rea-agents 6.5.0 → 6.7.0

package/dist/cli-runtime/{ProcessOwnership-DXC5-UWt.js → ProcessOwnershipObservation-C006iCtZ.js}

@@ -1,17 +1,17 @@
 import { __esmMin } from "./rolldown-runtime-DXoylpqc.js";
-import { compareUnicodeCodePoints, init_unicodeCodePointOrder } from "./reconstructionObligationLedgerSchemas-Bao0xMr-.js";
-import { AnalysisCapabilityUnavailableError, init_analysisErrorCore } from "./errorSchemas-CTRmvMl3.js";
-import { execFileOutput, execFileOutputFailure, init_ExecFileOutput } from "./ExecFileOutput-BEQs-lDD.js";
+import { err, init_result, ok } from "./reconstructionObligationLedgerSchemas-Bi6sect1.js";
+import { AnalysisCapabilityUnavailableError, init_analysisErrorCore } from "./errorSchemas-Ixz_q7qt.js";
+import { analysisErrorWithCleanupFailure, init_analysisErrorCleanup } from "./analysisErrorCleanup-COdAmDsb.js";
+import { ProviderCleanupError, init_providerCleanupError } from "./providerCleanupError-BhsJyAhk.js";
+import { execFileOutput, execFileOutputFailure, init_ExecFileOutput } from "./ExecFileOutput-D6KLYTve.js";
 import { DEFAULT_SWIFTC_COMPILE_TIMEOUT_MS, init_providerStartupTimeout, providerStartupTimeoutSchema } from "./providerStartupTimeout-B2tF2LtZ.js";
 import { init_safeJson, safeParseJson } from "./safeJson-DKKACtdy.js";
 import { z } from "zod";
 import { basename, isAbsolute, join } from "node:path";
-import { promisify } from "node:util";
-import { mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
 import { rmSync } from "node:fs";
-import { execFile } from "node:child_process";
-import { fileURLToPath } from "node:url";
 import { tmpdir } from "node:os";
+import { mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 
 //#region dist/process/ProcessCommandIdentity.js
 var matchesOwnedProcessCommand;
@@ -106,10 +106,13 @@ function init_boundedUtf8Text() {
 
 //#endregion
 //#region dist/process/DarwinProcessRunTokenReader.js
-var responseSchema, identityResponseSchema, sourceFiles, SWIFTC_INTERRUPT, resolveSwiftcCompileTimeoutMs, STDERR_EXCERPT_LIMIT, DarwinProcessOwnershipInspectionError, MAX_COMPILER_STDERR_BYTES, compilerOutcome, compilerOutcomeDescription, compilerInspectionError, abortReason, isExpectedAbort$1, waitForCompilation, createDarwinProcessRunTokenReader;
+var responseSchema, identityResponseSchema, sourceFiles, SWIFTC_INTERRUPT, resolveSwiftcCompileTimeoutMs, STDERR_EXCERPT_LIMIT, DarwinProcessOwnershipInspectionError, MAX_COMPILER_OUTPUT_BYTES, compilerFailureFacts, compilerOutcomeDescription, compilerInspectionError, abortReason, isExpectedAbort$1, waitForCompilation, createDarwinProcessRunTokenReader;
 function init_DarwinProcessRunTokenReader() {
 	return (init_DarwinProcessRunTokenReader = __esmMin((() => {
 		init_providerStartupTimeout();
+		init_result();
+		init_providerCleanupError();
+		init_analysisErrorCleanup();
 		init_safeJson();
 		init_boundedUtf8Text();
 		init_ExecFileOutput();
@@ -145,31 +148,66 @@ function init_DarwinProcessRunTokenReader() {
 			return parsed.success ? parsed.data : DEFAULT_SWIFTC_COMPILE_TIMEOUT_MS;
 		};
 		STDERR_EXCERPT_LIMIT = 512;
-		DarwinProcessOwnershipInspectionError = class extends Error {
+		DarwinProcessOwnershipInspectionError = class DarwinProcessOwnershipInspectionError extends Error {
+			#cleanupOwner;
+			get cleanupOwner() {
+				return this.#cleanupOwner;
+			}
 			constructor(message, options) {
-				const { compilerOutcome, ...errorOptions } = options ?? {};
+				const { compilerOutcome, capturedOutput, cleanupFailure, cleanupOwner, cancellation, ...errorOptions } = options ?? {};
 				super(message, errorOptions);
 				this.name = "DarwinProcessOwnershipInspectionError";
 				this.compilerOutcome = compilerOutcome;
+				this.capturedOutput = capturedOutput;
+				this.#cleanupOwner = cleanupOwner;
+				this.cleanupFailure = cleanupFailure;
+				this.cancellation = cancellation;
 			}
 			compilerOutcome;
+			capturedOutput;
+			cleanupFailure;
+			cancellation;
+			/** Preserve the physical preparation failure while following the exact cleanup owner. */
+			withCleanupFailure(cleanup, owner) {
+				const combined = this.cleanupFailure === undefined || this.cleanupFailure === cleanup ? cleanup : analysisErrorWithCleanupFailure(this.cleanupFailure, cleanup).bindCleanupDependencies([this.cleanupFailure, cleanup]);
+				return new DarwinProcessOwnershipInspectionError(this.message, {
+					...Object.hasOwn(this, "cause") ? { cause: this.cause } : {},
+					...this.compilerOutcome === undefined ? {} : { compilerOutcome: this.compilerOutcome },
+					...this.capturedOutput === undefined ? {} : { capturedOutput: this.capturedOutput },
+					cleanupFailure: combined,
+					cleanupOwner: owner ?? this.cleanupOwner,
+					...this.cancellation === undefined ? {} : { cancellation: this.cancellation }
+				});
+			}
 		};
-		MAX_COMPILER_STDERR_BYTES = 8 * 1024;
-		compilerOutcome = (cause, timeoutMs) => {
+		MAX_COMPILER_OUTPUT_BYTES = 8 * 1024;
+		compilerFailureFacts = (cause, timeoutMs) => {
 			const failure = execFileOutputFailure(cause);
 			if (failure === undefined) return undefined;
-			const stderr = boundedUtf8Text(failure.stderr, MAX_COMPILER_STDERR_BYTES);
+			const stderr = boundedUtf8Text(failure.stderr, MAX_COMPILER_OUTPUT_BYTES);
+			const stdout = boundedUtf8Text(failure.stdout, MAX_COMPILER_OUTPUT_BYTES);
 			const outcome = failure.code === "ETIMEDOUT" ? "timed_out" : typeof failure.code === "number" ? "exited" : failure.signal !== null ? "signaled" : failure.code === "ENOENT" ? "spawn_failed" : "failed";
 			return {
-				outcome,
-				code: failure.code,
-				signal: failure.signal,
-				stderr: stderr.text,
-				stderrBytes: Buffer.byteLength(failure.stderr, "utf8"),
-				stderrTruncated: stderr.truncated,
-				outputTruncated: failure.outputTruncated,
-				killed: failure.killed,
-				...outcome === "timed_out" ? { timeoutMs } : {}
+				outcome: {
+					outcome,
+					code: failure.code,
+					signal: failure.signal,
+					stderr: stderr.text,
+					...failure.stderrBytes === undefined ? {} : { stderrBytes: failure.stderrBytes },
+					stderrTruncated: stderr.truncated,
+					outputTruncated: failure.outputTruncated,
+					killed: failure.killed,
+					...outcome === "timed_out" ? { timeoutMs } : {}
+				},
+				capturedOutput: {
+					stdout: stdout.text,
+					stderr: stderr.text,
+					truncated: stdout.truncated || stderr.truncated || failure.outputTruncated,
+					...failure.stdoutBytes === undefined ? {} : { stdout_bytes: failure.stdoutBytes },
+					...failure.stderrBytes === undefined ? {} : { stderr_bytes: failure.stderrBytes },
+					exit_code: typeof failure.code === "number" ? failure.code : null,
+					signal: failure.signal
+				}
 			};
 		};
 		compilerOutcomeDescription = (outcome, fallbackCode) => {
@@ -180,7 +218,8 @@ function init_DarwinProcessRunTokenReader() {
 			return `compiler result: ${String(outcome.code)}`;
 		};
 		compilerInspectionError = (cause, timeoutMs, compiler) => {
-			const outcome = compilerOutcome(cause, timeoutMs);
+			const facts = compilerFailureFacts(cause, timeoutMs);
+			const outcome = facts?.outcome;
 			const code = outcome?.code ?? "unknown";
 			const description = compilerOutcomeDescription(outcome, code);
 			const launcher = compiler.kind === "xcrun" ? "xcrun" : "the selected Swift compiler (REA_DARWIN_SWIFTC_PATH)";
@@ -191,7 +230,10 @@ function init_DarwinProcessRunTokenReader() {
 			const suffix = diagnostics ? `: ${diagnostics}${truncated ? "… [diagnostics truncated]" : ""}` : outcome === undefined ? `: ${cause instanceof Error ? cause.message : String(cause)}` : ": no compiler diagnostics were captured";
 			return new DarwinProcessOwnershipInspectionError(`${prefix} (${description})${suffix}`, {
 				cause,
-				...outcome === undefined ? {} : { compilerOutcome: outcome }
+				...facts === undefined ? {} : {
+					compilerOutcome: facts.outcome,
+					capturedOutput: facts.capturedOutput
+				}
 			});
 		};
 		abortReason = (signal) => {
@@ -201,20 +243,31 @@ function init_DarwinProcessRunTokenReader() {
 			return error;
 		};
 		isExpectedAbort$1 = (cause, signal) => signal.aborted && (cause === signal.reason || cause instanceof Error && cause.name === "AbortError");
-		waitForCompilation = async (promise, signal) => {
-			if (signal === undefined) return promise;
-			if (signal.aborted) throw abortReason(signal);
-			return new Promise((resolve, reject) => {
+		waitForCompilation = async (operation, signal) => {
+			if (signal === undefined) return {
+				kind: "completed",
+				result: await operation.promise
+			};
+			return new Promise((resolve) => {
 				let completed = false;
-				const finish = (callback) => {
+				const finish = (outcome) => {
 					if (completed) return;
 					completed = true;
 					signal.removeEventListener("abort", onAbort);
-					callback();
+					resolve(outcome);
+				};
+				const onAbort = () => {
+					if (operation.primaryFailure !== undefined) return;
+					finish({
+						kind: "cancelled",
+						reason: signal.reason
+					});
 				};
-				const onAbort = () => finish(() => reject(abortReason(signal)));
 				signal.addEventListener("abort", onAbort, { once: true });
-				promise.then((value) => finish(() => resolve(value)), (cause) => finish(() => reject(cause)));
+				void operation.promise.then((result) => finish({
+					kind: "completed",
+					result
+				}));
 				if (signal.aborted) onAbort();
 			});
 		};
@@ -232,36 +285,55 @@ function init_DarwinProcessRunTokenReader() {
 			let closed = false;
 			let exitCleanupInstalled = false;
 			const cleanupAtExit = () => {
-				if (root !== undefined) rmSync(root, {
+				if (root !== undefined) rmSync(root.path, {
 					recursive: true,
 					force: true
 				});
 			};
-			const cleanupRoot = async (target = root) => {
-				if (target === undefined) return;
-				await rm(target, {
-					recursive: true,
-					force: true
+			const cleanupRoot = (target = root) => {
+				if (target === undefined) return Promise.resolve();
+				target.cleanupPromise ??= Promise.resolve().then(async () => {
+					try {
+						await rm(target.path, {
+							recursive: true,
+							force: true
+						});
+					} catch (cause) {
+						const failure = new ProviderCleanupError("process-ownership", [target.path], { reason: "The Darwin ownership helper root remains owned until removal succeeds." }, {
+							cause,
+							operation: "prepare_owned_process"
+						});
+						if (target.cleanupAnchor === undefined) target.cleanupAnchor = failure;
+						else failure.bindCleanupDependencies([target.cleanupAnchor]);
+						throw failure;
+					}
+					target.cleanupAnchor?.resolveCleanup();
+					target.cleanupAnchor = undefined;
+					if (root !== target) return;
+					root = undefined;
+					executable = undefined;
+					if (exitCleanupInstalled) process.removeListener("exit", cleanupAtExit);
+					exitCleanupInstalled = false;
+				}).catch((cause) => {
+					target.cleanupPromise = undefined;
+					throw cause;
 				});
-				if (root !== target) return;
-				root = undefined;
-				executable = undefined;
-				if (exitCleanupInstalled) process.removeListener("exit", cleanupAtExit);
-				exitCleanupInstalled = false;
+				return target.cleanupPromise;
 			};
-			const runCompilation = async (signal) => {
+			const runCompilation = async (operation) => {
+				const signal = operation.controller.signal;
 				let operationRoot;
 				try {
 					if (compiler.kind === "swiftc" && (!isAbsolute(compiler.executable) || !isAbsolute(compiler.sdkRoot))) {
 						throw new DarwinProcessOwnershipInspectionError("Direct Darwin helper compilation requires absolute REA_DARWIN_SWIFTC_PATH and SDKROOT paths selecting a compatible installed Swift compiler and macOS SDK.");
 					}
-					operationRoot = await mkdtemp(join(tmpdir(), "rea-process-token-"));
+					operationRoot = { path: await mkdtemp(join(tmpdir(), "rea-process-token-")) };
 					root = operationRoot;
 					process.once("exit", cleanupAtExit);
 					exitCleanupInstalled = true;
 					if (signal.aborted || closed) throw abortReason(signal);
-					const output = join(operationRoot, "reader");
-					const compilerTemporary = join(operationRoot, "tmp");
+					const output = join(operationRoot.path, "reader");
+					const compilerTemporary = join(operationRoot.path, "tmp");
 					await mkdir(compilerTemporary);
 					const compilerEnvironment = {
 						...process.env,
@@ -293,13 +365,15 @@ function init_DarwinProcessRunTokenReader() {
 					executable = output;
 					return output;
 				} catch (cause) {
-					const ownsRoot = operationRoot !== undefined && root === operationRoot;
+					operation.primaryFailure = { cause };
 					if (operationRoot !== undefined) {
-						if (ownsRoot) await cleanupRoot(operationRoot);
-						else await rm(operationRoot, {
-							recursive: true,
-							force: true
-						});
+						try {
+							await cleanupRoot(operationRoot);
+						} catch (cleanup) {
+							if (!(cleanup instanceof ProviderCleanupError)) throw cleanup;
+							const primary = cause instanceof DarwinProcessOwnershipInspectionError ? cause : new DarwinProcessOwnershipInspectionError("Darwin process ownership helper preparation failed", { cause });
+							throw primary.withCleanupFailure(cleanup, { close: () => cleanupRoot(operationRoot) });
+						}
 					}
 					throw cause;
 				}
@@ -308,7 +382,7 @@ function init_DarwinProcessRunTokenReader() {
 				const controller = new AbortController();
 				const operation = {
 					controller,
-					promise: runCompilation(controller.signal).finally(() => {
+					promise: Promise.resolve().then(() => runCompilation(operation)).then(ok, err).finally(() => {
 						operation.settled = true;
 						if (compilation === operation) compilation = undefined;
 					}),
@@ -332,25 +406,31 @@ function init_DarwinProcessRunTokenReader() {
 					}
 					let operation = compilation;
 					if (operation?.aborting === true) {
-						try {
-							await waitForCompilation(operation.promise, signal);
-						} catch (cause) {
-							if (signal !== undefined && isExpectedAbort$1(cause, signal)) throw cause;
-						}
+						const waited = await waitForCompilation(operation, signal);
+						if (waited.kind === "cancelled") throw waited.reason;
+						if (!waited.result.ok && waited.result.error instanceof DarwinProcessOwnershipInspectionError && waited.result.error.cleanupFailure !== undefined) throw waited.result.error;
 						continue;
 					}
 					operation ??= beginCompilation();
 					operation.waiters += 1;
-					try {
-						return await waitForCompilation(operation.promise, signal);
-					} finally {
-						operation.waiters -= 1;
-						if (operation.waiters === 0 && !operation.settled && !operation.aborting) {
-							operation.aborting = true;
-							operation.controller.abort();
-							await operation.promise.catch(() => undefined);
+					const waited = await waitForCompilation(operation, signal);
+					operation.waiters -= 1;
+					if (operation.waiters === 0 && !operation.settled && !operation.aborting) {
+						operation.aborting = true;
+						operation.controller.abort();
+						const finalized = await operation.promise;
+						if (waited.kind === "cancelled" && !finalized.ok && finalized.error instanceof DarwinProcessOwnershipInspectionError && finalized.error.cleanupFailure !== undefined) {
+							throw new DarwinProcessOwnershipInspectionError("Darwin process ownership helper preparation was cancelled", {
+								cause: waited.reason,
+								cancellation: { reason: waited.reason },
+								cleanupFailure: finalized.error.cleanupFailure,
+								cleanupOwner: finalized.error.cleanupOwner
+							});
 						}
 					}
+					if (waited.kind === "cancelled") throw waited.reason;
+					if (!waited.result.ok) throw waited.result.error;
+					return waited.result.value;
 				}
 			};
 			const read = async (processes, signal) => {
@@ -417,7 +497,7 @@ function init_DarwinProcessRunTokenReader() {
 					if (operation !== undefined && !operation.settled) {
 						operation.aborting = true;
 						operation.controller.abort();
-						await operation.promise.catch(() => undefined);
+						await operation.promise;
 					}
 					await cleanupRoot();
 				})().catch((cause) => {
@@ -837,542 +917,4 @@ function init_ProcessOwnershipObservation() {
 }
 
 //#endregion
-//#region dist/process/ProcessOwnership.js
-var execFileAsync, cleanupWindowsProcessTree, systemWindowsProcessTreeHost, readProcessRunId, withUnverifiedObservations, cleanupOwnedProcessGroup, verifyNoTokenOwnedProcesses, readLiveProcessTable, settleLauncherExit, createOwnedCleanupPlan, mergeProcessOwnershipFailure, ownershipFailurePriority, revalidateOwnedProcessGroup, cleanupValidationFailure, sanitizedTokenReadFailure, processOwnershipFailures, processRunTokenFailures, recheckOwnershipFailures, TOKEN_READ_RETRY_ATTEMPTS, TOKEN_READ_RETRY_DELAY_MS, PLATFORM_BINARY_ENVIRONMENT_WITHHELD, RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD, currentProcessUid, environmentWithheldFromInspection, scanTokenOwnedProcesses, settleUnreadableTokenCandidates;
-function init_ProcessOwnership() {
-	return (init_ProcessOwnership = __esmMin((() => {
-		init_ProcessOwnershipObservation();
-		init_ProcessOwnershipIdentity();
-		init_ProcessOwnershipProcessTree();
-		init_ProcessRunTokenObservations();
-		init_unicodeCodePointOrder();
-		execFileAsync = promisify(execFile);
-		cleanupWindowsProcessTree = async (rootPid, host = systemWindowsProcessTreeHost) => {
-			if (!Number.isSafeInteger(rootPid) || rootPid <= 0) return {
-				cleaned: false,
-				reason: "Windows process-tree PID is invalid"
-			};
-			try {
-				const result = await host.terminateTree(rootPid);
-				return {
-					cleaned: true,
-					signaled: result === "terminated"
-				};
-			} catch (cause) {
-				return {
-					cleaned: false,
-					reason: `Windows process-tree termination failed for PID ${String(rootPid)}: ${errorMessage(cause)}`
-				};
-			}
-		};
-		systemWindowsProcessTreeHost = { async terminateTree(rootPid) {
-			try {
-				await execFileAsync("taskkill.exe", [
-					"/pid",
-					String(rootPid),
-					"/t",
-					"/f"
-				], {
-					windowsHide: true,
-					timeout: 5e3
-				});
-				return "terminated";
-			} catch (cause) {
-				if (cause instanceof Error && "code" in cause && (cause.code === 128 || cause.code === "ESRCH")) return "missing";
-				throw cause;
-			}
-		} };
-		readProcessRunId = async (pid, host = systemProcessOwnershipHost, signal) => (await host.environment(pid, signal)).REA_PROCESS_RUN_ID;
-		withUnverifiedObservations = (result, unverified) => unverified.length === 0 || (result.unverified?.length ?? 0) > 0 ? result : {
-			...result,
-			unverified
-		};
-		cleanupOwnedProcessGroup = async (ownership, host = systemProcessOwnershipHost) => {
-			const processTable = await readLiveProcessTable(host);
-			if (!processTable.available) return {
-				cleaned: false,
-				reason: `process table could not be inspected: ${processTable.reason}`
-			};
-			const plan = await createOwnedCleanupPlan(ownership, processTable.processes, host);
-			if ("cleaned" in plan) return plan;
-			let signaled = false;
-			for (const processGroupId of plan.signalOrder) {
-				const revalidation = await revalidateOwnedProcessGroup(processGroupId, ownership, host, plan.tokenOwnedIdentities);
-				if ("cleaned" in revalidation) {
-					if (!revalidation.cleaned) return withUnverifiedObservations(revalidation, plan.unverified);
-					return {
-						...revalidation,
-						...revalidation.unverified?.length || plan.unverified.length === 0 ? {} : { unverified: plan.unverified }
-					};
-				}
-				if (revalidation.empty) continue;
-				try {
-					host.signalGroup(processGroupId, "SIGKILL");
-					signaled = true;
-				} catch (cause) {
-					const code = cause instanceof Error && "code" in cause ? cause.code : undefined;
-					if (code !== "ESRCH") return withUnverifiedObservations({
-						cleaned: false,
-						reason: `owned process group signal failed: ${errorMessage(cause)}`
-					}, plan.unverified);
-				}
-			}
-			if (plan.unresolved.length > 0) return cleanupValidationFailure(plan.unresolved, plan.unverified);
-			return {
-				cleaned: true,
-				signaled,
-				...plan.unverified.length === 0 ? {} : { unverified: plan.unverified }
-			};
-		};
-		verifyNoTokenOwnedProcesses = async (runId, host = systemProcessOwnershipHost, captureBaseline, relation) => {
-			const processTable = await readLiveProcessTable(host);
-			if (!processTable.available) return {
-				cleaned: false,
-				reason: `process table could not be inspected: ${processTable.reason}`
-			};
-			const scan = await scanTokenOwnedProcesses(processTable.processes, runId, host, captureBaseline, relation);
-			if (scan.failures.length > 0) return cleanupValidationFailure(scan.failures, scan.unverified);
-			if (scan.owned.length > 0) return {
-				cleaned: false,
-				reason: "token-owned process remained after cleanup",
-				...scan.unverified.length === 0 ? {} : { unverified: scan.unverified }
-			};
-			return {
-				cleaned: true,
-				signaled: false,
-				...scan.unverified.length === 0 ? {} : { unverified: scan.unverified }
-			};
-		};
-		readLiveProcessTable = async (host) => {
-			try {
-				return {
-					available: true,
-					processes: liveProcesses(await host.listProcesses())
-				};
-			} catch (cause) {
-				return {
-					available: false,
-					reason: errorMessage(cause)
-				};
-			}
-		};
-		settleLauncherExit = async (ownership, processes, host) => {
-			const launcher = processes.find(({ pid }) => pid === ownership.leaderPid);
-			if (launcher === undefined) return processes;
-			const reason = launcherIdentityFailure(launcher, ownership);
-			if (reason === null) return processes;
-			const refreshed = await readLiveProcessTable(host);
-			if (refreshed.available && !refreshed.processes.some(({ pid }) => pid === launcher.pid)) {
-				const descendants = descendantsOf([launcher.pid], processes);
-				const descendantPids = new Set(descendants.map(({ pid }) => pid));
-				const descendantGroupIds = new Set(descendants.map(({ processGroupId }) => processGroupId));
-				const refreshedDescendantPids = new Set(descendantsOf(descendants.map(({ pid }) => pid), refreshed.processes).map(({ pid }) => pid));
-				if (refreshed.processes.some((process) => process.processGroupId !== ownership.processGroupId && (refreshedDescendantPids.has(process.pid) || descendantPids.has(process.pid) || descendantGroupIds.has(process.processGroupId)))) return {
-					cleaned: false,
-					reason
-				};
-				return refreshed.processes;
-			}
-			return {
-				cleaned: false,
-				reason
-			};
-		};
-		createOwnedCleanupPlan = async (ownership, initialProcesses, host) => {
-			const processes = await settleLauncherExit(ownership, initialProcesses, host);
-			if ("cleaned" in processes) return processes;
-			const sampledProcessGroupIds = new Set((ownership.sampledProcessGroupIds ?? []).filter((processGroupId) => Number.isSafeInteger(processGroupId) && processGroupId > 0));
-			const tokenOwned = ownership.sweepTokenOwnedProcesses === true ? await scanTokenOwnedProcesses(processes, ownership.runId, host, ownership.captureBaseline, {
-				leaderPid: ownership.leaderPid,
-				processGroupId: ownership.processGroupId,
-				...sampledProcessGroupIds.size === 0 ? {} : { sampledProcessGroupIds: [...sampledProcessGroupIds] }
-			}) : {
-				owned: [],
-				failures: [],
-				unverified: [],
-				identities: new Map()
-			};
-			const tokenOwnedGroupIds = new Set(tokenOwned.owned.map(({ processGroupId }) => processGroupId));
-			const launcher = processes.find(({ pid }) => pid === ownership.leaderPid);
-			const rootMembers = processes.filter(({ processGroupId }) => processGroupId === ownership.processGroupId);
-			if (launcher === undefined && rootMembers.length === 0 && tokenOwned.owned.length === 0 && !processes.some(({ processGroupId }) => sampledProcessGroupIds.has(processGroupId))) return tokenOwned.failures.length > 0 ? {
-				signalOrder: [],
-				tokenOwnedIdentities: tokenOwned.identities,
-				unresolved: tokenOwned.failures,
-				unverified: tokenOwned.unverified
-			} : {
-				cleaned: true,
-				signaled: false,
-				...tokenOwned.unverified.length === 0 ? {} : { unverified: tokenOwned.unverified }
-			};
-			let descendants = [];
-			if (launcher !== undefined) {
-				descendants = descendantsOf([launcher.pid], processes);
-			}
-			const descendantPids = new Set(descendants.map(({ pid }) => pid));
-			const processGroupIds = new Set([ownership.processGroupId]);
-			for (const descendant of descendants) processGroupIds.add(descendant.processGroupId);
-			for (const process of tokenOwned.owned) processGroupIds.add(process.processGroupId);
-			for (const processGroupId of sampledProcessGroupIds) processGroupIds.add(processGroupId);
-			const signalableGroups = new Set();
-			const unresolved = [...tokenOwned.failures];
-			const unverifiableSampledGroups = new Set();
-			for (const processGroupId of processGroupIds) {
-				if (processGroupId === ownership.processGroupId) continue;
-				const groupLeader = processes.find(({ pid, processGroupId: observedGroupId }) => pid === processGroupId && observedGroupId === processGroupId);
-				if ((groupLeader === undefined || !descendantPids.has(groupLeader.pid)) && !tokenOwnedGroupIds.has(processGroupId) && !sampledProcessGroupIds.has(processGroupId)) return {
-					cleaned: false,
-					reason: "descendant process-group leader identity could not be verified"
-				};
-				if ((groupLeader === undefined || !descendantPids.has(groupLeader.pid)) && !tokenOwnedGroupIds.has(processGroupId)) unverifiableSampledGroups.add(processGroupId);
-			}
-			const liveMembers = processes.filter(({ processGroupId }) => processGroupIds.has(processGroupId));
-			for (const processGroupId of processGroupIds) {
-				const members = liveMembers.filter(({ processGroupId: observedGroupId }) => observedGroupId === processGroupId);
-				if (members.length === 0) continue;
-				const failures = await processOwnershipFailures(members, ownership.runId, host, tokenOwned.identities);
-				if (failures.length === 0 && unverifiableSampledGroups.has(processGroupId)) unresolved.push(...members.map(({ pid }) => ({
-					pid,
-					reason: "process-identity-unavailable",
-					diagnostic: "sampled process-group leader identity could not be verified"
-				})));
-				const scanFailures = tokenOwned.failures.filter(({ pid }) => members.some((member) => member.pid === pid));
-				for (const failure of failures) mergeProcessOwnershipFailure(unresolved, failure);
-				if (failures.length === 0 && scanFailures.length === 0 && !unverifiableSampledGroups.has(processGroupId)) signalableGroups.add(processGroupId);
-			}
-			if (ownership.sweepTokenOwnedProcesses !== true && unresolved.length > 0) return cleanupValidationFailure(unresolved, tokenOwned.unverified);
-			return {
-				signalOrder: [...signalableGroups].filter((groupId) => processGroupIds.has(groupId)).sort((left, right) => left === ownership.processGroupId ? -1 : right === ownership.processGroupId ? 1 : left - right),
-				tokenOwnedIdentities: tokenOwned.identities,
-				unresolved,
-				unverified: tokenOwned.unverified
-			};
-		};
-		mergeProcessOwnershipFailure = (failures, next) => {
-			const index = failures.findIndex(({ pid }) => pid === next.pid);
-			if (index < 0) {
-				failures.push(next);
-				return;
-			}
-			const previous = failures[index];
-			if (previous !== undefined && ownershipFailurePriority(next.reason) >= ownershipFailurePriority(previous.reason)) failures[index] = next;
-		};
-		ownershipFailurePriority = (reason) => reason === "run-token-mismatch" ? 3 : reason === "process-identity-unavailable" ? 2 : reason === "environment-unreadable" ? 1 : 0;
-		revalidateOwnedProcessGroup = async (processGroupId, ownership, host, expectedIdentities) => {
-			let members;
-			try {
-				const processes = await settleLauncherExit(ownership, liveProcesses(await host.listProcesses()), host);
-				if ("cleaned" in processes) return processes;
-				members = processes.filter(({ processGroupId: observedGroupId }) => observedGroupId === processGroupId);
-			} catch (cause) {
-				return {
-					cleaned: false,
-					reason: `process ownership could not be revalidated: ${errorMessage(cause)}`
-				};
-			}
-			const failures = await processOwnershipFailures(members, ownership.runId, host, expectedIdentities);
-			if (failures.length > 0) return cleanupValidationFailure(failures);
-			if (processGroupId !== ownership.processGroupId && members.length > 0 && !members.some(({ pid }) => pid === processGroupId) && ownership.sweepTokenOwnedProcesses !== true) return {
-				cleaned: false,
-				reason: "descendant process-group leader identity could not be revalidated"
-			};
-			return { empty: members.length === 0 };
-		};
-		cleanupValidationFailure = (failures, unverified = []) => {
-			const unverifiedEntry = unverified.length === 0 ? {} : { unverified };
-			const unreadable = failures.filter(({ reason }) => reason === "environment-unreadable");
-			if (failures.some(({ reason }) => reason === "run-token-mismatch")) return {
-				cleaned: false,
-				reason: `process ownership token mismatch for PID(s): ${[...new Set(failures.filter(({ reason }) => reason === "run-token-mismatch").map(({ pid }) => pid))].sort((left, right) => left - right).join(", ")}`,
-				failures,
-				...unverifiedEntry
-			};
-			if (failures.some(({ reason }) => reason === "process-identity-unavailable")) return {
-				cleaned: false,
-				reason: "process identity could not be revalidated",
-				failures,
-				...unverifiedEntry
-			};
-			if (unreadable.length > 0) {
-				const counts = new Map();
-				for (const { diagnostic } of unreadable) {
-					const category = sanitizedTokenReadFailure(diagnostic);
-					counts.set(category, (counts.get(category) ?? 0) + 1);
-				}
-				const breakdown = [...counts].sort(([left], [right]) => compareUnicodeCodePoints(left, right)).map(([category, count]) => `${category}=${String(count)}`).join(", ");
-				const candidates = unreadable.map(({ pid, diagnostic }) => `${String(pid)}=${sanitizedTokenReadFailure(diagnostic)}`).sort((left, right) => compareUnicodeCodePoints(left, right));
-				return {
-					cleaned: false,
-					reason: `process ownership token could not be read for ${String(unreadable.length)} live process(es): ${breakdown}; live candidates ${candidates.join(", ")}`,
-					failures,
-					...unverifiedEntry
-				};
-			}
-			return {
-				cleaned: false,
-				reason: "process ownership could not be revalidated",
-				failures,
-				...unverifiedEntry
-			};
-		};
-		sanitizedTokenReadFailure = (diagnostic) => {
-			if (diagnostic === "environment_unavailable") return diagnostic;
-			if (diagnostic === "platform_binary_environment_withheld") return diagnostic;
-			if (diagnostic === "restricted_process_environment_withheld") return diagnostic;
-			const environmentErrno = /^(EACCES|EPERM|ENOENT|ESRCH):/u.exec(diagnostic ?? "");
-			if (environmentErrno?.[1] !== undefined) return `environment_errno_${environmentErrno[1]}`;
-			if (diagnostic === "apple_vector_unavailable") return diagnostic;
-			if (diagnostic === "ambiguous_environment_boundary") return diagnostic;
-			if (diagnostic === "malformed_procargs") return diagnostic;
-			if (diagnostic === "process_identity_changed_during_token_read") return diagnostic;
-			if (diagnostic === "process_not_in_snapshot") return diagnostic;
-			const processTableFailure = /^process_table_failed_(\d+)$/u.exec(diagnostic ?? "");
-			if (processTableFailure?.[1] !== undefined) return `process_table_errno_${processTableFailure[1]}`;
-			const sysctlFailure = /^sysctl_failed_(\d+)$/u.exec(diagnostic ?? "");
-			if (sysctlFailure?.[1] !== undefined) return `sysctl_errno_${sysctlFailure[1]}`;
-			if (diagnostic === "reader_failure") return diagnostic;
-			if (diagnostic === "duplicate_run_token") return diagnostic;
-			if (diagnostic === "invalid_run_token_encoding") return diagnostic;
-			return "other_unavailable";
-		};
-		processOwnershipFailures = async (members, runId, host, expectedIdentities = new Map()) => {
-			const failures = [];
-			if (expectedIdentities.size > 0 && host.processIdentities !== undefined) {
-				const expectedMembers = members.filter(({ pid }) => expectedIdentities.has(pid));
-				const observed = await host.processIdentities(expectedMembers);
-				const identityFailures = [];
-				for (const member of expectedMembers) {
-					const expected = expectedIdentities.get(member.pid);
-					const current = observed.get(member.pid);
-					if (expected === null || current?.state !== "readable" || current.identity !== expected) {
-						identityFailures.push({
-							pid: member.pid,
-							reason: "process-identity-unavailable",
-							diagnostic: "process identity changed or became unavailable before signal"
-						});
-					}
-				}
-				failures.push(...await recheckOwnershipFailures(identityFailures, host));
-			}
-			failures.push(...await processRunTokenFailures(members, runId, host));
-			if (failures.length === 0 && expectedIdentities.size > 0 && host.processIdentities !== undefined) {
-				const expectedMembers = members.filter(({ pid }) => expectedIdentities.has(pid));
-				const observed = await host.processIdentities(expectedMembers);
-				const identityFailures = [];
-				for (const member of expectedMembers) {
-					const expected = expectedIdentities.get(member.pid);
-					const current = observed.get(member.pid);
-					if (expected !== null && current?.state === "readable" && current.identity === expected) continue;
-					identityFailures.push({
-						pid: member.pid,
-						reason: "process-identity-unavailable",
-						diagnostic: "process identity changed or became unavailable during token validation"
-					});
-				}
-				failures.push(...await recheckOwnershipFailures(identityFailures, host));
-			}
-			return failures;
-		};
-		processRunTokenFailures = async (members, runId, host) => {
-			const failures = [];
-			for await (const { process: member, observation } of readProcessRunTokens(host, members)) {
-				if (observation.state === "readable") {
-					if (observation.runId !== runId) failures.push({
-						pid: member.pid,
-						reason: "run-token-mismatch"
-					});
-					continue;
-				}
-				failures.push({
-					pid: member.pid,
-					reason: "environment-unreadable",
-					diagnostic: observation.reason
-				});
-			}
-			return recheckOwnershipFailures(failures, host);
-		};
-		recheckOwnershipFailures = async (failures, host) => {
-			if (!failures.some(({ reason }) => reason !== "run-token-mismatch")) return failures;
-			try {
-				let processes = await host.listProcesses();
-				const isDarwin = (host.platform ?? process.platform) === "darwin";
-				for (let attempt = 0; isDarwin && attempt < TOKEN_READ_RETRY_ATTEMPTS && processes.some(({ pid, state }) => failures.some((failure) => failure.pid === pid && failure.reason !== "run-token-mismatch") && state.slice(1).includes("E")); attempt += 1) {
-					await new Promise((resolve) => setTimeout(resolve, TOKEN_READ_RETRY_DELAY_MS));
-					processes = await host.listProcesses();
-				}
-				const live = new Set(liveProcesses(processes).map(({ pid }) => pid));
-				return failures.filter(({ pid, reason }) => reason === "run-token-mismatch" || live.has(pid));
-			} catch (cause) {
-				return failures.map((failure) => failure.reason === "run-token-mismatch" ? failure : {
-					...failure,
-					diagnostic: `${failure.diagnostic}; process liveness recheck failed: ${errorMessage(cause)}`
-				});
-			}
-		};
-		TOKEN_READ_RETRY_ATTEMPTS = 3;
-		TOKEN_READ_RETRY_DELAY_MS = 40;
-		PLATFORM_BINARY_ENVIRONMENT_WITHHELD = "platform_binary_environment_withheld";
-		RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD = "restricted_process_environment_withheld";
-		currentProcessUid = () => typeof process.getuid === "function" ? process.getuid() : undefined;
-		environmentWithheldFromInspection = (entry, diagnostic) => {
-			const uid = currentProcessUid();
-			if (uid !== undefined && entry.uid !== undefined && entry.uid !== uid) return true;
-			return diagnostic === PLATFORM_BINARY_ENVIRONMENT_WITHHELD || diagnostic === RESTRICTED_PROCESS_ENVIRONMENT_WITHHELD;
-		};
-		scanTokenOwnedProcesses = async (processes, runId, host, captureBaseline, relation) => {
-			let candidates = processes;
-			let candidateIdentities = new Map();
-			if (host.processIdentities !== undefined) {
-				const current = await host.processIdentities(processes);
-				candidateIdentities = current;
-				if (captureBaseline !== undefined) {
-					const baseline = new Map(captureBaseline.map(({ pid, identity }) => [pid, identity]));
-					candidates = processes.filter((process) => {
-						const before = baseline.get(process.pid);
-						const now = current.get(process.pid);
-						return !(before !== undefined && before !== null && now?.state === "readable" && now.identity === before);
-					});
-				}
-			}
-			const failures = [];
-			if (captureBaseline !== undefined && host.processIdentities !== undefined) {
-				const stableCandidates = [];
-				const identityFailures = [];
-				for (const process of candidates) {
-					if (candidateIdentities.get(process.pid)?.state === "readable") {
-						stableCandidates.push(process);
-						continue;
-					}
-					identityFailures.push({
-						pid: process.pid,
-						reason: "process-identity-unavailable",
-						diagnostic: "process identity was unavailable during token scan"
-					});
-				}
-				failures.push(...await recheckOwnershipFailures(identityFailures, host));
-				candidates = stableCandidates;
-			}
-			const owned = [];
-			const ownedIdentities = new Map();
-			const recordOwned = (process) => {
-				owned.push(process);
-				const identity = candidateIdentities.get(process.pid);
-				ownedIdentities.set(process.pid, identity?.state === "readable" ? identity.identity : null);
-			};
-			const unreadable = [];
-			for await (const { process, observation } of readProcessRunTokens(host, candidates)) {
-				if (observation.state === "readable") {
-					if (observation.runId === runId) recordOwned(process);
-				} else unreadable.push({
-					process,
-					diagnostic: observation.reason
-				});
-			}
-			const remaining = await settleUnreadableTokenCandidates(unreadable, runId, host, recordOwned);
-			const relatedPids = new Set();
-			const relatedGroupIds = new Set();
-			if (relation !== undefined) {
-				relatedPids.add(relation.leaderPid);
-				for (const descendant of descendantsOf([relation.leaderPid], processes)) relatedPids.add(descendant.pid);
-				relatedGroupIds.add(relation.processGroupId);
-				for (const processGroupId of relation.sampledProcessGroupIds ?? []) if (Number.isSafeInteger(processGroupId) && processGroupId > 0) relatedGroupIds.add(processGroupId);
-				for (const process of owned) relatedGroupIds.add(process.processGroupId);
-			}
-			const unverified = [];
-			const strict = [];
-			const withheld = [];
-			for (const candidate of remaining) {
-				const isRelated = relation === undefined || relatedPids.has(candidate.process.pid) || relatedGroupIds.has(candidate.process.processGroupId);
-				if (!isRelated && environmentWithheldFromInspection(candidate.process, candidate.diagnostic)) {
-					withheld.push(candidate);
-					continue;
-				}
-				strict.push(candidate);
-			}
-			let finalLive;
-			try {
-				finalLive = new Set(liveProcesses(await host.listProcesses()).map(({ pid }) => pid));
-			} catch (cause) {
-				void cause;
-				finalLive = undefined;
-			}
-			for (const candidate of strict) {
-				if (finalLive !== undefined && !finalLive.has(candidate.process.pid)) continue;
-				failures.push({
-					pid: candidate.process.pid,
-					reason: "environment-unreadable",
-					diagnostic: candidate.diagnostic
-				});
-			}
-			for (const candidate of withheld) {
-				if (finalLive !== undefined && !finalLive.has(candidate.process.pid)) continue;
-				unverified.push({
-					pid: candidate.process.pid,
-					diagnostic: candidate.diagnostic
-				});
-			}
-			if (candidates.length > 0 && host.processIdentities !== undefined) {
-				const afterRead = await host.processIdentities(candidates);
-				const stillOwned = [];
-				const identityFailures = [];
-				const ownedPids = new Set(owned.map(({ pid }) => pid));
-				for (const process of candidates) {
-					const before = candidateIdentities.get(process.pid);
-					const current = afterRead.get(process.pid);
-					if (before?.state === "readable" && current?.state === "readable" && current.identity === before.identity) {
-						if (ownedPids.has(process.pid)) stillOwned.push(process);
-						continue;
-					}
-					identityFailures.push({
-						pid: process.pid,
-						reason: "process-identity-unavailable",
-						diagnostic: "process identity changed or became unavailable during token validation"
-					});
-				}
-				failures.push(...await recheckOwnershipFailures(identityFailures, host));
-				return {
-					owned: stillOwned,
-					failures,
-					unverified,
-					identities: ownedIdentities
-				};
-			}
-			return {
-				owned,
-				failures,
-				unverified,
-				identities: ownedIdentities
-			};
-		};
-		settleUnreadableTokenCandidates = async (pending, runId, host, recordOwned) => {
-			let remaining = pending;
-			for (let attempt = 0; attempt < TOKEN_READ_RETRY_ATTEMPTS && remaining.length > 0; attempt += 1) {
-				await new Promise((resolve) => setTimeout(resolve, TOKEN_READ_RETRY_DELAY_MS));
-				let live;
-				try {
-					live = new Set(liveProcesses(await host.listProcesses()).map(({ pid }) => pid));
-				} catch (cause) {
-					void cause;
-					live = undefined;
-				}
-				const stillUnreadable = [];
-				const candidates = remaining.map(({ process }) => process).filter(({ pid }) => live === undefined || live.has(pid));
-				for await (const { process, observation } of readProcessRunTokens(host, candidates)) {
-					if (observation.state === "readable") {
-						if (observation.runId === runId) recordOwned(process);
-						continue;
-					}
-					stillUnreadable.push({
-						process,
-						diagnostic: observation.reason
-					});
-				}
-				remaining = stillUnreadable;
-			}
-			return remaining;
-		};
-	})))();
-}
-
-//#endregion
-export { DarwinProcessOwnershipInspectionError, SWIFTC_INTERRUPT, boundedUtf8Text, cleanupOwnedProcessGroup, cleanupWindowsProcessTree, init_DarwinProcessRunTokenReader, init_ProcessOwnership, init_ProcessOwnershipObservation, init_ProcessOwnershipProcessTree, init_boundedUtf8Text, observeOwnedProcessGroups, observeOwnedProcessLineage, observeProcessStartIdentity, observeProcessStartIdentityExit, parseLinuxProcessStartTime, prepareProcessOwnershipInspection, readProcessRunId, selectCapturedProcessGroupIds, signalProcessWithStartIdentity, systemProcessOwnershipHost, verifyNoTokenOwnedProcesses };
+export { DarwinProcessOwnershipInspectionError, SWIFTC_INTERRUPT, boundedUtf8Text, descendantsOf, errorMessage, init_DarwinProcessRunTokenReader, init_ProcessOwnershipIdentity, init_ProcessOwnershipObservation, init_ProcessOwnershipProcessTree, init_ProcessRunTokenObservations, init_boundedUtf8Text, launcherIdentityFailure, liveProcesses, observeOwnedProcessGroups, observeOwnedProcessLineage, observeProcessStartIdentity, observeProcessStartIdentityExit, parseLinuxProcessStartTime, prepareProcessOwnershipInspection, readProcessRunTokens, selectCapturedProcessGroupIds, signalProcessWithStartIdentity, systemProcessOwnershipHost };