dorkos 0.98.0 → 0.101.0

package/dist/browser/native/darwin-journal-worker.mjs

@@ -0,0 +1,2244 @@
+// packages/browser/src/runtime/darwin-journal-worker.ts
+import { spawn as spawn3 } from "node:child_process";
+import { z as z3 } from "zod";
+
+// packages/browser/src/lifecycle/process-journal.ts
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import * as fs from "node:fs/promises";
+import { isAbsolute, join, normalize, parse } from "node:path";
+import { z } from "zod";
+var JOURNAL_LIMITS = Object.freeze({
+  bytes: 1048576,
+  writerBytes: 4096,
+  identities: 512,
+  gaps: 32,
+  depth: 16,
+  pending: 8
+});
+var GAP_CODES = [
+  "boot-unknown",
+  "boot-changed",
+  "identity-unknown",
+  "root-pending",
+  "parent-changed",
+  "association-missing",
+  "observer-lost",
+  "sequence-gap",
+  "frame-invalid",
+  "capacity-exceeded",
+  "read-uncertain",
+  "persistence-uncertain",
+  "custody-pending"
+];
+var counter = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var text = (cap) => z.string().min(1).refine(
+  (v) => v.length <= cap && Buffer.byteLength(v) <= cap && Buffer.from(v).toString("utf8") === v && ![...v].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)
+);
+var opaque = text(64).refine((v) => /^[A-Za-z0-9_-]+$/.test(v));
+var digestSchema = z.string().regex(/^[a-f0-9]{64}$/);
+var ProcessIdentitySchema = z.object({ pid: counter.refine((v) => v > 0), birth: text(128) }).strict();
+var BootScopeSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("observed"), value: text(128), sourceIdentityDigest: digestSchema }).strict(),
+  z.object({ kind: z.literal("unknown"), cause: z.enum(GAP_CODES) }).strict()
+]);
+var JournalBindingSchema = z.object({
+  journalId: opaque,
+  browserId: opaque,
+  profile: z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("persistent"), profileId: opaque }).strict(),
+    z.object({ kind: z.literal("ephemeral") }).strict()
+  ]),
+  browserGeneration: counter,
+  reservationNonce: opaque,
+  runtimeIdentityDigest: digestSchema,
+  manager: ProcessIdentitySchema,
+  bootScope: BootScopeSchema
+}).strict();
+var JournalWriterSchema = z.object({ writerId: opaque, epoch: counter, kind: z.enum(["manager", "observer", "reconciler"]) }).strict();
+var ObservationWindowSchema = z.object({
+  startSequence: counter,
+  checkpointSequence: counter,
+  endSequence: counter,
+  startMonotonic: z.number().finite().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  endMonotonic: z.number().finite().nonnegative().max(Number.MAX_SAFE_INTEGER)
+}).strict().refine(
+  (w) => w.startSequence <= w.checkpointSequence && w.checkpointSequence <= w.endSequence && w.startMonotonic <= w.endMonotonic
+);
+var AssociationSchema = z.object({
+  parentBefore: ProcessIdentitySchema,
+  parentAfter: ProcessIdentitySchema,
+  child: ProcessIdentitySchema,
+  childParentPid: counter.refine((v) => v > 0),
+  window: ObservationWindowSchema,
+  recordedSequence: counter,
+  parentDeathSequence: counter.nullable()
+}).strict().refine(
+  (a) => sameProcess(a.parentBefore, a.parentAfter) && a.child.pid !== a.parentBefore.pid && a.childParentPid === a.parentBefore.pid && a.window.endSequence <= a.recordedSequence && (a.parentDeathSequence === null || a.recordedSequence < a.parentDeathSequence)
+);
+var retainedSchema = z.object({
+  identity: ProcessIdentitySchema,
+  role: z.enum(["manager", "root", "descendant"]),
+  parent: ProcessIdentitySchema.nullable(),
+  association: AssociationSchema.nullable(),
+  currentParent: ProcessIdentitySchema.nullable(),
+  acquisitionEpoch: counter,
+  firstSeenSequence: counter,
+  lastSeenSequence: counter,
+  relationWindow: ObservationWindowSchema,
+  lifecycle: z.enum(["alive", "exited-unreaped", "dead", "replacement", "unknown"])
+}).strict();
+var gapSchema = z.object({
+  cause: z.enum(GAP_CODES),
+  firstSequence: counter,
+  identity: ProcessIdentitySchema.nullable(),
+  count: counter.refine((v) => v > 0)
+}).strict();
+var causeSchema = z.object({ cause: z.enum(GAP_CODES), sequence: counter }).strict();
+var JournalSnapshotSchema = z.object({
+  schemaVersion: z.literal(1),
+  kind: z.literal("browser-process-journal"),
+  provenance: z.literal("recorded-data"),
+  binding: JournalBindingSchema,
+  writer: JournalWriterSchema,
+  sequence: counter,
+  phase: z.enum([
+    "allocated",
+    "launch-intent",
+    "observing",
+    "manager-lost",
+    "reconciling",
+    "observation-ended",
+    "retained"
+  ]),
+  observationWindow: ObservationWindowSchema,
+  root: z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("pending") }).strict(),
+    z.object({ kind: z.literal("absent-before-launch") }).strict(),
+    z.object({
+      kind: z.literal("attributed"),
+      identity: ProcessIdentitySchema,
+      association: AssociationSchema
+    }).strict()
+  ]),
+  retainedIdentities: z.array(retainedSchema).max(JOURNAL_LIMITS.identities),
+  gaps: z.array(gapSchema).max(JOURNAL_LIMITS.gaps),
+  firstCause: causeSchema.nullable()
+}).strict();
+var ProcessJournalError = class extends Error {
+  constructor(causeCode) {
+    super(causeCode);
+    this.causeCode = causeCode;
+    this.name = "ProcessJournalError";
+  }
+  causeCode;
+};
+function insist(ok, cause = "frame-invalid") {
+  if (!ok) throw new ProcessJournalError(cause);
+}
+function sameProcess(a, b) {
+  return a.pid === b.pid && a.birth === b.birth;
+}
+function processKey(identity4) {
+  return JSON.stringify([identity4.pid, identity4.birth]);
+}
+function copyJournalData(value) {
+  const seen = /* @__PURE__ */ new WeakSet();
+  let nodes = 0;
+  const visit = (item, depth) => {
+    insist(++nodes <= 32768 && depth <= JOURNAL_LIMITS.depth, "capacity-exceeded");
+    if (item === null || typeof item === "boolean") return item;
+    if (typeof item === "number") {
+      insist(Number.isFinite(item));
+      return item;
+    }
+    if (typeof item === "string") {
+      insist(item.length <= 128 && Buffer.byteLength(item) <= 128, "capacity-exceeded");
+      insist(Buffer.from(item).toString("utf8") === item);
+      return item;
+    }
+    insist(typeof item === "object" && item !== null);
+    insist(!seen.has(item));
+    seen.add(item);
+    const array = Array.isArray(item);
+    const proto = Object.getPrototypeOf(item);
+    insist(array ? proto === Array.prototype : proto === Object.prototype || proto === null);
+    insist(Object.getOwnPropertySymbols(item).length === 0);
+    const keys = Object.getOwnPropertyNames(item);
+    if (array) {
+      const length = Object.getOwnPropertyDescriptor(item, "length");
+      insist(
+        length && "value" in length && Number.isSafeInteger(length.value) && length.value >= 0 && length.value <= JOURNAL_LIMITS.identities,
+        "capacity-exceeded"
+      );
+      insist(keys.length === length.value + 1);
+      const out2 = [];
+      for (let i = 0; i < length.value; i++) {
+        const descriptor = Object.getOwnPropertyDescriptor(item, String(i));
+        insist(descriptor && "value" in descriptor && descriptor.enumerable);
+        out2.push(visit(descriptor.value, depth + 1));
+      }
+      seen.delete(item);
+      return out2;
+    }
+    insist(keys.length <= 24, "capacity-exceeded");
+    const out = /* @__PURE__ */ Object.create(null);
+    for (const key of keys) {
+      insist(
+        key.length <= 64 && !["__proto__", "constructor", "prototype", "then", "toJSON"].includes(key)
+      );
+      const descriptor = Object.getOwnPropertyDescriptor(item, key);
+      insist(descriptor && "value" in descriptor && descriptor.enumerable);
+      out[key] = visit(descriptor.value, depth + 1);
+    }
+    seen.delete(item);
+    return out;
+  };
+  try {
+    return visit(value, 0);
+  } catch (error) {
+    throw error instanceof ProcessJournalError ? error : new ProcessJournalError("frame-invalid");
+  }
+}
+function frozen(value) {
+  if (value && typeof value === "object") {
+    for (const child of Object.values(value)) frozen(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+function recordedJSON(value) {
+  const sort = (item) => {
+    if (Array.isArray(item)) return item.map(sort);
+    if (item && typeof item === "object")
+      return Object.fromEntries(
+        Object.entries(item).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => [k, sort(v)])
+      );
+    return item;
+  };
+  return JSON.stringify(sort(copyJournalData(value)));
+}
+function sameJournalBinding(a, b) {
+  return recordedJSON(a) === recordedJSON(b);
+}
+function validateJournalSnapshot(value) {
+  const parsed = JournalSnapshotSchema.safeParse(copyJournalData(value));
+  insist(parsed.success);
+  const s = parsed.data;
+  insist(s.observationWindow.endSequence <= s.sequence);
+  const identities = new Map(s.retainedIdentities.map((r) => [processKey(r.identity), r]));
+  insist(identities.size === s.retainedIdentities.length);
+  const managers = s.retainedIdentities.filter((r) => r.role === "manager");
+  insist(managers.length === 1 && sameProcess(managers[0].identity, s.binding.manager));
+  for (const r of s.retainedIdentities) {
+    insist(
+      r.firstSeenSequence <= r.lastSeenSequence && r.lastSeenSequence <= s.sequence && r.relationWindow.endSequence <= r.firstSeenSequence && r.acquisitionEpoch <= s.writer.epoch
+    );
+    if (r.lifecycle === "exited-unreaped")
+      insist(
+        r.role === "descendant" && r.association !== null && r.parent !== null && r.firstSeenSequence < r.lastSeenSequence,
+        "association-missing"
+      );
+    if (r.lifecycle === "unknown")
+      insist(
+        s.gaps.some(
+          (g) => g.cause === "identity-unknown" && (g.identity === null || sameProcess(g.identity, r.identity))
+        ),
+        "identity-unknown"
+      );
+    if (r.role === "manager") insist(r.parent === null && r.association === null);
+    else {
+      const a = r.association;
+      insist(
+        a && r.parent && sameProcess(a.parentBefore, r.parent) && sameProcess(a.child, r.identity) && a.recordedSequence === r.firstSeenSequence && identities.has(processKey(r.parent)),
+        "association-missing"
+      );
+      insist(recordedJSON(a.window) === recordedJSON(r.relationWindow));
+      let ancestor = r.parent, depth = 0;
+      const visited = /* @__PURE__ */ new Set([processKey(r.identity)]);
+      while (ancestor) {
+        const key = processKey(ancestor);
+        insist(!visited.has(key) && ++depth <= JOURNAL_LIMITS.depth, "association-missing");
+        visited.add(key);
+        const parent = identities.get(key);
+        insist(parent, "association-missing");
+        ancestor = parent.parent;
+      }
+    }
+  }
+  const roots = s.retainedIdentities.filter((r) => r.role === "root");
+  if (s.root.kind === "attributed") {
+    insist(
+      roots.length === 1 && sameProcess(roots[0].identity, s.root.identity) && recordedJSON(roots[0].association) === recordedJSON(s.root.association),
+      "association-missing"
+    );
+  } else insist(roots.length === 0, "root-pending");
+  const gapKinds = new Set(s.gaps.map((g) => g.cause));
+  insist(gapKinds.size === s.gaps.length && s.gaps.every((g) => g.firstSequence <= s.sequence));
+  if (s.gaps.length)
+    insist(
+      s.firstCause && s.gaps.some(
+        (g) => g.cause === s.firstCause.cause && g.firstSequence === s.firstCause.sequence
+      ) && s.firstCause.sequence === Math.min(...s.gaps.map((g) => g.firstSequence))
+    );
+  else insist(s.firstCause === null);
+  insist(Buffer.byteLength(recordedJSON(s)) <= JOURNAL_LIMITS.bytes, "capacity-exceeded");
+  return frozen(s);
+}
+var phases = [
+  "allocated",
+  "launch-intent",
+  "observing",
+  "manager-lost",
+  "reconciling",
+  "observation-ended",
+  "retained"
+];
+function successor(prior, next) {
+  insist(
+    sameJournalBinding(prior.binding, next.binding) && next.sequence === prior.sequence + 1 && next.writer.epoch === prior.writer.epoch && recordedJSON(next.writer) === recordedJSON(prior.writer),
+    "sequence-gap"
+  );
+  insist(
+    phases.indexOf(next.phase) >= phases.indexOf(prior.phase) && next.observationWindow.startSequence >= prior.observationWindow.startSequence && next.observationWindow.checkpointSequence >= prior.observationWindow.checkpointSequence && next.observationWindow.endSequence >= prior.observationWindow.endSequence && next.observationWindow.startMonotonic >= prior.observationWindow.startMonotonic && next.observationWindow.endMonotonic >= prior.observationWindow.endMonotonic,
+    "sequence-gap"
+  );
+  if (prior.root.kind === "attributed")
+    insist(recordedJSON(prior.root) === recordedJSON(next.root), "association-missing");
+  if (prior.firstCause) insist(recordedJSON(prior.firstCause) === recordedJSON(next.firstCause));
+  for (const gap of prior.gaps)
+    insist(
+      next.gaps.some(
+        (g) => g.cause === gap.cause && g.firstSequence === gap.firstSequence && g.count >= gap.count && recordedJSON(g.identity) === recordedJSON(gap.identity)
+      )
+    );
+  for (const old of prior.retainedIdentities) {
+    const current = next.retainedIdentities.find((r) => sameProcess(r.identity, old.identity));
+    insist(
+      current && current.role === old.role && current.acquisitionEpoch === old.acquisitionEpoch && current.firstSeenSequence === old.firstSeenSequence && current.lastSeenSequence >= old.lastSeenSequence && recordedJSON(current.parent) === recordedJSON(old.parent) && recordedJSON(current.association) === recordedJSON(old.association) && recordedJSON(current.relationWindow) === recordedJSON(old.relationWindow),
+      "association-missing"
+    );
+  }
+  for (const old of prior.retainedIdentities)
+    if (old.lifecycle === "exited-unreaped") {
+      const current = next.retainedIdentities.find((r) => sameProcess(r.identity, old.identity));
+      insist(current && current.lifecycle !== "alive", "identity-unknown");
+    }
+  for (const added of next.retainedIdentities)
+    if (!prior.retainedIdentities.some((r) => sameProcess(r.identity, added.identity))) {
+      const parent = prior.retainedIdentities.find(
+        (r) => added.parent && sameProcess(r.identity, added.parent)
+      );
+      insist(
+        added.role !== "manager" && added.firstSeenSequence === next.sequence && parent && parent.lifecycle === "alive",
+        "association-missing"
+      );
+    }
+}
+var heldFiles = /* @__PURE__ */ new Set();
+var localFileSlots = 0;
+var Files = class {
+  constructor(hooks = {}) {
+    this.hooks = hooks;
+  }
+  hooks;
+  duties = [];
+  async point(point) {
+    await this.hooks.fault?.(point);
+  }
+  async open(path, flags, mode = 384) {
+    insist(this.duties.length < 64 && localFileSlots < 64, "capacity-exceeded");
+    const duty = {
+      acquisitionPending: true,
+      acquired: false,
+      closeAttempted: false,
+      closed: false
+    };
+    this.duties.push(duty);
+    localFileSlots++;
+    try {
+      duty.handle = await fs.open(path, flags, mode);
+      duty.acquired = true;
+      duty.acquisitionPending = false;
+    } catch (error) {
+      const code = error.code;
+      if (code === "EEXIST" || code === "ENOENT") {
+        duty.acquisitionPending = false;
+        localFileSlots--;
+      }
+      throw error;
+    }
+    return duty;
+  }
+  async close(duty, point) {
+    if (duty.closeAttempted) return;
+    duty.closeAttempted = true;
+    let failed = false, fault;
+    try {
+      if (point) await this.point(point);
+    } catch (error) {
+      failed = true;
+      fault = error;
+    }
+    try {
+      await duty.handle.close();
+      duty.closed = true;
+      localFileSlots--;
+    } catch (error) {
+      if (!failed) {
+        failed = true;
+        fault = error;
+      }
+    }
+    if (failed) throw fault;
+  }
+  async drain() {
+    let ok = true;
+    for (const duty of this.duties)
+      if (duty.acquired && !duty.closeAttempted) {
+        try {
+          await this.close(duty);
+        } catch {
+          ok = false;
+        }
+      }
+    const returned = ok && this.duties.every((d) => !d.acquisitionPending && (!d.acquired || d.closed));
+    if (this.duties.some((d) => d.acquisitionPending || d.acquired && !d.closed))
+      heldFiles.add(this);
+    return returned;
+  }
+  custody() {
+    return Object.freeze({
+      opens: this.duties.filter((d) => d.acquired).length,
+      closesAttempted: this.duties.filter((d) => d.closeAttempted).length,
+      closed: this.duties.filter((d) => d.closed).length,
+      held: this.duties.filter((d) => d.acquisitionPending || d.acquired && !d.closed).length
+    });
+  }
+};
+async function withOriginalClose(io, duty, operation, point) {
+  let failed = false, failure;
+  let result;
+  try {
+    result = await operation();
+  } catch (error) {
+    failed = true;
+    failure = error;
+  }
+  try {
+    await io.close(duty, point);
+  } catch (error) {
+    if (!failed) {
+      failed = true;
+      failure = error;
+    }
+  }
+  if (failed) throw failure;
+  return result;
+}
+var readFlags = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+var createFlags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+function identity(s) {
+  const shared = {
+    device: String(s.dev),
+    inode: String(s.ino),
+    mode: Number(s.mode),
+    uid: Number(s.uid)
+  };
+  if (s.isDirectory()) return { ...shared, type: "directory" };
+  insist(s.isFile() && !s.isSymbolicLink(), "read-uncertain");
+  return {
+    ...shared,
+    type: "file",
+    size: String(s.size),
+    mtimeNs: String(s.mtimeNs),
+    ctimeNs: String(s.ctimeNs)
+  };
+}
+function sameFile(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function sameDirectory(a, b) {
+  return a.type === "directory" && a.device === b.device && a.inode === b.inode && a.mode === b.mode && a.uid === b.uid;
+}
+async function named(path) {
+  return identity(await fs.lstat(path, { bigint: true }));
+}
+async function maybe(path) {
+  try {
+    return await named(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function observeJournalDirectory(path) {
+  insist(isAbsolute(path) && normalize(path) === path && path.length <= 4096, "read-uncertain");
+  let current = parse(path).root;
+  for (const part of path.slice(current.length).split("/").filter(Boolean)) {
+    current = join(current, part);
+    insist((await named(current)).type === "directory", "read-uncertain");
+  }
+  const value = await named(path);
+  insist(value.type === "directory" && (value.mode & 63) === 0, "read-uncertain");
+  return Object.freeze(value);
+}
+function location(options) {
+  const binding = JournalBindingSchema.parse(copyJournalData(options.binding));
+  const p = z.object({
+    device: z.string().regex(/^\d+$/),
+    inode: z.string().regex(/^\d+$/),
+    mode: counter,
+    uid: counter,
+    type: z.literal("directory")
+  }).strict().parse(copyJournalData(options.parentIdentity));
+  insist(
+    p && p.type === "directory" && /^\d+$/.test(p.device) && /^\d+$/.test(p.inode) && Number.isSafeInteger(p.mode) && Number.isSafeInteger(p.uid) && (p.mode & 63) === 0,
+    "read-uncertain"
+  );
+  insist(
+    isAbsolute(options.parentDirectory) && normalize(options.parentDirectory) === options.parentDirectory && options.parentDirectory.length <= 4096,
+    "read-uncertain"
+  );
+  return Object.freeze({
+    parentDirectory: options.parentDirectory,
+    parentIdentity: Object.freeze({ ...p }),
+    binding: frozen(binding)
+  });
+}
+function rootPath(l) {
+  return join(l.parentDirectory, "journal-" + l.binding.journalId);
+}
+async function assertParent(l, io) {
+  await io.point("parent-check");
+  insist(
+    sameDirectory(await observeJournalDirectory(l.parentDirectory), l.parentIdentity),
+    "parent-changed"
+  );
+}
+async function assertRoot(l, pin, io) {
+  await assertParent(l, io);
+  insist(sameDirectory(await named(rootPath(l)), pin), "parent-changed");
+}
+async function syncDirectory(path, io, point) {
+  const before = await named(path);
+  insist(before.type === "directory", "persistence-uncertain");
+  const d = await io.open(path, readFlags | constants.O_DIRECTORY);
+  await withOriginalClose(
+    io,
+    d,
+    async () => {
+      insist(
+        sameFile(before, identity(await d.handle.stat({ bigint: true }))),
+        "persistence-uncertain"
+      );
+      await io.point(point);
+      await d.handle.sync();
+      insist(sameFile(before, await named(path)), "persistence-uncertain");
+    },
+    "directory-close"
+  );
+}
+async function writeAll(d, bytes, io, point) {
+  const cap = io.hooks.writeChunkBytes ?? 65536;
+  insist(Number.isSafeInteger(cap) && cap > 0 && cap <= 65536);
+  let offset = 0;
+  while (offset < bytes.length) {
+    await io.point(point);
+    const { bytesWritten } = await d.handle.write(
+      bytes,
+      offset,
+      Math.min(cap, bytes.length - offset),
+      offset
+    );
+    insist(
+      bytesWritten > 0 && bytesWritten <= Math.min(cap, bytes.length - offset),
+      "persistence-uncertain"
+    );
+    offset += bytesWritten;
+  }
+}
+var sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function checkDepth(bytes) {
+  const textValue = bytes.toString("utf8");
+  insist(Buffer.from(textValue).equals(bytes));
+  let depth = 0, quoted = false, escaped = false;
+  for (const char of textValue) {
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === "{" || char === "[")
+      insist(++depth <= JOURNAL_LIMITS.depth, "capacity-exceeded");
+    else if (char === "}" || char === "]") insist(--depth >= 0);
+  }
+  insist(!quoted && depth === 0);
+  return textValue;
+}
+async function readSnapshot(l, root, io) {
+  await assertRoot(l, root, io);
+  const path = join(rootPath(l), "snapshot.json");
+  const before = await maybe(path);
+  if (!before) {
+    await assertRoot(l, root, io);
+    insist(await maybe(path) === null, "read-uncertain");
+    return null;
+  }
+  insist(
+    before.type === "file" && BigInt(before.size) <= BigInt(JOURNAL_LIMITS.bytes) && before.uid === root.uid && (before.mode & 63) === 0,
+    "read-uncertain"
+  );
+  await io.point("reader-open");
+  const d = await io.open(path, readFlags);
+  const result = await withOriginalClose(
+    io,
+    d,
+    async () => {
+      insist(sameFile(before, identity(await d.handle.stat({ bigint: true }))), "read-uncertain");
+      const buffer = Buffer.alloc(Math.min(JOURNAL_LIMITS.bytes + 1, Number(before.size) + 1));
+      let offset = 0;
+      while (offset < buffer.length) {
+        await io.point("reader-read");
+        const { bytesRead } = await d.handle.read(
+          buffer,
+          offset,
+          Math.min(65536, buffer.length - offset),
+          offset
+        );
+        if (!bytesRead) break;
+        offset += bytesRead;
+      }
+      insist(offset === Number(before.size), "read-uncertain");
+      const bytes = buffer.subarray(0, offset);
+      const raw = checkDepth(bytes);
+      const snapshot = validateJournalSnapshot(JSON.parse(raw));
+      insist(recordedJSON(snapshot) === raw);
+      insist(sameJournalBinding(snapshot.binding, l.binding), "boot-changed");
+      insist(
+        sameFile(before, identity(await d.handle.stat({ bigint: true }))) && sameFile(before, await named(path)),
+        "read-uncertain"
+      );
+      return { snapshot, digest: sha(bytes), identity: before };
+    },
+    "reader-close"
+  );
+  insist(sameFile(before, await named(path)), "read-uncertain");
+  await assertRoot(l, root, io);
+  return result;
+}
+var ticketBrand = /* @__PURE__ */ Symbol("journal-successor");
+var tickets = /* @__PURE__ */ new WeakMap();
+async function openJournalWriter(options) {
+  const io = new Files(options);
+  let marker;
+  let l, root, prior;
+  let writerIdentity, markerPin;
+  const markerName = "writer.json", temporaryName = "snapshot.tmp";
+  let markerAcquired = false;
+  try {
+    l = location(options);
+    writerIdentity = frozen(JournalWriterSchema.parse(copyJournalData(options.writer)));
+    const expected = z.discriminatedUnion("kind", [
+      z.object({ kind: z.literal("absent") }).strict(),
+      z.object({ kind: z.literal("recorded"), sequence: counter, digest: digestSchema }).strict()
+    ]).parse(copyJournalData(options.prior));
+    await assertParent(l, io);
+    const ticket = options.ticket && tickets.get(options.ticket);
+    if (options.ticket) {
+      insist(
+        ticket && !ticket.used && sameJournalBinding(ticket.location.binding, l.binding) && ticket.location.parentDirectory === l.parentDirectory && sameDirectory(ticket.location.parentIdentity, l.parentIdentity) && recordedJSON(ticket.writer) === recordedJSON(writerIdentity),
+        "sequence-gap"
+      );
+      ticket.used = true;
+    } else insist(expected.kind === "absent", "custody-pending");
+    let initial = await maybe(rootPath(l));
+    if (initial && !ticket) {
+      if (await maybe(join(rootPath(l), markerName))) {
+        const busy = new Error("journal writer exists");
+        busy.code = "EEXIST";
+        throw busy;
+      }
+      throw new ProcessJournalError("custody-pending");
+    }
+    if (!initial) {
+      insist(!ticket && expected.kind === "absent", "sequence-gap");
+      await fs.mkdir(rootPath(l), { mode: 448 });
+      initial = await named(rootPath(l));
+      insist(
+        initial.type === "directory" && initial.uid === l.parentIdentity.uid && (initial.mode & 63) === 0
+      );
+      await io.point("namespace-created");
+      await assertRoot(l, initial, io);
+      await syncDirectory(rootPath(l), io, "namespace-sync");
+      await syncDirectory(l.parentDirectory, io, "parent-sync");
+    }
+    insist(
+      initial.type === "directory" && initial.uid === l.parentIdentity.uid && (initial.mode & 63) === 0,
+      "read-uncertain"
+    );
+    root = initial;
+    if (ticket) insist(sameDirectory(root, ticket.root), "read-uncertain");
+    await assertRoot(l, root, io);
+    await io.point("marker-open");
+    await assertRoot(l, root, io);
+    marker = await io.open(join(rootPath(l), markerName), createFlags);
+    markerAcquired = true;
+    prior = await readSnapshot(l, root, io);
+    if (expected.kind === "absent") insist(prior === null, "sequence-gap");
+    else
+      insist(
+        prior && prior.digest === expected.digest && prior.snapshot.sequence === expected.sequence && ticket && ticket.prior?.digest === prior.digest,
+        "sequence-gap"
+      );
+    insist(await maybe(join(rootPath(l), temporaryName)) === null, "persistence-uncertain");
+    const ownerBytes = Buffer.from(
+      recordedJSON({
+        schemaVersion: 1,
+        binding: l.binding,
+        writer: writerIdentity,
+        phase: "allocated",
+        sequence: prior?.snapshot.sequence ?? null,
+        digest: prior?.digest ?? null
+      })
+    );
+    insist(ownerBytes.length <= JOURNAL_LIMITS.writerBytes, "capacity-exceeded");
+    await writeAll(marker, ownerBytes, io, "marker-write");
+    await io.point("marker-sync");
+    await marker.handle.sync();
+    markerPin = identity(await marker.handle.stat({ bigint: true }));
+    insist(sameFile(markerPin, await named(join(rootPath(l), markerName))));
+    await syncDirectory(rootPath(l), io, "namespace-sync");
+    await syncDirectory(l.parentDirectory, io, "parent-sync");
+    await assertRoot(l, root, io);
+  } catch (error) {
+    await io.drain();
+    const busy = !markerAcquired && error?.code === "EEXIST";
+    return Object.freeze({
+      state: busy ? "busy" : markerAcquired ? "uncertain" : "refused",
+      cause: error instanceof ProcessJournalError ? error.causeCode : busy ? "custody-pending" : "persistence-uncertain",
+      custody: io.custody()
+    });
+  }
+  const markerOriginal = marker;
+  let accepting = true, firstCause = null, pending = 0;
+  let tail = Promise.resolve();
+  let closePromise = null;
+  let handoffPromise = null;
+  const heldCalls = /* @__PURE__ */ new Set();
+  const custody = () => {
+    const records = [io.custody(), ...[...heldCalls].map((call) => call.custody())];
+    return Object.freeze({
+      opens: records.reduce((n, r) => n + r.opens, 0),
+      closesAttempted: records.reduce((n, r) => n + r.closesAttempted, 0),
+      closed: records.reduce((n, r) => n + r.closed, 0),
+      held: records.reduce((n, r) => n + r.held, 0)
+    });
+  };
+  const fail = (cause) => {
+    firstCause ??= cause;
+    accepting = false;
+  };
+  const markerCurrent = async (call) => {
+    insist(firstCause === null, firstCause ?? "persistence-uncertain");
+    await assertRoot(l, root, call);
+    insist(firstCause === null, firstCause ?? "persistence-uncertain");
+    insist(
+      sameFile(markerPin, identity(await markerOriginal.handle.stat({ bigint: true }))) && sameFile(markerPin, await named(join(rootPath(l), markerName))),
+      "persistence-uncertain"
+    );
+  };
+  const uncertain = (call, phase, nextDigest) => Object.freeze({
+    state: "uncertain",
+    cause: firstCause ?? "persistence-uncertain",
+    phase,
+    oldDigest: prior?.digest ?? null,
+    newDigest: nextDigest,
+    custody: call.custody()
+  });
+  const commit = async (input) => {
+    const call = new Files(options);
+    let phase = "validation", nextDigest = null;
+    try {
+      insist(firstCause === null, firstCause ?? "persistence-uncertain");
+      const next = validateJournalSnapshot(input);
+      insist(
+        sameJournalBinding(next.binding, l.binding) && recordedJSON(next.writer) === recordedJSON(writerIdentity),
+        "sequence-gap"
+      );
+      if (prior) {
+        const previous = prior.snapshot;
+        if (previous.writer.epoch === writerIdentity.epoch) successor(previous, next);
+        else {
+          insist(
+            previous.writer.epoch < Number.MAX_SAFE_INTEGER && writerIdentity.epoch === previous.writer.epoch + 1,
+            "sequence-gap"
+          );
+          successor(validateJournalSnapshot({ ...previous, writer: writerIdentity }), next);
+        }
+      } else insist(next.sequence === 0, "sequence-gap");
+      const bytes = Buffer.from(recordedJSON(next));
+      nextDigest = sha(bytes);
+      await markerCurrent(call);
+      const current = await readSnapshot(l, root, call);
+      insist(
+        (current?.digest ?? null) === (prior?.digest ?? null) && (!current || !prior || sameFile(current.identity, prior.identity)),
+        "persistence-uncertain"
+      );
+      const temporary = join(rootPath(l), temporaryName);
+      insist(await maybe(temporary) === null, "persistence-uncertain");
+      phase = "temporary";
+      await call.point("payload-open");
+      await markerCurrent(call);
+      const d = await call.open(temporary, createFlags);
+      const payloadPin = await withOriginalClose(
+        call,
+        d,
+        async () => {
+          await writeAll(d, bytes, call, "payload-write");
+          await call.point("payload-sync");
+          await d.handle.sync();
+          const pin = identity(await d.handle.stat({ bigint: true }));
+          insist(
+            pin.type === "file" && Number(pin.size) === bytes.length && sameFile(pin, await named(temporary)),
+            "persistence-uncertain"
+          );
+          return pin;
+        },
+        "payload-close"
+      );
+      await markerCurrent(call);
+      insist(sameFile(payloadPin, await named(temporary)), "persistence-uncertain");
+      const destination = join(rootPath(l), "snapshot.json"), namedPrior = await maybe(destination);
+      insist(
+        prior ? namedPrior && sameFile(namedPrior, prior.identity) : namedPrior === null,
+        "persistence-uncertain"
+      );
+      phase = "rename-pending";
+      await call.point("snapshot-rename");
+      await markerCurrent(call);
+      const finalPrior = await maybe(destination);
+      insist(
+        prior ? finalPrior && sameFile(finalPrior, prior.identity) : finalPrior === null,
+        "persistence-uncertain"
+      );
+      await fs.rename(temporary, destination);
+      phase = "renamed";
+      await syncDirectory(rootPath(l), call, "snapshot-directory-sync");
+      await syncDirectory(l.parentDirectory, call, "parent-sync");
+      await markerCurrent(call);
+      const read = await readSnapshot(l, root, call);
+      insist(read && read.digest === nextDigest, "persistence-uncertain");
+      insist(await call.drain(), "custody-pending");
+      prior = read;
+      return Object.freeze({
+        state: "durable-recorded",
+        sequence: next.sequence,
+        digest: nextDigest,
+        custody: call.custody()
+      });
+    } catch (error) {
+      fail(error instanceof ProcessJournalError ? error.causeCode : "persistence-uncertain");
+      if (!await call.drain()) {
+        heldCalls.add(call);
+        fail("custody-pending");
+      }
+      return uncertain(call, phase, nextDigest);
+    }
+  };
+  const owner = Object.freeze({
+    commitSnapshot(input) {
+      if (!accepting || pending >= JOURNAL_LIMITS.pending) {
+        if (pending >= JOURNAL_LIMITS.pending) fail("capacity-exceeded");
+        return Promise.resolve(uncertain(new Files(), "admission", null));
+      }
+      let snapshot;
+      try {
+        snapshot = validateJournalSnapshot(input);
+      } catch (error) {
+        fail(error instanceof ProcessJournalError ? error.causeCode : "frame-invalid");
+        return Promise.resolve(uncertain(new Files(), "validation", null));
+      }
+      pending++;
+      const operation = tail.then(() => commit(snapshot));
+      tail = operation.then(
+        () => {
+          pending--;
+        },
+        () => {
+          pending--;
+          fail("persistence-uncertain");
+        }
+      );
+      return operation;
+    },
+    handoff(nextWriter) {
+      if (handoffPromise) return handoffPromise;
+      if (closePromise || !accepting)
+        return Promise.resolve(
+          Object.freeze({
+            state: "uncertain",
+            cause: firstCause ?? "custody-pending",
+            custody: custody()
+          })
+        );
+      accepting = false;
+      let proposedWriter;
+      try {
+        proposedWriter = frozen(JournalWriterSchema.parse(copyJournalData(nextWriter)));
+      } catch {
+        fail("frame-invalid");
+        handoffPromise = (async () => {
+          await tail;
+          await io.drain();
+          return Object.freeze({
+            state: "uncertain",
+            cause: firstCause,
+            custody: custody()
+          });
+        })();
+        return handoffPromise;
+      }
+      handoffPromise = (async () => {
+        await tail;
+        const call = new Files(options);
+        try {
+          insist(firstCause === null, firstCause ?? "persistence-uncertain");
+          const next = proposedWriter;
+          insist(
+            writerIdentity.epoch < Number.MAX_SAFE_INTEGER && next.epoch === writerIdentity.epoch + 1,
+            "sequence-gap"
+          );
+          await markerCurrent(call);
+          const bytes = Buffer.from(
+            recordedJSON({
+              schemaVersion: 1,
+              binding: l.binding,
+              writer: writerIdentity,
+              phase: "handoff",
+              successor: next,
+              sequence: prior?.snapshot.sequence ?? null,
+              digest: prior?.digest ?? null
+            })
+          );
+          insist(bytes.length <= JOURNAL_LIMITS.writerBytes, "capacity-exceeded");
+          await call.point("handoff-write");
+          await markerOriginal.handle.truncate(0);
+          await writeAll(markerOriginal, bytes, call, "marker-write");
+          await call.point("marker-sync");
+          await markerOriginal.handle.sync();
+          markerPin = identity(await markerOriginal.handle.stat({ bigint: true }));
+          await syncDirectory(rootPath(l), call, "namespace-sync");
+          await markerCurrent(call);
+          await io.close(markerOriginal, "marker-close");
+          insist(await io.drain(), "custody-pending");
+          insist(
+            sameFile(markerPin, await named(join(rootPath(l), markerName))),
+            "persistence-uncertain"
+          );
+          await call.point("marker-unlink");
+          await assertRoot(l, root, call);
+          insist(
+            sameFile(markerPin, await named(join(rootPath(l), markerName))),
+            "persistence-uncertain"
+          );
+          await fs.unlink(join(rootPath(l), markerName));
+          await syncDirectory(rootPath(l), call, "handoff-directory-sync");
+          await syncDirectory(l.parentDirectory, call, "parent-sync");
+          insist(await maybe(join(rootPath(l), markerName)) === null, "persistence-uncertain");
+          insist(await call.drain(), "custody-pending");
+          const ticket = Object.freeze({ [ticketBrand]: true });
+          tickets.set(ticket, { location: l, root, prior, writer: next, used: false });
+          return Object.freeze({
+            state: "handed-off",
+            ticket,
+            sequence: prior?.snapshot.sequence ?? null,
+            digest: prior?.digest ?? null,
+            custody: custody()
+          });
+        } catch (error) {
+          fail(error instanceof ProcessJournalError ? error.causeCode : "persistence-uncertain");
+          if (!await call.drain()) heldCalls.add(call);
+          await io.drain();
+          return Object.freeze({ state: "uncertain", cause: firstCause, custody: custody() });
+        }
+      })();
+      return handoffPromise;
+    },
+    close() {
+      if (closePromise) return closePromise;
+      accepting = false;
+      closePromise = (async () => {
+        if (handoffPromise) await handoffPromise;
+        else {
+          await tail;
+          try {
+            await io.close(markerOriginal, "marker-close");
+          } catch {
+            fail("custody-pending");
+          }
+          if (!await io.drain()) fail("custody-pending");
+        }
+        return Object.freeze(
+          firstCause ? { state: "uncertain", cause: firstCause, custody: custody() } : { state: "closed", custody: custody() }
+        );
+      })();
+      return closePromise;
+    }
+  });
+  return Object.freeze({ state: "allocated", writer: owner, custody: io.custody() });
+}
+
+// packages/browser/src/runtime/darwin-process-observer.ts
+import { createHash as createHash2 } from "node:crypto";
+import { constants as constants2 } from "node:fs";
+import { open as open2, realpath, lstat as lstat2 } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { z as z2 } from "zod";
+var decimal = z2.string().regex(/^(0|[1-9][0-9]{0,19})$/).refine(
+  (value) => /^(0|[1-9][0-9]{0,19})$/.test(value) && BigInt(value) <= 18446744073709551615n
+);
+var identity2 = z2.object({
+  pid: z2.number().int().positive().max(2147483647),
+  seconds: decimal,
+  microseconds: decimal
+}).strict();
+var replySchema = z2.object({
+  version: z2.literal(1),
+  bootSeconds: decimal,
+  bootMicroseconds: decimal,
+  processes: z2.array(
+    z2.discriminatedUnion("kind", [
+      z2.object({
+        kind: z2.literal("present"),
+        identity: identity2,
+        parentPid: z2.number().int().nonnegative().max(2147483647),
+        zombie: z2.boolean()
+      }).strict(),
+      z2.object({ kind: z2.literal("absent"), pid: z2.number().int().positive().max(2147483647) }).strict(),
+      z2.object({
+        kind: z2.literal("unknown"),
+        pid: z2.number().int().positive().max(2147483647),
+        error: z2.number().int()
+      }).strict()
+    ])
+  ).max(512)
+}).strict();
+var childrenSchema = replySchema.extend({
+  parentBefore: identity2.nullable(),
+  parentAfter: identity2.nullable(),
+  complete: z2.boolean()
+}).strict();
+function parseDarwinChildrenBatch(bytes, parent) {
+  if (bytes.byteLength > 256 * 1024) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  const batch = childrenSchema.parse(
+    JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes))
+  );
+  if (BigInt(batch.bootMicroseconds) >= 1000000n)
+    throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  const pids = /* @__PURE__ */ new Set();
+  for (const fact of batch.processes) {
+    const pid = fact.kind === "present" ? fact.identity.pid : fact.pid;
+    if (pids.has(pid)) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    pids.add(pid);
+    if (fact.kind === "present") darwinBirth(fact.identity);
+  }
+  if (batch.complete && (!batch.parentBefore || !batch.parentAfter || darwinBirth(batch.parentBefore).birth !== parent.birth || batch.parentBefore.pid !== parent.pid || darwinBirth(batch.parentAfter).birth !== parent.birth || batch.parentAfter.pid !== parent.pid || batch.processes.some(
+    (fact) => fact.kind !== "present" || fact.parentPid !== parent.pid || fact.identity.pid === parent.pid
+  )))
+    throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  return batch;
+}
+function darwinBirth(value) {
+  if (BigInt(value.microseconds) >= 1000000n) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  return Object.freeze({
+    pid: value.pid,
+    birth: `darwin-bsd-start:${value.seconds}:${value.microseconds}`
+  });
+}
+function parseDarwinProcessBatch(bytes, requested) {
+  if (bytes.byteLength > 256 * 1024) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  const batch = replySchema.parse(
+    JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes))
+  );
+  if (BigInt(batch.bootMicroseconds) >= 1000000n || batch.processes.length !== requested.length)
+    throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  const remaining = new Set(requested);
+  for (const fact of batch.processes) {
+    const pid = fact.kind === "present" ? fact.identity.pid : fact.pid;
+    if (!remaining.delete(pid)) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    if (fact.kind === "present") darwinBirth(fact.identity);
+  }
+  if (remaining.size) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+  return batch;
+}
+var heldReads = /* @__PURE__ */ new Set();
+var heldChildren = /* @__PURE__ */ new Set();
+var readCustodyUncertain = false;
+function createDarwinProcessObserver(artifact) {
+  const descriptor = Object.freeze({ ...artifact });
+  const invoke = async (command, pids) => {
+    if (readCustodyUncertain || process.platform !== "darwin" || !/^[a-f0-9]{64}$/.test(descriptor.sha256) || pids.length < 1 || pids.length > 512 || new Set(pids).size !== pids.length || pids.some((pid) => !Number.isSafeInteger(pid) || pid < 1 || pid > 2147483647))
+      throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    if (await realpath(descriptor.path) !== descriptor.path)
+      throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    const file = await open2(
+      descriptor.path,
+      constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK
+    );
+    heldReads.add(file);
+    let primary, failed = false;
+    try {
+      const before = await file.stat({ bigint: true });
+      if (!before.isFile() || before.size > 4n * 1024n * 1024n || (before.mode & 0o111n) === 0n)
+        throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+      const hash = createHash2("sha256");
+      const buffer = new Uint8Array(65536);
+      let bytes = 0;
+      for (; ; ) {
+        const read = await file.read(
+          buffer,
+          0,
+          Math.min(buffer.length, 4 * 1024 * 1024 + 1 - bytes),
+          null
+        );
+        if (!read.bytesRead) break;
+        bytes += read.bytesRead;
+        if (bytes > 4 * 1024 * 1024) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+        hash.update(buffer.subarray(0, read.bytesRead));
+      }
+      const after = await file.stat({ bigint: true });
+      const named2 = await lstat2(descriptor.path, { bigint: true });
+      if (!named2.isFile() || named2.dev !== after.dev || named2.ino !== after.ino)
+        throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+      if (hash.digest("hex") !== descriptor.sha256 || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+        throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    } catch (error) {
+      primary = error;
+      failed = true;
+    }
+    try {
+      await file.close();
+      heldReads.delete(file);
+    } catch (error) {
+      readCustodyUncertain = true;
+      if (!failed) primary = error;
+      failed = true;
+    }
+    if (failed) throw primary;
+    if (readCustodyUncertain) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    const child = spawn(descriptor.path, [command, ...pids.map(String)], {
+      shell: false,
+      detached: false,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { PATH: "/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
+    });
+    heldChildren.add(child);
+    let failedChild = false;
+    const terminal = new Promise((done) => {
+      child.on("error", () => {
+        failedChild = true;
+      });
+      child.once("close", (code2) => done(code2));
+    });
+    const pipeReturns = [
+      { eof: false, closed: false },
+      { eof: false, closed: false }
+    ];
+    const drain = async (stream, duty) => {
+      if (!stream) {
+        failedChild = true;
+        return new Uint8Array();
+      }
+      stream.once("end", () => {
+        duty.eof = true;
+      });
+      stream.once("close", () => {
+        duty.closed = true;
+      });
+      const chunks = [];
+      let bytes = 0;
+      for await (const value of stream) {
+        const chunk = Buffer.from(value);
+        bytes += chunk.length;
+        if (bytes <= 256 * 1024) chunks.push(chunk);
+        else failedChild = true;
+      }
+      if (!stream.readableEnded || !duty.eof) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+      return Buffer.concat(chunks);
+    };
+    const streams = await Promise.allSettled([
+      drain(child.stdout, pipeReturns[0]),
+      drain(child.stderr, pipeReturns[1])
+    ]);
+    const code = await terminal;
+    const pipesReturned = streams.every((stream) => stream.status === "fulfilled") && pipeReturns.every((duty) => duty.eof && duty.closed);
+    if (pipesReturned) heldChildren.delete(child);
+    else readCustodyUncertain = true;
+    if (readCustodyUncertain || failedChild || code !== 0 || !pipesReturned)
+      throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    const stdout = streams[0];
+    if (stdout.status !== "fulfilled") throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+    return stdout.value;
+  };
+  return Object.freeze({
+    async inspect(pids) {
+      return parseDarwinProcessBatch(await invoke("inspect", pids), pids);
+    },
+    async children(parent) {
+      return parseDarwinChildrenBatch(await invoke("children", [parent.pid]), parent);
+    }
+  });
+}
+
+// packages/browser/src/runtime/darwin-owned-child.ts
+import { spawn as spawn2 } from "node:child_process";
+var returnBrand = /* @__PURE__ */ Symbol("Darwin original child return");
+var ownership = /* @__PURE__ */ new WeakMap();
+var returns = /* @__PURE__ */ new WeakMap();
+var retained = /* @__PURE__ */ new Set();
+function acceptsDarwinOwnedChildReturn(child, returned) {
+  return !!returned && typeof returned === "object" && ownership.has(child) && returns.get(returned) === ownership.get(child);
+}
+function createDarwinOwnedChildLauncher(options) {
+  const observer = createDarwinProcessObserver(options.artifact);
+  const manager = Object.freeze({ ...options.manager });
+  return Object.freeze({
+    async launch(command) {
+      if (process.platform !== "darwin" || process.pid === manager.pid)
+        throw new Error("SUPERVISOR_PROCESS_REQUIRED");
+      const initial = await observer.inspect([process.pid, manager.pid]);
+      const supervisor = initial.processes.find(
+        (fact) => fact.kind === "present" && fact.identity.pid === process.pid
+      );
+      const observedManager = initial.processes.find(
+        (fact) => fact.kind === "present" && fact.identity.pid === manager.pid
+      );
+      if (!supervisor || supervisor.kind !== "present" || supervisor.zombie || !observedManager || observedManager.kind !== "present" || observedManager.zombie || !sameProcess(darwinBirth(observedManager.identity), manager))
+        throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+      const boot = `${initial.bootSeconds}:${initial.bootMicroseconds}`;
+      const state = { child: null, pending: true, firstCause: null };
+      retained.add(state);
+      const fail = (cause) => {
+        state.firstCause ??= cause;
+      };
+      let child;
+      try {
+        child = spawn2(command.executable, [...command.argv], {
+          cwd: command.cwd,
+          env: { ...command.env },
+          shell: false,
+          detached: false,
+          stdio: command.ipc ? ["ignore", "pipe", "pipe", "ipc"] : ["ignore", "pipe", "pipe"]
+        });
+        state.child = child;
+      } catch (error) {
+        fail("CHILD_ACQUISITION_UNCERTAIN");
+        throw error;
+      }
+      let exitObserved = false, closeObserved = false;
+      let exitCode = null, signal = null;
+      const terminal = new Promise((resolve) => {
+        child.on("error", () => fail("CHILD_ERROR"));
+        child.once("exit", (code, killedBy) => {
+          exitObserved = true;
+          exitCode = code;
+          signal = killedBy;
+          if (killedBy) fail("CHILD_SIGNALED");
+          else if (code !== 0) fail("CHILD_EXIT_FAILED");
+        });
+        child.once("close", (code, killedBy) => {
+          closeObserved = true;
+          if (!exitObserved || code !== exitCode || killedBy !== signal)
+            fail("CHILD_TERMINAL_UNCERTAIN");
+          resolve();
+        });
+      });
+      const drain = (original) => {
+        let eof = false, closed = false, overflow = false;
+        const chunks = [];
+        let retainedBytes = 0;
+        const completion2 = new Promise((resolve) => {
+          if (!original) {
+            fail("CHILD_PIPE_UNAVAILABLE");
+            resolve(new Uint8Array());
+            return;
+          }
+          original.once("end", () => {
+            eof = true;
+          });
+          original.on("error", () => fail("CHILD_PIPE_ERROR"));
+          original.once("close", () => {
+            closed = true;
+            if (!eof) fail("CHILD_PIPE_EOF_UNAVAILABLE");
+            try {
+              resolve(Buffer.concat(chunks));
+            } catch {
+              fail("CHILD_PIPE_RETENTION_UNAVAILABLE");
+              resolve(new Uint8Array());
+            }
+          });
+          original.on("data", (value) => {
+            if (overflow) return;
+            if (value.byteLength > 256 * 1024 - retainedBytes) {
+              overflow = true;
+              fail("CHILD_PIPE_OVERFLOW");
+              return;
+            }
+            try {
+              const copy = Uint8Array.from(value);
+              retainedBytes += copy.byteLength;
+              chunks.push(copy);
+            } catch {
+              overflow = true;
+              fail("CHILD_PIPE_RETENTION_UNAVAILABLE");
+            }
+          });
+        });
+        return { completion: completion2, complete: () => eof && closed };
+      };
+      const stdout = drain(child.stdout), stderr = drain(child.stderr);
+      const identity4 = (async () => {
+        if (!child.pid) throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+        const batch = await observer.inspect([process.pid, child.pid]);
+        const parent = batch.processes.find(
+          (fact2) => fact2.kind === "present" && fact2.identity.pid === process.pid
+        );
+        const fact = batch.processes.find(
+          (fact2) => fact2.kind === "present" && fact2.identity.pid === child.pid
+        );
+        if (`${batch.bootSeconds}:${batch.bootMicroseconds}` !== boot || !parent || parent.kind !== "present" || parent.zombie || !sameProcess(darwinBirth(parent.identity), darwinBirth(supervisor.identity)) || !fact || fact.kind !== "present" || fact.zombie || fact.parentPid !== process.pid)
+          throw new Error("PROCESS_OBSERVATION_UNAVAILABLE");
+        return Object.freeze(darwinBirth(fact.identity));
+      })();
+      void identity4.catch(() => fail("CHILD_BIRTH_UNAVAILABLE"));
+      let token = null;
+      const completion = (async () => {
+        const [out, err] = await Promise.all([stdout.completion, stderr.completion, terminal]);
+        let birth = null;
+        try {
+          birth = await identity4;
+        } catch {
+          fail("CHILD_BIRTH_UNAVAILABLE");
+        }
+        if (!exitObserved || !closeObserved || !stdout.complete() || !stderr.complete())
+          fail("CHILD_RETURN_UNCERTAIN");
+        if (birth) {
+          try {
+            const batch = await observer.inspect([birth.pid]);
+            if (`${batch.bootSeconds}:${batch.bootMicroseconds}` !== boot || batch.processes[0]?.kind !== "absent")
+              fail("CHILD_NATIVE_RETURN_UNAVAILABLE");
+          } catch {
+            fail("CHILD_NATIVE_RETURN_UNAVAILABLE");
+          }
+        }
+        if (state.firstCause === null && birth) {
+          token = Object.freeze({ [returnBrand]: true });
+          returns.set(token, state);
+          state.pending = false;
+          retained.delete(state);
+        }
+        return Object.freeze({
+          exitCode,
+          signal,
+          firstCause: state.firstCause,
+          stdout: out,
+          stderr: err
+        });
+      })();
+      const handle = Object.freeze({
+        child,
+        identity: () => identity4,
+        completion: () => completion,
+        returned: async () => {
+          await completion;
+          return token;
+        },
+        custody: () => Object.freeze({ pending: state.pending, firstCause: state.firstCause })
+      });
+      ownership.set(handle, state);
+      return handle;
+    }
+  });
+}
+
+// packages/browser/src/runtime/darwin-journal-observer.ts
+async function observeDarwinJournal(options) {
+  let current = validateJournalSnapshot(options.initial);
+  if (current.sequence !== 0 || current.root.kind !== "pending" || current.writer.kind !== "observer" || current.binding.bootScope.kind !== "observed" || !options.observer.children || options.exitingObserver && (!options.logicalManager || options.exitingObserver.pid !== process.pid || !sameProcess(options.exitingObserver, current.binding.manager)) || !Number.isFinite(options.endMonotonic) || options.continuousWindowMilliseconds !== void 0 && (!Number.isSafeInteger(options.continuousWindowMilliseconds) || options.continuousWindowMilliseconds < 100 || options.continuousWindowMilliseconds > 6e5) || !Number.isFinite(options.maxGap) || options.maxGap <= 0)
+    return "uncertain";
+  let currentWindowEnd = options.endMonotonic;
+  let faultReported = false;
+  let enumerationClosed = false;
+  const reportFault = async () => {
+    if (options.continuousWindowMilliseconds === void 0 || faultReported) return;
+    faultReported = true;
+    await options.onObservationFault?.();
+  };
+  const opened = await openJournalWriter({
+    ...options.location,
+    writer: current.writer,
+    prior: { kind: "absent" }
+  });
+  if (opened.state !== "allocated") return "uncertain";
+  let result = "uncertain";
+  let refusalCause = "observer-lost";
+  const gap = (next, cause, identity4 = null) => {
+    const prior = next.gaps.find((value) => value.cause === cause);
+    if (prior) prior.count = Math.min(Number.MAX_SAFE_INTEGER, prior.count + 1);
+    else
+      next.gaps.push({
+        cause,
+        identity: identity4,
+        firstSequence: next.sequence,
+        count: 1
+      });
+    next.firstCause ??= { cause, sequence: next.sequence };
+  };
+  const checkBoot = (batch) => current.binding.bootScope.kind === "observed" && current.binding.bootScope.value === `darwin-boot:${batch.bootSeconds}:${batch.bootMicroseconds}`;
+  try {
+    if ((await opened.writer.commitSnapshot(current)).state !== "durable-recorded")
+      throw new Error("JOURNAL_UNCERTAIN");
+    const owner = await options.observer.inspect([current.binding.manager.pid]);
+    const ownerFact = owner.processes[0];
+    if (!checkBoot(owner) || ownerFact?.kind !== "present" || ownerFact.zombie || !sameProcess(darwinBirth(ownerFact.identity), current.binding.manager)) {
+      refusalCause = checkBoot(owner) ? "identity-unknown" : "boot-changed";
+      throw new Error("OWNER_UNAVAILABLE");
+    }
+    await options.onEnrolled?.();
+    const root = await options.root;
+    const supervisor = options.rootSupervisor?.();
+    const selectedRoot = supervisor ?? root;
+    if (!root && options.endBrowser?.() && options.launchNotEntered?.()) {
+      const ended = copyJournalData(current);
+      ended.sequence++;
+      ended.phase = "observation-ended";
+      ended.root = { kind: "absent-before-launch" };
+      ended.observationWindow = {
+        ...current.observationWindow,
+        startSequence: ended.sequence,
+        checkpointSequence: ended.sequence,
+        endSequence: ended.sequence
+      };
+      if ((await opened.writer.commitSnapshot(ended)).state !== "durable-recorded")
+        throw new Error();
+      current = validateJournalSnapshot(ended);
+      result = "campaign-closed";
+    } else if (!root) {
+      refusalCause = "root-pending";
+      throw new Error("ROOT_UNAVAILABLE");
+    }
+    if (root)
+      for (; ; ) {
+        const start = options.monotonicNow();
+        if (!Number.isFinite(start) || start >= currentWindowEnd) {
+          result = "retained";
+          break;
+        }
+        const next = copyJournalData(current);
+        next.sequence++;
+        const window = {
+          startSequence: next.sequence,
+          checkpointSequence: next.sequence,
+          endSequence: next.sequence,
+          startMonotonic: start,
+          endMonotonic: start
+        };
+        next.observationWindow = window;
+        if (start - current.observationWindow.endMonotonic > options.maxGap)
+          gap(next, "observer-lost");
+        const batch = await options.observer.inspect([
+          .../* @__PURE__ */ new Set([
+            ...current.retainedIdentities.map((value) => value.identity.pid),
+            ...options.logicalManager ? [options.logicalManager.pid] : []
+          ])
+        ]);
+        const validBoot = checkBoot(batch);
+        if (!validBoot) gap(next, "boot-changed");
+        const facts = new Map(
+          batch.processes.map((fact) => [
+            fact.kind === "present" ? fact.identity.pid : fact.pid,
+            fact
+          ])
+        );
+        for (const retained2 of next.retainedIdentities) {
+          const fact = facts.get(retained2.identity.pid);
+          retained2.lastSeenSequence = next.sequence;
+          if (!validBoot || !fact || fact.kind === "unknown") {
+            retained2.lifecycle = "unknown";
+            gap(next, "identity-unknown", retained2.identity);
+          } else if (fact.kind === "absent") {
+            retained2.lifecycle = "dead";
+            retained2.currentParent = null;
+          } else if (!sameProcess(darwinBirth(fact.identity), retained2.identity)) {
+            retained2.lifecycle = "replacement";
+            retained2.currentParent = null;
+          } else if (fact.zombie) {
+            const prior = current.retainedIdentities.find(
+              (row) => sameProcess(row.identity, retained2.identity)
+            );
+            const parent = retained2.parent && facts.get(retained2.parent.pid);
+            const parentKnown = parent?.kind === "absent" || parent?.kind === "present" && !parent.zombie && retained2.parent && sameProcess(darwinBirth(parent.identity), retained2.parent);
+            if (retained2.role === "descendant" && retained2.association && retained2.parent && prior && (prior.lifecycle === "alive" || prior.lifecycle === "exited-unreaped") && parentKnown) {
+              retained2.lifecycle = "exited-unreaped";
+              retained2.currentParent = parent?.kind === "present" && fact.parentPid === parent.identity.pid ? retained2.parent : null;
+            } else {
+              gap(next, "custody-pending", retained2.identity);
+            }
+          } else if (retained2.lifecycle === "exited-unreaped") {
+            retained2.lifecycle = "unknown";
+            gap(next, "identity-unknown", retained2.identity);
+          } else {
+            retained2.lifecycle = "alive";
+            const parent = facts.get(fact.parentPid);
+            retained2.currentParent = parent?.kind === "present" ? darwinBirth(parent.identity) : null;
+          }
+        }
+        const manager = next.retainedIdentities.find((value) => value.role === "manager");
+        let ownerGone = manager.lifecycle === "dead" || manager.lifecycle === "replacement";
+        if (options.logicalManager) {
+          const ownerFact2 = facts.get(options.logicalManager.pid);
+          ownerGone = ownerFact2?.kind === "absent" || ownerFact2?.kind === "present" && !sameProcess(darwinBirth(ownerFact2.identity), options.logicalManager);
+          if (!ownerFact2 || ownerFact2.kind === "unknown" || ownerFact2.kind === "present" && ownerFact2.zombie)
+            gap(next, "identity-unknown", options.logicalManager);
+        }
+        if (ownerGone) next.phase = "manager-lost";
+        for (const parent of current.retainedIdentities.filter(
+          (value) => value.lifecycle === "alive"
+        )) {
+          const now = next.retainedIdentities.find(
+            (value) => sameProcess(value.identity, parent.identity)
+          );
+          if (next.gaps.length) break;
+          if (now.lifecycle !== "alive") continue;
+          const returnedRoot = options.originalRootReturned?.();
+          if (returnedRoot && !sameProcess(returnedRoot, root)) {
+            gap(next, "identity-unknown", root);
+            break;
+          }
+          if (returnedRoot && current.root.kind === "attributed" && sameProcess(parent.identity, returnedRoot))
+            continue;
+          if (options.enumerationCloseRequested?.()) continue;
+          let childFacts;
+          if (parent.role === "manager") {
+            if (current.root.kind === "attributed") continue;
+            const before = facts.get(parent.identity.pid);
+            const selected = await options.observer.inspect([selectedRoot.pid]);
+            const afterBatch = await options.observer.inspect([parent.identity.pid]);
+            const fact = selected.processes[0], after = afterBatch.processes[0];
+            if (!checkBoot(selected) || !checkBoot(afterBatch) || before?.kind !== "present" || before.zombie || !sameProcess(darwinBirth(before.identity), parent.identity) || after?.kind !== "present" || after.zombie || !sameProcess(darwinBirth(after.identity), parent.identity) || fact?.kind !== "present" || fact.zombie || fact.parentPid !== parent.identity.pid || !sameProcess(darwinBirth(fact.identity), selectedRoot)) {
+              gap(next, "association-missing", parent.identity);
+              continue;
+            }
+            childFacts = [fact];
+          } else {
+            const children = await options.observer.children(parent.identity);
+            if (!children.complete || !checkBoot(children)) {
+              await options.onIncompleteChildren?.(parent.identity, children);
+              gap(next, "association-missing", parent.identity);
+              continue;
+            }
+            childFacts = children.processes;
+          }
+          for (const fact of childFacts) {
+            if (fact.kind === "present" && fact.zombie) {
+              const prior = current.retainedIdentities.find(
+                (row) => sameProcess(row.identity, darwinBirth(fact.identity))
+              );
+              const retained2 = next.retainedIdentities.find(
+                (row) => sameProcess(row.identity, darwinBirth(fact.identity))
+              );
+              if (prior && retained2?.lifecycle === "exited-unreaped" && retained2.role === "descendant" && retained2.parent && sameProcess(retained2.parent, parent.identity) && fact.parentPid === parent.identity.pid)
+                continue;
+            }
+            if (fact.kind !== "present" || fact.zombie) {
+              gap(next, "association-missing", parent.identity);
+              continue;
+            }
+            const child = darwinBirth(fact.identity);
+            if (parent.role === "manager" && !sameProcess(child, selectedRoot)) continue;
+            if (next.retainedIdentities.some(
+              (value) => processKey(value.identity) === processKey(child)
+            ))
+              continue;
+            if (next.retainedIdentities.length >= 512) {
+              gap(next, "capacity-exceeded");
+              continue;
+            }
+            const relation = {
+              ...window,
+              endMonotonic: options.monotonicNow()
+            };
+            const association = {
+              parentBefore: parent.identity,
+              parentAfter: parent.identity,
+              child,
+              childParentPid: parent.identity.pid,
+              window: relation,
+              recordedSequence: next.sequence,
+              parentDeathSequence: null
+            };
+            const isRoot = sameProcess(child, root);
+            next.retainedIdentities.push({
+              identity: child,
+              role: isRoot ? "root" : "descendant",
+              parent: parent.identity,
+              association,
+              currentParent: parent.identity,
+              acquisitionEpoch: current.writer.epoch,
+              firstSeenSequence: next.sequence,
+              lastSeenSequence: next.sequence,
+              relationWindow: relation,
+              lifecycle: "alive"
+            });
+            if (isRoot) {
+              next.root = { kind: "attributed", identity: child, association };
+              if (next.phase === "allocated") next.phase = "observing";
+            }
+          }
+        }
+        const end = options.monotonicNow();
+        window.endMonotonic = end;
+        if (!Number.isFinite(end) || end < start || end >= currentWindowEnd || end - start > options.maxGap)
+          gap(next, "observer-lost");
+        const admittedGone = next.retainedIdentities.every(
+          (value) => value.lifecycle === "dead" || value.lifecycle === "replacement" || options.exitingObserver && sameProcess(value.identity, options.exitingObserver) || options.endBrowser?.() && value.role === "manager" && value.lifecycle === "alive"
+        ) && (!options.logicalManager || ownerGone || options.endBrowser?.());
+        const gone = next.root.kind === "attributed" && admittedGone;
+        if (gone) next.phase = "observation-ended";
+        const commit = await opened.writer.commitSnapshot(next);
+        if (commit.state !== "durable-recorded") {
+          result = "uncertain";
+          break;
+        }
+        current = validateJournalSnapshot(next);
+        if (!enumerationClosed && options.enumerationCloseRequested?.()) {
+          if (current.gaps.length || current.root.kind !== "attributed" || !current.retainedIdentities.some(
+            (row) => row.role === "root" && row.lifecycle === "alive" && sameProcess(row.identity, root)
+          ))
+            throw new Error("JOURNAL_PRECLOSE_REFUSED");
+          enumerationClosed = true;
+          await options.onEnumerationClosed?.({
+            sequence: current.sequence,
+            monotonic: end,
+            root: current.root.identity
+          });
+        }
+        if (options.continuousWindowMilliseconds !== void 0) {
+          if (current.gaps.length || !Number.isFinite(end) || end < start || end >= currentWindowEnd) {
+            await reportFault();
+            result = "retained";
+            break;
+          }
+          const nextEnd = end + options.continuousWindowMilliseconds;
+          if (!Number.isFinite(nextEnd) || nextEnd <= end) {
+            await reportFault();
+            result = "retained";
+            break;
+          }
+          if (!gone && current.root.kind === "attributed")
+            await options.onCheckpoint?.({
+              sequence: current.sequence,
+              monotonic: end,
+              root: current.root.identity
+            });
+          currentWindowEnd = nextEnd;
+        }
+        if (current.gaps.length && admittedGone) {
+          const managerFact = facts.get(current.binding.manager.pid);
+          result = supervisor && gone && options.endBrowser?.() && managerFact?.kind === "present" && !managerFact.zombie && sameProcess(darwinBirth(managerFact.identity), current.binding.manager) ? "campaign-closed-gapped" : "retained";
+          break;
+        }
+        if (gone) {
+          result = options.exitingObserver ? "original-child-returned-observer-live" : options.endBrowser?.() ? "campaign-closed" : "recorded-gone";
+          break;
+        }
+        await options.pause();
+      }
+  } catch {
+    result = "uncertain";
+  }
+  if (result !== "recorded-gone" && result !== "original-child-returned-observer-live" && result !== "campaign-closed" && result !== "campaign-closed-gapped") {
+    try {
+      await reportFault();
+    } catch {
+      result = "uncertain";
+    }
+    const refusal = copyJournalData(current);
+    refusal.sequence++;
+    refusal.phase = "retained";
+    refusal.observationWindow = {
+      ...current.observationWindow,
+      startSequence: refusal.sequence,
+      checkpointSequence: refusal.sequence,
+      endSequence: refusal.sequence
+    };
+    if (!refusal.gaps.length) gap(refusal, refusalCause);
+    if ((await opened.writer.commitSnapshot(refusal)).state !== "durable-recorded")
+      result = "uncertain";
+  }
+  const closed = await opened.writer.close();
+  return closed.state === "closed" ? result : "uncertain";
+}
+
+// packages/browser/src/runtime/darwin-journal-worker.ts
+var identity3 = z3.object({
+  pid: z3.number().int().positive(),
+  birth: z3.string().min(1).max(128)
+}).strict();
+var seedSchema = z3.object({
+  kind: z3.literal("seed"),
+  ownedLaunch: z3.boolean().default(false),
+  logicalManager: identity3.optional(),
+  initial: JournalSnapshotSchema,
+  location: z3.object({
+    parentDirectory: z3.string().max(4096),
+    parentIdentity: z3.object({
+      device: z3.string(),
+      inode: z3.string(),
+      mode: z3.number(),
+      uid: z3.number(),
+      type: z3.literal("directory")
+    }).strict(),
+    binding: JournalSnapshotSchema.shape.binding
+  }).strict(),
+  artifact: z3.object({
+    path: z3.string().max(4096),
+    sha256: z3.string().regex(/^[a-f0-9]{64}$/)
+  }).strict(),
+  duration: z3.number().positive().max(6e5),
+  continuous: z3.boolean().default(false),
+  maxGap: z3.number().positive().max(1e4)
+}).strict();
+var rootSchema = z3.object({
+  kind: z3.literal("root"),
+  identity: identity3,
+  supervisor: identity3.optional()
+}).strict();
+var launchSchema = z3.object({
+  kind: z3.literal("launch"),
+  executable: z3.string().min(1).max(4096),
+  cwd: z3.string().min(1).max(4096),
+  argv: z3.array(z3.string().max(4096)).max(64)
+}).strict();
+var refuseSchema = z3.object({ kind: z3.literal("refuse-seed") }).strict();
+var returnedSchema = z3.object({
+  kind: z3.literal("root-returned"),
+  nonce: z3.string().min(1).max(128),
+  identity: identity3
+}).strict();
+var prepareCloseSchema = z3.object({
+  kind: z3.literal("prepare-close"),
+  nonce: z3.string().min(1).max(128),
+  identity: identity3
+}).strict();
+var endSchema = z3.object({ kind: z3.literal("end-browser"), launchEntered: z3.boolean() }).strict();
+var messages = z3.discriminatedUnion("kind", [
+  z3.object({ kind: z3.literal("enrolled") }).strict(),
+  z3.object({ kind: z3.literal("observation-fault") }).strict(),
+  z3.object({
+    kind: z3.literal("enumeration-closed"),
+    nonce: z3.string().min(1).max(128),
+    sequence: z3.number().int().positive().safe(),
+    monotonic: z3.number().int().nonnegative().safe(),
+    root: identity3
+  }).strict(),
+  z3.object({
+    kind: z3.literal("checkpoint"),
+    sequence: z3.number().int().positive().safe(),
+    monotonic: z3.number().int().nonnegative().safe(),
+    root: identity3
+  }).strict(),
+  z3.object({
+    kind: z3.literal("complete"),
+    result: z3.enum([
+      "recorded-gone",
+      "original-child-returned-observer-live",
+      "campaign-closed-gapped",
+      "campaign-closed",
+      "retained",
+      "uncertain"
+    ])
+  }).strict()
+]);
+var originals = /* @__PURE__ */ new Set();
+async function startDarwinJournalWorker(options) {
+  const seed = seedSchema.parse({
+    kind: "seed",
+    ownedLaunch: options.ownedLaunch ?? false,
+    location: options.location,
+    initial: options.initial,
+    artifact: options.artifact,
+    duration: options.duration,
+    continuous: options.continuous ?? false,
+    maxGap: options.maxGap
+  });
+  if (Buffer.byteLength(JSON.stringify(seed)) > 1048576) throw new Error("JOURNAL_UNAVAILABLE");
+  const originalClock = process.hrtime.bigint.bind(process.hrtime);
+  const monotonicNow = () => Number(originalClock() / 1000000n);
+  if (seed.continuous && seed.ownedLaunch) throw new Error("CONTINUOUS_ROOT_UNSUPPORTED");
+  const child = spawn3(process.execPath, [options.workerPath, "--private-darwin-journal-worker"], {
+    shell: false,
+    detached: false,
+    stdio: ["ignore", "pipe", "pipe", "ipc"],
+    env: { PATH: "/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
+  });
+  originals.add(child);
+  let failure = false, used = false, returnedSent = false, result = "uncertain";
+  let acknowledge, refuse;
+  const enrolled = new Promise((resolve, reject) => {
+    acknowledge = () => resolve();
+    refuse = reject;
+  });
+  void enrolled.catch(() => {
+  });
+  let sawEnrolled = false, sawComplete = false;
+  let expectedRoot;
+  let checkpoint;
+  let acceptCheckpoint, rejectCheckpoint;
+  const firstCheckpoint = new Promise((resolve, reject) => {
+    acceptCheckpoint = resolve;
+    rejectCheckpoint = reject;
+  });
+  void firstCheckpoint.catch(() => {
+  });
+  let closeRequested = false, closeAcknowledged = false;
+  let resolveClose, rejectClose;
+  const closeReady = new Promise((resolve, reject) => {
+    resolveClose = resolve;
+    rejectClose = reject;
+  });
+  void closeReady.catch(() => {
+  });
+  let closeSend;
+  const fault = (reason) => {
+    failure = true;
+    refuse(reason);
+    rejectCheckpoint(reason);
+    rejectClose(reason);
+  };
+  const observationKnown = () => {
+    if (failure || !sawEnrolled || sawComplete) return false;
+    if (!seed.continuous) return true;
+    if (!checkpoint) return false;
+    const now = monotonicNow();
+    if (!Number.isSafeInteger(now) || now < checkpoint.monotonic || now - checkpoint.monotonic > seed.maxGap) {
+      fault(new Error("JOURNAL_OBSERVATION_STALE"));
+      return false;
+    }
+    return true;
+  };
+  child.on("message", (value) => {
+    const parsed = messages.safeParse(value);
+    if (!parsed.success) {
+      fault(new Error("JOURNAL_UNAVAILABLE"));
+      return;
+    }
+    if (parsed.data.kind === "observation-fault") {
+      fault(new Error("JOURNAL_OBSERVATION_REFUSED"));
+    } else if (parsed.data.kind === "enumeration-closed") {
+      const next = parsed.data;
+      const now = monotonicNow();
+      if (!closeRequested || closeAcknowledged || failure || sawComplete || !sawEnrolled || !expectedRoot || next.nonce !== seed.initial.binding.reservationNonce || !sameProcess(next.root, expectedRoot) || !Number.isSafeInteger(now) || next.monotonic > now || now - next.monotonic > seed.maxGap || checkpoint && (next.sequence <= checkpoint.sequence || next.monotonic < checkpoint.monotonic)) {
+        fault(new Error("JOURNAL_PRECLOSE_REFUSED"));
+        return;
+      }
+      closeAcknowledged = true;
+      resolveClose();
+    } else if (parsed.data.kind === "checkpoint") {
+      const next = parsed.data;
+      const now = monotonicNow();
+      if (!seed.continuous || !sawEnrolled || sawComplete || failure || !expectedRoot || expectedRoot.pid !== next.root.pid || expectedRoot.birth !== next.root.birth || checkpoint && (!observationKnown() || next.sequence <= checkpoint.sequence || next.monotonic < checkpoint.monotonic) || !Number.isSafeInteger(now) || next.monotonic > now || now - next.monotonic > seed.maxGap) {
+        fault(new Error("JOURNAL_CHECKPOINT_REFUSED"));
+        return;
+      }
+      checkpoint = { sequence: next.sequence, monotonic: next.monotonic };
+      acceptCheckpoint();
+    } else if (parsed.data.kind === "enrolled") {
+      if (sawEnrolled || sawComplete) {
+        fault(new Error("JOURNAL_UNAVAILABLE"));
+        return;
+      }
+      sawEnrolled = true;
+      acknowledge();
+    } else {
+      if (!sawEnrolled || sawComplete) {
+        fault(new Error("JOURNAL_UNAVAILABLE"));
+        return;
+      }
+      sawComplete = true;
+      if (seed.continuous && !checkpoint) fault(new Error("JOURNAL_CHECKPOINT_REFUSED"));
+      rejectCheckpoint(new Error("JOURNAL_OBSERVATION_ENDED"));
+      if (!closeAcknowledged) rejectClose(new Error("JOURNAL_PRECLOSE_REFUSED"));
+      result = parsed.data.result;
+    }
+  });
+  child.on("error", () => {
+    fault(new Error("JOURNAL_UNAVAILABLE"));
+  });
+  const terminal = new Promise(
+    (resolve) => child.once("close", (code) => {
+      if (!sawComplete) fault(new Error("JOURNAL_UNAVAILABLE"));
+      rejectCheckpoint(new Error("JOURNAL_OBSERVATION_ENDED"));
+      if (!closeAcknowledged) rejectClose(new Error("JOURNAL_PRECLOSE_REFUSED"));
+      resolve(code);
+    })
+  );
+  const stderrChunks = [];
+  const pipeReturns = [
+    { eof: false, closed: false },
+    { eof: false, closed: false }
+  ];
+  const drain = async (stream, duty) => {
+    if (!stream) {
+      fault(new Error("JOURNAL_PIPE_UNAVAILABLE"));
+      return;
+    }
+    stream.once("error", (reason) => fault(reason));
+    stream.once("end", () => {
+      duty.eof = true;
+    });
+    stream.once("close", () => {
+      duty.closed = true;
+      if (!duty.eof) fault(new Error("JOURNAL_PIPE_UNAVAILABLE"));
+    });
+    try {
+      let bytes = 0;
+      for await (const chunk of stream) {
+        bytes += Buffer.byteLength(chunk);
+        if (bytes > 262144) fault(new Error("JOURNAL_PIPE_UNAVAILABLE"));
+        else if (stream === child.stderr) stderrChunks.push(Buffer.from(chunk));
+      }
+      if (!stream.readableEnded || !duty.eof) throw new Error("JOURNAL_PIPE_UNAVAILABLE");
+    } catch (reason) {
+      fault(reason);
+      throw reason;
+    }
+  };
+  const streams = Promise.allSettled([
+    drain(child.stdout, pipeReturns[0]),
+    drain(child.stderr, pipeReturns[1])
+  ]);
+  const completion = (async () => {
+    const [code, closed] = await Promise.all([terminal, streams]);
+    const pipesReturned = closed.every((value) => value.status === "fulfilled") && pipeReturns.every((duty) => duty.eof && duty.closed);
+    if (pipesReturned) originals.delete(child);
+    return failure || code !== 0 || !pipesReturned || !sawComplete ? "uncertain" : result;
+  })();
+  const send = (value) => new Promise(
+    (resolve, reject) => child.send(value, (error) => {
+      if (error) {
+        fault(error);
+        reject(error);
+      } else resolve();
+    })
+  );
+  try {
+    if (options.ownedLaunch) {
+      const batch = await createDarwinProcessObserver(options.artifact).inspect([child.pid]);
+      const self = batch.processes[0];
+      if (self.kind !== "present" || self.zombie || self.parentPid !== process.pid || seed.initial.binding.bootScope.kind !== "observed" || seed.initial.binding.bootScope.value !== `darwin-boot:${batch.bootSeconds}:${batch.bootMicroseconds}`)
+        throw new Error("SUPERVISOR_UNAVAILABLE");
+      seed.logicalManager = { ...seed.initial.binding.manager };
+      const actualSelf = darwinBirth(self.identity);
+      seed.initial.binding.manager = actualSelf;
+      seed.location.binding.manager = actualSelf;
+      seed.initial.retainedIdentities[0].identity = actualSelf;
+    }
+    await send(seed);
+    await enrolled;
+  } catch (error) {
+    try {
+      if (child.connected) await send({ kind: "refuse-seed" });
+    } catch {
+      failure = true;
+    }
+    try {
+      await completion;
+    } catch {
+      failure = true;
+    }
+    throw error;
+  }
+  return Object.freeze({
+    child,
+    isObservationKnown: observationKnown,
+    location: seed.location,
+    stderr: () => Buffer.concat(stderrChunks),
+    completion,
+    prepareClose() {
+      if (closeSend) return closeSend;
+      closeRequested = true;
+      closeSend = Promise.resolve().then(async () => {
+        if (failure || sawComplete || returnedSent || !expectedRoot)
+          throw new Error("JOURNAL_PRECLOSE_REFUSED");
+        await send(
+          prepareCloseSchema.parse({
+            kind: "prepare-close",
+            nonce: seed.initial.binding.reservationNonce,
+            identity: expectedRoot
+          })
+        );
+        await closeReady;
+      });
+      void closeSend.catch(fault);
+      return closeSend;
+    },
+    async rootReturned(root) {
+      const original = identity3.parse(root);
+      if (failure || returnedSent || !expectedRoot || !sameProcess(original, expectedRoot))
+        throw new Error("JOURNAL_ROOT_RETURN_REFUSED");
+      returnedSent = true;
+      await send(
+        returnedSchema.parse({
+          kind: "root-returned",
+          nonce: seed.initial.binding.reservationNonce,
+          identity: original
+        })
+      );
+    },
+    async endBrowser(launchEntered) {
+      await send({ kind: "end-browser", launchEntered });
+    },
+    async launchRoot(command) {
+      if (!options.ownedLaunch || used) throw new Error("ROOT_ALREADY_ENROLLED");
+      used = true;
+      await send(launchSchema.parse({ kind: "launch", ...command }));
+    },
+    async enrollRoot(root, supervisor) {
+      if (used || options.ownedLaunch) throw new Error("ROOT_ALREADY_ENROLLED");
+      used = true;
+      expectedRoot = identity3.parse(root);
+      await send(
+        rootSchema.parse({
+          kind: "root",
+          identity: expectedRoot,
+          ...supervisor ? { supervisor } : {}
+        })
+      );
+      if (seed.continuous) await firstCheckpoint;
+    }
+  });
+}
+function darwinMonotonicNow() {
+  return Number(process.hrtime.bigint() / 1000000n);
+}
+async function runPrivateWorker() {
+  let supervisor;
+  let rootResolve;
+  const root = new Promise((resolve) => {
+    rootResolve = resolve;
+  });
+  let seedResolve;
+  const seed = new Promise((resolve) => {
+    seedResolve = resolve;
+  });
+  let launchResolve;
+  const launch = new Promise((resolve) => {
+    launchResolve = resolve;
+  });
+  let ended = false, launchNotEntered = false;
+  let seedNonce;
+  let enrolledRoot, returnedRoot;
+  let enumerationCloseRequested = false;
+  let seeded = false, rooted = false, invalid = false;
+  const receive = (value) => {
+    if (refuseSchema.safeParse(value).success) {
+      invalid = true;
+      seeded = true;
+      seedResolve(null);
+      rootResolve(null);
+      launchResolve(null);
+      return;
+    }
+    if (!seeded) {
+      seeded = true;
+      seedResolve(value);
+      return;
+    }
+    const prepare = prepareCloseSchema.safeParse(value);
+    if (prepare.success) {
+      if (invalid || ended || enumerationCloseRequested || returnedRoot || !rooted || !enrolledRoot || !seedNonce || prepare.data.nonce !== seedNonce || !sameProcess(prepare.data.identity, enrolledRoot)) {
+        invalid = true;
+        return;
+      }
+      enumerationCloseRequested = true;
+      return;
+    }
+    const returned = returnedSchema.safeParse(value);
+    if (returned.success) {
+      if (!rooted || !enrolledRoot || returnedRoot || !seedNonce || returned.data.nonce !== seedNonce || !sameProcess(returned.data.identity, enrolledRoot)) {
+        invalid = true;
+        return;
+      }
+      returnedRoot = Object.freeze({ ...returned.data.identity });
+      return;
+    }
+    const end = endSchema.safeParse(value);
+    if (end.success) {
+      if (ended) {
+        invalid = true;
+        return;
+      }
+      ended = true;
+      launchNotEntered = !end.data.launchEntered;
+      if (launchNotEntered) {
+        if (rooted) {
+          invalid = true;
+          return;
+        }
+        rootResolve(null);
+        launchResolve(null);
+      }
+      return;
+    }
+    if (ended) {
+      invalid = true;
+      return;
+    }
+    const request = launchSchema.safeParse(value);
+    if (!rooted && request.success) {
+      rooted = true;
+      launchResolve(request.data);
+      return;
+    }
+    const parsed = rootSchema.safeParse(value);
+    if (rooted || !parsed.success) {
+      invalid = true;
+      rootResolve(null);
+      return;
+    }
+    rooted = true;
+    supervisor = parsed.data.supervisor;
+    enrolledRoot = Object.freeze({ ...parsed.data.identity });
+    rootResolve(parsed.data.identity);
+  };
+  process.on("message", receive);
+  const disconnected = () => {
+    process.removeListener("message", receive);
+    if (!seeded) seedResolve(null);
+    if (!rooted) {
+      rootResolve(null);
+      launchResolve(null);
+    }
+  };
+  process.once("disconnect", disconnected);
+  if (!process.connected) disconnected();
+  const send = (value) => new Promise((resolve, reject) => {
+    if (!process.send) {
+      reject(new Error("CHANNEL_UNAVAILABLE"));
+      return;
+    }
+    process.send(value, (error) => error ? reject(error) : resolve());
+  });
+  let result;
+  try {
+    const value = seedSchema.parse(await seed);
+    seedNonce = value.initial.binding.reservationNonce;
+    if (value.initial.binding.bootScope.kind !== "observed" || value.initial.binding.bootScope.sourceIdentityDigest !== value.artifact.sha256)
+      throw new Error("BOOT_SOURCE_UNAVAILABLE");
+    const logicalManager = value.logicalManager ?? {
+      ...value.initial.binding.manager
+    };
+    const observer = createDarwinProcessObserver(value.artifact);
+    let ownedRoot = null;
+    if (value.ownedLaunch) {
+      const self = (await observer.inspect([process.pid])).processes[0];
+      if (self.kind !== "present" || self.zombie) throw new Error("SUPERVISOR_UNAVAILABLE");
+      const actualSelf = darwinBirth(self.identity);
+      if (actualSelf.pid !== value.initial.binding.manager.pid || actualSelf.birth !== value.initial.binding.manager.birth || !value.logicalManager)
+        throw new Error("SUPERVISOR_BINDING_MISMATCH");
+      void (async () => {
+        try {
+          const command = launchSchema.parse(await launch);
+          ownedRoot = await createDarwinOwnedChildLauncher({
+            artifact: value.artifact,
+            manager: logicalManager
+          }).launch({
+            executable: command.executable,
+            argv: command.argv,
+            cwd: command.cwd,
+            env: { PATH: "/usr/bin:/bin", LANG: "C", LC_ALL: "C" }
+          });
+          rootResolve(await ownedRoot.identity());
+        } catch {
+          invalid = true;
+          rootResolve(null);
+        }
+      })();
+    }
+    const rootEnd = setTimeout(() => {
+      rootResolve(null);
+      launchResolve(null);
+    }, value.duration);
+    let reportedIncomplete = false;
+    try {
+      result = await observeDarwinJournal({
+        location: value.location,
+        initial: value.initial,
+        root,
+        rootSupervisor: () => supervisor,
+        observer,
+        endBrowser: () => ended,
+        originalRootReturned: () => {
+          if (invalid) throw new Error("JOURNAL_ROOT_RETURN_REFUSED");
+          return returnedRoot;
+        },
+        enumerationCloseRequested: () => {
+          if (invalid) throw new Error("JOURNAL_PRECLOSE_REFUSED");
+          return enumerationCloseRequested;
+        },
+        onEnumerationClosed: (checkpoint) => send({ kind: "enumeration-closed", nonce: seedNonce, ...checkpoint }),
+        launchNotEntered: () => launchNotEntered,
+        ...value.ownedLaunch ? { logicalManager, exitingObserver: value.initial.binding.manager } : {},
+        monotonicNow: darwinMonotonicNow,
+        pause: () => new Promise((resolve) => setTimeout(resolve, 50)),
+        endMonotonic: darwinMonotonicNow() + value.duration,
+        ...value.continuous ? {
+          continuousWindowMilliseconds: value.duration,
+          onObservationFault: () => send({ kind: "observation-fault" }),
+          onCheckpoint: (checkpoint) => send({ kind: "checkpoint", ...checkpoint })
+        } : {},
+        maxGap: value.maxGap,
+        onEnrolled: () => send({ kind: "enrolled" }),
+        onIncompleteChildren: async (parent, batch) => {
+          if (reportedIncomplete) return;
+          reportedIncomplete = true;
+          const bytes = JSON.stringify({
+            kind: "incomplete-native-children",
+            parent,
+            batch
+          }) + "\n";
+          await new Promise(
+            (resolve, reject) => process.stderr.write(bytes, (error) => error ? reject(error) : resolve())
+          );
+        }
+      });
+    } finally {
+      clearTimeout(rootEnd);
+    }
+    if (value.ownedLaunch) {
+      const original = ownedRoot;
+      if (!original || result !== "original-child-returned-observer-live") result = "uncertain";
+      else if (!acceptsDarwinOwnedChildReturn(original, await original.returned()))
+        result = "uncertain";
+    }
+    if (invalid) result = "uncertain";
+  } catch {
+    result = "uncertain";
+  }
+  if (process.connected) {
+    try {
+      await send({ kind: "complete", result });
+    } catch {
+      result = "uncertain";
+    }
+    process.disconnect();
+  }
+  process.exitCode = result === "uncertain" ? 1 : 0;
+}
+if (process.argv[2] === "--private-darwin-journal-worker") void runPrivateWorker();
+export {
+  darwinMonotonicNow,
+  startDarwinJournalWorker
+};