may name a file or a directory, a write names a directory. A
+ * `readOnly` entry re-closes a subtree under a declared write.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Request {
+    readonly network: Network;
+    /** Whether host Unix sockets are permitted; defaults to true for build tools. */
+    readonly unixSockets?: boolean | undefined;
+    /** Closed-by-default process and IPC policy for untrusted native commands. */
+    readonly strict?: boolean | undefined;
+    readonly mechanism?: Selection | undefined;
+    readonly reads: ReadonlyArray<string>;
+    readonly writes: ReadonlyArray<string>;
+    /**
+     * Declared outputs whose leaf is a file rather than a directory. A file
+     * cannot be bound writable on its own and does not exist before the tool
+     * writes it, so its parent directory becomes the writable bind. Kept apart
+     * from `writes` because only the caller knows which of the two a
+     * declaration meant: inferring it from the path would hand a not-yet-created
+     * `.cargo-home` or `dist.new` its parent, and a parent that is the
+     * workspace root opens the whole workspace for the run.
+     */
+    readonly writeFiles?: ReadonlyArray<string> | undefined;
+    readonly readOnly?: ReadonlyArray<string> | undefined;
+    /**
+     * Absolute host paths outside the workspace the tool reads: a git
+     * submodule's local source repository, for one. Bound read-only where the
+     * mechanism would otherwise hide them; a path that does not exist, or that
+     * sits inside the workspace, is dropped.
+     */
+    readonly externalReads?: ReadonlyArray<string> | undefined;
+}
+/**
+ * The host facts mechanism selection reads. Injectable so every platform's
+ * argv can be tested on every other platform.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Host {
+    readonly platform: NodeJS.Platform;
+    /** Selected Xcode developer tree on a macOS runner. */
+    readonly developerDirectory?: string | undefined;
+    /** The real host home, used to mask credentials and locate runtime caches. */
+    readonly home?: string | undefined;
+    /** Resolves an executable name on `PATH` to an absolute path, or nothing. */
+    readonly executable: (name: string) => string | undefined;
+    /** Whether a host path exists. */
+    readonly exists: (path: string) => boolean;
+    /** Whether a host path is a directory. */
+    readonly isDirectory: (path: string) => boolean;
+    /** Tests the entry itself, including dangling links; defaults to the real host. */
+    readonly isSymbolicLink?: ((path: string) => boolean) | undefined;
+    /**
+     * The names of a directory's direct children, or undefined when the host
+     * cannot list it. Optional: a host without it keeps every declared file as
+     * its own entry, which is correct and merely long.
+     */
+    readonly entries?: ((directory: string) => ReadonlyArray<string> | undefined) | undefined;
+    /**
+     * Where a path's bytes actually live once every symbolic link on it is
+     * followed, or `undefined` when the host cannot say. Write validation uses
+     * the real host when this probe is omitted and refuses unresolved existing
+     * paths. Read aliases are only collected when this probe is supplied.
+     */
+    readonly realpath?: ((path: string) => string | undefined) | undefined;
+    /**
+     * The program a package-manager shim script runs: the absolute path on the
+     * `# cmd-shim-target=` line pnpm's cmd-shim writes, or `undefined` for any
+     * other file. Optional: a host without it treats a shim as the program.
+     */
+    readonly shimTarget?: ((path: string) => string | undefined) | undefined;
+    readonly uid: number | undefined;
+    readonly gid: number | undefined;
+}
+/**
+ * One selected enforcement mechanism.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export type Mechanism = {
+    readonly _tag: "bubblewrap";
+    readonly executable: string;
+} | {
+    readonly _tag: "seatbelt";
+    readonly executable: string;
+} | {
+    readonly _tag: "docker";
+    readonly executable: string;
+    readonly image: string;
+} | {
+    readonly _tag: "none";
+};
+/**
+ * The refusal a host that cannot enforce a declared confinement produces.
+ * `mechanism` names what was selected, `missing` what the host lacks.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Unenforceable {
+    readonly _tag: "@smthrs/platform-node/SandboxUnenforceable";
+    readonly platform: NodeJS.Platform;
+    readonly mechanism: string;
+    readonly missing: string;
+    readonly message: string;
+}
+/**
+ * Checks for an {@link Unenforceable} refusal.
+ *
+ * @category guards
+ * @since 1.0.0-rc.1
+ */
+export declare const isUnenforceable: (value: unknown) => value is Unenforceable;
+/**
+ * Builds an {@link Unenforceable} refusal.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export declare const unenforceable: (platform: NodeJS.Platform, mechanism: string, missing: string, detail: string) => Unenforceable;
+/**
+ * The resolved confinement one spawn runs under. Every path is absolute and
+ * canonical.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Plan {
+    readonly mechanism: Exclude<Mechanism, {
+        readonly _tag: "none";
+    }>;
+    readonly network: Network;
+    /** Whether host Unix sockets are permitted; defaults to true for build tools. */
+    readonly unixSockets?: boolean | undefined;
+    /** Closed-by-default process and IPC policy for untrusted native commands. */
+    readonly strict?: boolean | undefined;
+    readonly workspaceRoot: string;
+    readonly cwd: string;
+    readonly reads: ReadonlyArray<string>;
+    /**
+     * Paths inside a granted directory that the declaration did not cover,
+     * re-closed after the grant. Only a mechanism with deny rules (seatbelt)
+     * folds; the others keep every declared file as its own entry.
+     */
+    readonly readDenies: ReadonlyArray<string>;
+    readonly writes: ReadonlyArray<string>;
+    readonly readOnly: ReadonlyArray<string>;
+    /**
+     * Where a declared read's bytes actually live when the path reaches them
+     * through a symbolic link that leaves the workspace.
+     *
+     * Bubblewrap needs them because it replaces `/tmp` with a private tmpfs, so
+     * a link into the host's `/tmp` (the scratch tree's `node_modules`, which
+     * points back at the real workspace) resolves to nothing inside the sandbox.
+     * Binding the real location read-only makes the link resolve to the same
+     * bytes the host sees, which is what declaring the read asked for. Docker
+     * mounts them for the same reason: the image supplies everything outside
+     * the workspace, and these paths are on the host. Seatbelt leaves the host
+     * filesystem in place but must grant the resolved spelling too. The
+     * request's own `externalReads` land here too.
+     */
+    readonly externalReads: ReadonlyArray<string>;
+    /** A host directory the run may scribble in; created by the caller, removed after. */
+    readonly tmp: string;
+    readonly uid: number | undefined;
+    readonly gid: number | undefined;
+}
+/**
+ * The real host: platform, `PATH` lookup, and filesystem probes.
+ *
+ * @category resolution
+ * @since 0.1.0
+ */
+export declare const host: (env?: Readonly<Record<string, string | undefined>>) => Host;
+/**
+ * Selects the mechanism a request runs under on a host.
+ *
+ * A docker selection is honored when `docker` is on `PATH` and refused
+ * otherwise; a bubblewrap selection is refused off Linux. With no selection
+ * the platform decides: bubblewrap on Linux, seatbelt on macOS, and a refusal
+ * elsewhere, because Windows has no user-level process sandbox and Docker
+ * needs an image only the caller can name.
+ *
+ * @category resolution
+ * @since 1.0.0-rc.1
+ */
+export declare const select: (request: Pick<Request, "network" | "mechanism">, hostFacts: Host) => Exclude<Mechanism, {
+    readonly _tag: "none";
+}> | Unenforceable;
+/**
+ * Rechecks write grants before directory creation and before rendering. Throws
+ * an {@link Unenforceable} refusal if a path changed since planning. Callers
+ * must keep the workspace stable until the operating system consumes mounts.
+ *
+ * @category resolution
+ * @since 0.1.0
+ */
+export declare const validateWrites: (confinement: Plan, hostFacts?: Host) => void;
+/**
+ * Resolves a request against a workspace into a {@link Plan}, or refuses.
+ *
+ * Every relative path is anchored at the canonical workspace root; one that
+ * escapes the workspace is dropped, because the sandbox never grants anything
+ * outside the tree the key covers. Reads that do not exist are dropped too:
+ * bubblewrap cannot bind a missing path, and a declared input that vanished is
+ * the executor's measurement failure, not this module's. A write containing
+ * any symbolic link below the canonical root is refused, including a missing
+ * output below a linked ancestor.
+ *
+ * @category resolution
+ * @since 0.1.0
+ */
+export declare const plan: (request: Request, location: {
+    readonly workspaceRoot: string;
+    readonly cwd: string;
+    readonly tmp: string;
+}, hostFacts: Host) => Plan | Unenforceable;
+/**
+ * Environment the confined process receives on top of the tool environment:
+ * a private temporary directory and home, so nothing a tool caches lands in
+ * the real home or the shared temp directory.
+ *
+ * `COREPACK_HOME` is the one host cache kept: it holds the package-manager
+ * program a corepack shim execs, the run may only read it (the mechanisms
+ * deny writes outside the workspace), and without it a confined `pnpm` is a
+ * shim with nothing to run. A non-default cache location requires an explicit
+ * `externalReads` grant; preserving the variable does not grant access.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const environment: (confinement: Plan, hostEnv?: Readonly<Record<string, string | undefined>>, hostHome?: string) => Readonly<Record<string, string>>;
+/**
+ * The program a confined run execs, made reachable inside its empty root.
+ *
+ * Bubblewrap resolves a bare program name with `execvp` against `PATH` inside
+ * the new root, and that root holds only the runtime paths and the declared
+ * sets. A package manager installed outside them — pnpm under the
+ * `pnpm/action-setup` prefix on a CI runner, a `.bin` link into a
+ * `node_modules` tree — is on the host `PATH` and absent from the sandbox, so
+ * the run died with `bwrap: execvp pnpm` before the tool started (#3140).
+ *
+ * A bare name is resolved on the tool's `PATH` (the host's when none is
+ * given). A program already inside a granted path is left exactly as spelled,
+ * so a multi-call binary keeps the name it dispatches on, and so is one inside
+ * the workspace, whose reads only the declaration may open. Otherwise the run
+ * execs the program's real file, and the nearest package directory holding it
+ * (its `package.json`, at most three levels up, never the home or the root)
+ * is bound read-only, because a script like `pnpm.cjs` loads its siblings.
+ * With no package directory only the real file is bound. A name that resolves
+ * nowhere is left for `execvp` to report.
+ *
+ * A package-manager shim script is followed like a link. `pnpm self-update`
+ * under `pnpm/action-setup` installs pnpm as a cmd-shim in `$PNPM_HOME/bin`
+ * that runs node on a package in pnpm's global store, a path relative to the
+ * script; binding the script alone left that package missing. When the
+ * program the shim names is executable, the run execs its real file and binds
+ * its package as above.
+ *
+ * @since 1.0.0
+ * @private
+ */
+export declare const launcher: (program: string, searchPath: string | undefined, granted: ReadonlyArray<string>, workspaceRoot: string, hostFacts: Host) => {
+    readonly program: string;
+    readonly reads: ReadonlyArray<string>;
+};
+/**
+ * The bubblewrap argv for a plan.
+ *
+ * Order matters: bubblewrap applies operations in argument order, so the
+ * empty root goes first, runtime paths are bound, the workspace tmpfs shadows
+ * any broad runtime grant, declared paths are bound on top, and re-closed
+ * subtrees are bound read-only over their writable parents. The tmpfs is
+ * remounted read-only last so an undeclared write
+ * under the workspace fails with `EROFS` instead of vanishing into the tmpfs.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const bubblewrap: (confinement: Plan, argv: ReadonlyArray<string>, hostFacts?: Host, searchPath?: string | undefined) => ReadonlyArray<string>;
+/**
+ * The seatbelt profile for a plan.
+ *
+ * File reads start closed, then enumerated runtime paths and declared sets
+ * are opened. The workspace is re-closed before its grants so a workspace
+ * under a runtime root does not inherit the broad runtime grant. Credentials
+ * are re-closed before explicit external reads, which can opt into them.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const seatbelt: (confinement: Plan, hostFacts?: Host) => string;
+/**
+ * The `docker run` argv for a plan. Paths keep their host spelling inside the
+ * container so an argv that names workspace paths works unchanged; the image
+ * supplies everything outside the workspace.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const docker: (confinement: Plan, argv: ReadonlyArray<string>, env: Readonly<Record<string, string>>, hostFacts?: Host, containerName?: string) => ReadonlyArray<string>;
+/**
+ * Wraps a tool argv in the plan's mechanism and reports the environment the
+ * wrapper needs the child to carry. Docker runs also return the unique
+ * container name the caller must forcibly remove when the client scope closes.
+ *
+ * @category rendering
+ * @since 0.1.0
+ */
+export declare const wrap: (confinement: Plan, argv: ReadonlyArray<string>, env: Readonly<Record<string, string>>, hostFacts?: Host) => {
+    readonly argv: ReadonlyArray<string>;
+    readonly env: Readonly<Record<string, string>>;
+    readonly containerName?: string;
+};
+/**
+ * Names, from a failed tool's own output, the paths it touched outside the
+ * declared set. The sandbox denies at the kernel, so the only witness is the
+ * tool's error text; this reads it back and says which side of the boundary
+ * each path fell on.
+ *
+ * @category diagnostics
+ * @since 0.1.0
+ */
+export declare const diagnose: (confinement: Plan, text: string) => string | undefined;
+//# sourceMappingURL=ProcessSandbox.d.ts.map

package/dist/esm/ProcessSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessSandbox.d.ts","sourceRoot":"","sources":["../../src/ProcessSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAQH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAA;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;CAC3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IAClC,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChD,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IACzD,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC1C,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC/C,mFAAmF;IACnF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;IACjE;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACzF;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACtE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,4CAA4C,CAAA;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,aAEoC,CAAA;AAE9F;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,UAAU,MAAM,CAAC,QAAQ,EACzB,WAAW,MAAM,EACjB,SAAS,MAAM,EACf,QAAQ,MAAM,KACb,aAMD,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7C,sFAAsF;IACtF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAOD;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,MAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAwB,KAAG,IAqD/F,CAAA;AA0BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,GACjB,SAAS,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,WAAW,CAAC,EAC/C,WAAW,IAAI,KACd,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,aA+ClD,CAAA;AAmED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,IAAI,EAAE,YAAW,IAAa,KAAG,IAM5E,CAAA;AAwGD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,IAAI,GACf,SAAS,OAAO,EAChB,UAAU;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxF,WAAW,IAAI,KACd,IAAI,GAAG,aAsFT,CAAA;AAsBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,GACtB,aAAa,IAAI,EACjB,UAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAwB,EAC5E,WAAU,MAAyB,KAClC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcjC,CAAA;AAuFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,QAAQ,GACnB,SAAS,MAAM,EACf,YAAY,MAAM,GAAG,SAAS,EAC9B,SAAS,aAAa,CAAC,MAAM,CAAC,EAC9B,eAAe,MAAM,EACrB,WAAW,IAAI,KACd;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAyBnE,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU,GACrB,aAAa,IAAI,EACjB,MAAM,aAAa,CAAC,MAAM,CAAC,EAC3B,YAAW,IAAa,EACxB,aAAa,MAAM,GAAG,SAAS,KAC9B,aAAa,CAAC,MAAM,CAoFtB,CAAA;AAmBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,GAAI,aAAa,IAAI,EAAE,YAAW,IAAa,KAAG,MAyGtE,CAAA;AAgBD;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,GACjB,aAAa,IAAI,EACjB,MAAM,aAAa,CAAC,MAAM,CAAC,EAC3B,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,YAAW,IAAa,EACxB,gBAAe,MAAmC,KACjD,aAAa,CAAC,MAAM,CAmCtB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,IAAI,GACf,aAAa,IAAI,EACjB,MAAM,aAAa,CAAC,MAAM,CAAC,EAC3B,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,YAAW,IAAa,KACvB;IACD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAehC,CAAA;AA8BD;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,GAAI,aAAa,IAAI,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAsCnE,CAAA"}