reverseport 0.0.0-stage → 1.0.0

package/dist/javascript/recovery/WakaruPublication.js

@@ -0,0 +1,126 @@
+import { join } from "node:path";
+import { Readable } from "node:stream";
+import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
+import { javascriptRecoveryResultSchema, } from "../../domain/javascript/javascriptRecovery.js";
+import { readRecoveryFile, recoveryDigest, } from "./RecoveryFiles.js";
+import { recoveryRanges, validateRecoverySourceMap, } from "./WakaruReport.js";
+import { RECOVERY_LIMITATIONS, RECOVERY_LIMITS, WAKARU_RELEASE, } from "./WakaruRelease.js";
+/** Write validated artifacts to one exclusively owned, rollback-capable tree. */
+export const publishWakaruArtifacts = async (context) => {
+    const { tree, sources, parsed, staging, signal } = context;
+    const write = async (path, bytes) => {
+        const sha256 = recoveryDigest(bytes);
+        const file = await tree.write(path, Readable.from([bytes]), { sha256, bytes: bytes.byteLength }, signal);
+        return {
+            path: join(tree.outputRoot, file.relativePath),
+            sha256: file.sha256,
+            bytes: file.bytesWritten,
+        };
+    };
+    const publishedSources = [];
+    for (const selected of sources) {
+        const { relative_path, ...source } = selected;
+        const snapshot = await readRecoveryFile(source.snapshot_path, source.bytes, signal);
+        if (recoveryDigest(snapshot) !== source.sha256)
+            throw new AnalysisOutputError("recover_javascript_sources", `The input snapshot changed during recovery: ${source.path}`);
+        publishedSources.push({
+            ...source,
+            published_copy: await write(`inputs/${relative_path}`, snapshot),
+        });
+    }
+    const [source, ...additionalSources] = publishedSources;
+    const modules = [];
+    for (const module of parsed.report.modules) {
+        modules.push(await publishModule(context, module, write));
+    }
+    const report = await write("reports/stdout.json", Buffer.from(context.execution.stdout));
+    const provenance = await write("reports/provenance.json", await readRecoveryFile(join(staging, "provenance.json"), RECOVERY_LIMITS.reportBytes, signal));
+    const details = {
+        source,
+        ...(additionalSources.length === 0
+            ? {}
+            : { additional_sources: additionalSources }),
+        engine: {
+            id: "wakaru",
+            version: context.admitted.version,
+            executable: {
+                path: context.engine.command,
+                sha256: context.engine.sha256,
+                bytes: context.engine.bytes,
+            },
+            audited_source_revision: WAKARU_RELEASE.revision,
+            executed_source_revision: null,
+        },
+        options: {
+            extraction_mode: context.input.extraction_mode,
+            rewrite_level: context.input.rewrite_level,
+        },
+        status: parsed.status,
+        detected_formats: parsed.report.detected_formats,
+        reported_safety: parsed.report.safety,
+        reported_strategy: parsed.provenance.strategy,
+        reported_format: parsed.provenance.format,
+        total: parsed.report.total,
+        failed: parsed.report.failed,
+        modules,
+        warnings: parsed.report.warnings.map(({ filename, kind, is_error, message }) => ({
+            filename,
+            kind,
+            is_error,
+            message,
+        })),
+        report,
+        provenance,
+        analysis_input: modules.length === 0
+            ? null
+            : {
+                input_path: join(tree.outputRoot, "modules"),
+                format: "directory",
+            },
+        runtime_equivalence: "unknown",
+        limitations: [
+            ...RECOVERY_LIMITATIONS,
+            ...(context.admitted.status === "compatible"
+                ? [context.admitted.limitation]
+                : []),
+        ],
+    };
+    const manifest = await write("manifest.json", Buffer.from(`${JSON.stringify(details, null, 2)}\n`));
+    return javascriptRecoveryResultSchema.parse({ ...details, manifest });
+};
+const publishModule = async (context, module, write) => {
+    const { staging, sources, parsed, signal } = context;
+    const artifact = await write(`modules/${module.filename}`, await readRecoveryFile(join(staging, module.filename), RECOVERY_LIMITS.outputBytes, signal));
+    const mapPath = join(staging, `${module.filename}.map`);
+    let sourceMap = null;
+    const map = await readRecoveryFile(mapPath, RECOVERY_LIMITS.outputBytes, signal).catch((cause) => {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return null;
+        throw cause;
+    });
+    if (map !== null) {
+        validateRecoverySourceMap(map, module.filename);
+        sourceMap = await write(`modules/${module.filename}.map`, map);
+    }
+    const provenance = parsed.provenance.modules[module.filename];
+    if (provenance === undefined)
+        throw new AnalysisOutputError("recover_javascript_sources", `Missing module provenance: ${module.filename}`);
+    const origin = sources.find((source) => source.snapshot_path === provenance.input);
+    if (origin === undefined)
+        throw new AnalysisOutputError("recover_javascript_sources", `Unselected module provenance input: ${provenance.input}`);
+    return {
+        reported_filename: module.filename,
+        reported_status: module.status,
+        artifact,
+        source_map: sourceMap,
+        provenance: {
+            reported_input: provenance.input,
+            original_path: origin.path,
+            original_sha256: origin.sha256,
+            extraction: provenance.extraction,
+            byte_ranges: recoveryRanges(provenance.ranges),
+            context_byte_ranges: recoveryRanges(provenance.context_ranges ?? []),
+            range_semantics: "half-open-utf8-bytes",
+        },
+    };
+};

package/dist/javascript/recovery/WakaruRelease.js

@@ -0,0 +1,36 @@
+/** Unchanged upstream source pin; executed bytes are identified separately. */
+export const WAKARU_RELEASE = {
+    version: "1.14.0",
+    revision: "8219bf5016a063d7fb215101a8c45d5959ec733f",
+    repository: "https://github.com/pionxzh/wakaru",
+};
+/**
+ * Releases the report parser accepts. Wakaru changes `--version`, `--json`
+ * and `provenance.json` only by addition within a major version
+ * (https://github.com/pionxzh/wakaru/blob/v1.14.0/docs/cli.md#machine-readable-output-compatibility);
+ * 1.13.0 is the first release this adapter verified.
+ */
+export const WAKARU_ACCEPTED_RANGE = "^1.13.0";
+/** Catalog identity for the verified Wakaru release. Evidence replaces version with the observed banner. */
+export const WAKARU_PROVIDER_IDENTITY = {
+    id: "wakaru",
+    name: "Wakaru",
+    version: WAKARU_RELEASE.version,
+};
+/** Per-operation resource bounds for the verified Linux adapter. */
+export const RECOVERY_LIMITS = {
+    inputBytes: 64 * 1024 * 1024,
+    outputBytes: 128 * 1024 * 1024,
+    outputEntries: 10000,
+    reportBytes: 8 * 1024 * 1024,
+    addressSpaceBytes: 1024 * 1024 * 1024,
+    timeoutMs: 120000,
+};
+/** Public limitations for transformations and extraction provenance. */
+export const RECOVERY_LIMITATIONS = [
+    "Recovered sources are derived artifacts; original variable names and runtime equivalence are not established.",
+    "Extraction ranges refer to half-open UTF-8 byte offsets in the original input, not rewritten line positions or whole-bundle coverage.",
+    "Emitted source maps are preserved as reported by the engine; their mapping accuracy is not independently established.",
+    "Inspection mode may produce non-executable regions. No input or recovered application code is executed.",
+    "Linux adapter: one worker, 1 GiB address-space ceiling, 120-second deadline, 64 MiB total input, 128 MiB output, 10000 output entries and 8 MiB per diagnostic/report stream. Resource limits are per operation, not aggregate host containment.",
+];

package/dist/javascript/recovery/WakaruReport.js

@@ -0,0 +1,140 @@
+import { z } from "zod";
+import { normalizeArtifactPath, ArtifactPathRegistry, } from "../../artifacts/ArtifactPaths.js";
+import { AnalysisOutputError } from "../../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import { readRecoveryFile, recoveryFailureMessage } from "./RecoveryFiles.js";
+import { RECOVERY_LIMITS } from "./WakaruRelease.js";
+const warningSchema = z.looseObject({
+    filename: z.string(),
+    kind: z.string(),
+    is_error: z.boolean(),
+    message: z.string(),
+});
+const reportSchema = z.looseObject({
+    detected_formats: z.array(z.string()),
+    safety: z.string(),
+    modules: z.array(z.looseObject({
+        filename: z.string().min(1),
+        kind: z.literal("javascript"),
+        status: z.string().min(1),
+    })),
+    warnings: z.array(warningSchema),
+    total: z.number().int().nonnegative(),
+    failed: z.number().int().nonnegative(),
+    elapsed_ms: z.number().int().nonnegative(),
+});
+const rangeSchema = z.tuple([
+    z.number().int().nonnegative(),
+    z.number().int().nonnegative(),
+]);
+const provenanceSchema = z.looseObject({
+    format: z.string(),
+    strategy: z.string(),
+    modules: z.record(z.string(), z.looseObject({
+        input: z.string(),
+        ranges: z.array(rangeSchema),
+        extraction: z.string(),
+        context_ranges: z.array(rangeSchema).optional(),
+    })),
+});
+const OPERATION = "recover_javascript_sources";
+/**
+ * Parse producer JSON before projecting provider-neutral artifacts. Wakaru adds
+ * fields and category values within a major version, so unknown keys are kept
+ * and `status` stays the reported string; identity, path, range and file-set
+ * checks below remain exact.
+ */
+export const parseWakaruReports = async (context) => {
+    const { execution, provenancePath } = context;
+    try {
+        if (execution.exit_code !== 0 && execution.exit_code !== 1)
+            throw new TypeError("Wakaru did not complete recovery (expected exit 0 or a reported partial exit 1)");
+        const report = reportSchema.parse(JSON.parse(execution.stdout));
+        const provenance = provenanceSchema.parse(JSON.parse((await readRecoveryFile(provenancePath, RECOVERY_LIMITS.reportBytes)).toString("utf8")));
+        if (report.total !== report.modules.length || report.failed > report.total)
+            throw new TypeError("Reported module totals disagree");
+        if (execution.exit_code === 1 &&
+            report.failed === 0 &&
+            !report.warnings.some((warning) => warning.is_error))
+            throw new TypeError("Wakaru exited 1 without a reported partial recovery reason");
+        validateModuleSet(report, provenance, context);
+        return {
+            report,
+            provenance,
+            status: report.failed > 0 ||
+                report.warnings.some((warning) => warning.is_error) ||
+                execution.exit_code === 1
+                ? "partial"
+                : "complete",
+        };
+    }
+    catch (cause) {
+        throw new ProviderAdapterError("wakaru", OPERATION, {
+            cause,
+            diagnostics: {
+                reason: `Unusable Wakaru recovery report: ${recoveryFailureMessage(cause)}`,
+                exit_code: execution.exit_code,
+                signal: execution.signal,
+                stdout: execution.stdout,
+                stderr: execution.stderr,
+            },
+        });
+    }
+};
+const validateModuleSet = (report, provenance, context) => {
+    const { files, snapshots } = context;
+    const registry = new ArtifactPathRegistry();
+    const expected = new Set(["provenance.json"]);
+    const observed = new Set(files.map((file) => file.relativePath));
+    for (const module of report.modules) {
+        const path = normalizeArtifactPath(module.filename);
+        if (path !== module.filename || !/\.(?:js|mjs|cjs)$/u.test(path))
+            throw new TypeError(`Unsupported module path: ${module.filename}`);
+        registry.add(path, "file");
+        if (!observed.has(path))
+            throw new TypeError(`Missing reported module file: ${path}`);
+        expected.add(path);
+        if (observed.has(`${path}.map`))
+            expected.add(`${path}.map`);
+        const entry = provenance.modules[path];
+        const sourceBytes = entry === undefined ? undefined : snapshots.get(entry.input);
+        if (entry === undefined || sourceBytes === undefined)
+            throw new TypeError(`Module provenance does not bind the selected input snapshot: ${path}`);
+        validateRanges([...entry.ranges, ...(entry.context_ranges ?? [])], sourceBytes, path);
+    }
+    if (Object.keys(provenance.modules).length !== report.modules.length)
+        throw new TypeError("Provenance and reported module sets disagree");
+    for (const path of observed)
+        if (!expected.has(path))
+            throw new TypeError(`Unreported recovery artifact: ${path}`);
+};
+const validateRanges = (ranges, bytes, filename) => {
+    for (const [start, end] of ranges) {
+        if (start > end ||
+            end > bytes.length ||
+            !utf8Boundary(bytes, start) ||
+            !utf8Boundary(bytes, end))
+            throw new TypeError(`Invalid half-open UTF-8 byte range [${String(start)},${String(end)}) for ${filename}`);
+    }
+};
+const utf8Boundary = (bytes, offset) => {
+    const value = bytes[offset];
+    return value === undefined || (value & 0xc0) !== 0x80;
+};
+/** Translate extraction byte ranges without claiming rewritten line positions. */
+export const recoveryRanges = (ranges) => ranges.map(([start, end]) => ({ start, end }));
+/** Validate a source map's representation; preserve its unverified mapping bytes. */
+export const validateRecoverySourceMap = (bytes, filename) => {
+    const schema = z.object({
+        version: z.literal(3),
+        sources: z.array(z.string()),
+        names: z.array(z.string()),
+        mappings: z.string(),
+    });
+    try {
+        schema.parse(JSON.parse(bytes.toString("utf8")));
+    }
+    catch (cause) {
+        throw new AnalysisOutputError(OPERATION, `Invalid emitted source map for ${filename}: ${recoveryFailureMessage(cause)}`, { cause });
+    }
+};

package/dist/javascript/recovery/WakaruVersion.js

@@ -0,0 +1,24 @@
+import { satisfies, valid } from "semver";
+import { WAKARU_ACCEPTED_RANGE, WAKARU_RELEASE } from "./WakaruRelease.js";
+/** Caller-facing accepted releases, naming the verified build. */
+export const wakaruReleaseLine = () => `Wakaru ${WAKARU_ACCEPTED_RANGE} (verified with ${WAKARU_RELEASE.version})`;
+/** Classify a `wakaru <version>` banner against the accepted release range. */
+export const admitWakaruVersion = (banner) => {
+    const token = banner.startsWith("wakaru ")
+        ? banner.slice("wakaru ".length)
+        : undefined;
+    if (token === undefined ||
+        valid(token) !== token ||
+        !satisfies(token, WAKARU_ACCEPTED_RANGE))
+        return {
+            status: "unsupported",
+            message: `Unsupported Wakaru version ${banner.length === 0 ? "missing" : banner}; accepted releases are ${wakaruReleaseLine()}`,
+        };
+    if (token === WAKARU_RELEASE.version)
+        return { status: "verified", version: token };
+    return {
+        status: "compatible",
+        version: token,
+        limitation: `This session uses Wakaru ${token}. The report parser is verified against ${WAKARU_RELEASE.version}; other ${WAKARU_ACCEPTED_RANGE} releases are accepted and the observed version is reported.`,
+    };
+};

package/dist/javascript/sourceMaps/DecodedSourceMap.js

@@ -0,0 +1,47 @@
+import { TraceMap, decodedMappings } from "@jridgewell/trace-mapping";
+import { SourceMapFormatFailure, } from "./SourceMapFormat.js";
+/** Determine whether a leaf-local mapping falls before its enclosing boundary. */
+export const isBeforeSourceMapLeafStop = (leaf, line, column) => {
+    if (leaf.stop === null)
+        return true;
+    const generatedLine = leaf.offset.line + line;
+    const generatedColumn = column + (line === 0 ? leaf.offset.column : 0);
+    return (generatedLine < leaf.stop.line ||
+        (generatedLine === leaf.stop.line && generatedColumn < leaf.stop.column));
+};
+/** Resolve one declaration with the same pinned upstream implementation used by full maps. */
+export const resolveSourceMapSource = (source, sourceRoot, mapUrl) => {
+    const map = new TraceMap({
+        version: 3,
+        names: [],
+        sources: [source ?? ""],
+        ...(sourceRoot == null ? {} : { sourceRoot }),
+        mappings: "",
+    }, mapUrl);
+    const resolved = map.resolvedSources[0];
+    if (resolved === undefined)
+        throw new SourceMapFormatFailure("format", "Source-map resolver did not return the requested source identity.");
+    return resolved;
+};
+/** Decode leaf mappings and validate producer indices before any consumer publishes them. */
+export const decodeValidatedSourceMapLeaves = (leaves, mapUrl, check) => leaves.map((leaf) => {
+    check?.();
+    const map = new TraceMap(leaf.codecMap, mapUrl);
+    const rows = decodedMappings(map);
+    for (const [line, row] of rows.entries()) {
+        if ((line & 255) === 0)
+            check?.();
+        for (const segment of row) {
+            const generatedLine = leaf.offset.line + line;
+            const generatedColumn = segment[0] + (line === 0 ? leaf.offset.column : 0);
+            if (!Number.isSafeInteger(generatedLine) ||
+                !Number.isSafeInteger(generatedColumn) ||
+                ![1, 4, 5].includes(segment.length) ||
+                segment.some((value) => !Number.isSafeInteger(value) || value < 0) ||
+                (segment.length !== 1 && segment[1] >= leaf.map.sources.length) ||
+                (segment.length === 5 && segment[4] >= leaf.map.names.length))
+                throw new SourceMapFormatFailure("format", "Decoded local or absolute position, source index or name index is invalid.");
+        }
+    }
+    return { leaf, map, rows, resolvedSources: map.resolvedSources };
+});

package/dist/javascript/sourceMaps/SourceMapCodecProcess.js

@@ -0,0 +1,37 @@
+import { readStableArtifact } from "../../artifacts/readStableArtifact.js";
+import { WEB_SOURCE_MAP_LIMITS } from "../../domain/webSourceLocation.js";
+import { traceSourceMap } from "./TraceSourceMap.js";
+import { SourceMapFormatFailure } from "./SourceMapFormat.js";
+import { sourceMapCodecInputSchema, sourceMapCodecReplySchema, } from "./SourceMapCodecProtocol.js";
+import { z } from "zod";
+/** Dedicated process entrypoint invoked only for an explicitly selected map. */
+const execute = async () => {
+    try {
+        const path = process.argv[2];
+        if (path === undefined)
+            throw new SourceMapFormatFailure("format", "Codec request path is missing.");
+        const data = await readStableArtifact(path, WEB_SOURCE_MAP_LIMITS.outputBytes);
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(data.bytes);
+        const value = JSON.parse(text);
+        const input = sourceMapCodecInputSchema.parse(value);
+        if (Buffer.byteLength(input.text) > WEB_SOURCE_MAP_LIMITS.mapBytes)
+            throw new SourceMapFormatFailure("limit", "Source map exceeds the 4 MiB codec input budget.");
+        const report = traceSourceMap(input.text, input.url, input.position);
+        const reply = JSON.stringify(sourceMapCodecReplySchema.parse({ state: "success", report }));
+        if (Buffer.byteLength(reply) > WEB_SOURCE_MAP_LIMITS.outputBytes)
+            throw new SourceMapFormatFailure("limit", "Complete source-map point evidence exceeds the 32 MiB output budget; no partial evidence was returned.");
+        return reply;
+    }
+    catch (cause) {
+        if (!(cause instanceof SourceMapFormatFailure ||
+            cause instanceof z.ZodError ||
+            cause instanceof SyntaxError))
+            throw cause;
+        return JSON.stringify({
+            state: "failure",
+            reason: cause instanceof SourceMapFormatFailure ? cause.reason : "format",
+            message: cause.message,
+        });
+    }
+};
+process.stdout.write(await execute());

package/dist/javascript/sourceMaps/SourceMapCodecProtocol.js

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import { webSourceMapReportSchema, webSourcePositionSchema, } from "../../domain/webSourceLocation.js";
+/** Trusted codec process input; captured application code is never evaluated. */
+export const sourceMapCodecInputSchema = z.strictObject({
+    text: z.string(),
+    url: z.string().min(1),
+    position: webSourcePositionSchema,
+});
+/** Codec success or a specific producer/resource constraint. */
+export const sourceMapCodecReplySchema = z.discriminatedUnion("state", [
+    z.strictObject({
+        state: z.literal("success"),
+        report: webSourceMapReportSchema,
+    }),
+    z.strictObject({
+        state: z.literal("failure"),
+        reason: z.enum(["format", "unsupported", "limit"]),
+        message: z.string(),
+    }),
+]);

package/dist/javascript/sourceMaps/SourceMapCommand.js

@@ -0,0 +1,223 @@
+import { randomUUID } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { AnalysisError } from "../../domain/analysisErrorBase.js";
+import { AnalysisCancelledError, AnalysisCapabilityUnavailableError, AnalysisOutputError, AnalysisResourceConstraintError, AnalysisTimeoutError, } from "../../domain/analysisErrorCore.js";
+import { ProviderAdapterError } from "../../domain/providerAdapterError.js";
+import { ProviderCleanupError } from "../../domain/providerCleanupError.js";
+import { err, ok } from "../../domain/result.js";
+import { WEB_SOURCE_MAP_LIMITS } from "../../domain/webSourceLocation.js";
+import { PrivateRuntimeRoot, PrivateRuntimeRootUnavailableError, } from "../../process/PrivateRuntimeRoot.js";
+import { ProviderStartupDeadline } from "../../process/ProviderDeadline.js";
+import { javaScriptWorkerMemoryLimitBytes } from "../../process/JavaScriptWorkerMemoryLimit.js";
+import { cleanupOwnedProcessGroup } from "../../process/ProcessOwnership.js";
+import { ProviderProcessSupervisor, spawnOwnedProviderProcess, } from "../../process/ProviderProcess.js";
+import { prepareProcessOwnershipInspection } from "../../process/ProcessOwnershipObservation.js";
+const OPERATION = "trace_web_source_location";
+const PROVIDER = "source-map-decoder";
+/** Process commit limit enforced on the codec; null where V8 heap flags apply. */
+export const SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES = javaScriptWorkerMemoryLimitBytes(WEB_SOURCE_MAP_LIMITS.codecHeapMiB);
+export class SourceMapCleanupFailure extends ProviderCleanupError {
+    cleanupOwner;
+    constructor(cleanupOwner, resources, diagnostics) {
+        super(PROVIDER, resources, diagnostics, { operation: OPERATION });
+        this.cleanupOwner = cleanupOwner;
+    }
+}
+/** Run a trusted codec command and release its process/root before returning output. */
+export const runSourceMapCommand = async (request, path, options, dependencies) => {
+    try {
+        await (dependencies.prepareOwnership ?? prepareProcessOwnershipInspection)(options?.signal);
+    }
+    catch (cause) {
+        return err(options?.signal?.aborted === true
+            ? new AnalysisCancelledError(OPERATION)
+            : new ProviderAdapterError(PROVIDER, OPERATION, {
+                cause,
+                diagnostics: {
+                    map_path: path,
+                    error_message: message(cause),
+                    phase: "process_ownership_preparation",
+                },
+            }));
+    }
+    const deadline = new ProviderStartupDeadline(WEB_SOURCE_MAP_LIMITS.decodeTimeoutMs, options?.signal);
+    const command = new OwnedCodec(path, dependencies, deadline);
+    let result;
+    try {
+        await command.start(request);
+        result = ok(await command.collect());
+    }
+    catch (cause) {
+        result = err(command.failure(cause));
+    }
+    finally {
+        deadline.dispose();
+    }
+    const cleanup = await command.close(result.ok ? null : result.error.message);
+    if (cleanup !== undefined)
+        return err(cleanup);
+    return result.ok && options?.signal?.aborted
+        ? err(new AnalysisCancelledError(OPERATION))
+        : result;
+};
+class OwnedCodec {
+    path;
+    dependencies;
+    deadline;
+    #runId = `rea-source-map-${randomUUID()}`;
+    #runtime;
+    #supervisor;
+    #oversized = false;
+    #processError;
+    constructor(path, dependencies, deadline) {
+        this.path = path;
+        this.dependencies = dependencies;
+        this.deadline = deadline;
+    }
+    async start(request) {
+        this.check();
+        this.#runtime = await (this.dependencies.createRuntime ??
+            (() => PrivateRuntimeRoot.create({ prefix: "rea-source-map-" })))();
+        this.check();
+        const requestPath = join(this.#runtime.path, "request.json");
+        await writeFile(requestPath, request, {
+            flag: "wx",
+            mode: 0o600,
+            signal: this.deadline.signal,
+        });
+        this.check();
+        const environment = {
+            ...(this.dependencies.environment ?? process.env),
+            UV_THREADPOOL_SIZE: "1",
+        };
+        delete environment.NODE_OPTIONS;
+        const spawned = await (this.dependencies.launcher ?? spawnOwnedProviderProcess)({
+            command: process.execPath,
+            arguments: [
+                `--max-old-space-size=${String(WEB_SOURCE_MAP_LIMITS.codecHeapMiB)}`,
+                "--max-semi-space-size=8",
+                "--v8-pool-size=1",
+                "--single-threaded",
+                "--stack_size=2048",
+                fileURLToPath(new URL("./SourceMapCodecProcess.js", import.meta.url)),
+                requestPath,
+            ],
+            runId: this.#runId,
+            cwd: this.#runtime.path,
+            hostEnvironment: environment,
+            ...(SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES === null
+                ? {}
+                : { memoryLimitBytes: SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES }),
+            signal: this.deadline.signal,
+        });
+        this.#supervisor = new ProviderProcessSupervisor({
+            ...spawned,
+            ownsProcessLifetime: true,
+            cleanup: spawned.cleanup ??
+                (() => cleanupOwnedProcessGroup(spawned.ownership)),
+        }, {
+            onDiagnostic: (event) => {
+                if (event.type === "error")
+                    this.#processError = event.message;
+                if (event.type === "output" &&
+                    event.totalBytes >
+                        (event.stream === "stdout"
+                            ? WEB_SOURCE_MAP_LIMITS.outputBytes
+                            : 1024 * 1024))
+                    this.#oversized = true;
+            },
+        });
+    }
+    async collect() {
+        const supervisor = this.#supervisor;
+        if (supervisor === undefined)
+            throw new Error("Codec process was not acquired");
+        while (!(await supervisor.waitForOutputClose(50)))
+            this.check();
+        this.check();
+        const snapshot = supervisor.snapshot();
+        // No partial codec result exists; a reached limit fails the whole trace.
+        if (snapshot.memoryLimitReached === true)
+            throw new AnalysisResourceConstraintError(OPERATION, "memory", `Source-map codec reached its ${SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES === null ? "" : `${String(SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES)}-byte `}process memory limit for ${this.path}; no partial evidence was returned.`, {
+                codec_process_memory_limit_bytes: SOURCE_MAP_CODEC_MEMORY_LIMIT_BYTES,
+            }, {
+                capturedOutput: {
+                    stdout: "",
+                    stderr: snapshot.stderr.text,
+                    truncated: snapshot.diagnosticTruncated ?? false,
+                },
+            });
+        if (snapshot.exitCode !== 0 || snapshot.signal !== null)
+            throw new ProviderAdapterError(PROVIDER, OPERATION, {
+                diagnostics: {
+                    map_path: this.path,
+                    exit_code: snapshot.exitCode ?? null,
+                    signal: snapshot.signal ?? null,
+                    stderr: snapshot.stderr.text,
+                },
+            });
+        return snapshot.stdout.text;
+    }
+    check() {
+        if (this.deadline.interruption === "cancelled")
+            throw new AnalysisCancelledError(OPERATION);
+        if (this.deadline.interruption === "timeout")
+            throw new AnalysisTimeoutError(OPERATION, WEB_SOURCE_MAP_LIMITS.decodeTimeoutMs);
+        if (this.#oversized)
+            throw new AnalysisOutputError(OPERATION, "Codec output exceeds its complete-evidence or diagnostic budget.");
+        if (this.#processError !== undefined)
+            throw new ProviderAdapterError(PROVIDER, OPERATION, {
+                diagnostics: { map_path: this.path, error_message: this.#processError },
+            });
+    }
+    failure(cause) {
+        if (this.deadline.interruption === "cancelled")
+            return new AnalysisCancelledError(OPERATION);
+        if (this.deadline.interruption === "timeout")
+            return new AnalysisTimeoutError(OPERATION, WEB_SOURCE_MAP_LIMITS.decodeTimeoutMs);
+        if (cause instanceof AnalysisError)
+            return cause;
+        return cause instanceof PrivateRuntimeRootUnavailableError
+            ? new AnalysisCapabilityUnavailableError(PROVIDER, OPERATION, cause.message, { cause })
+            : new ProviderAdapterError(PROVIDER, OPERATION, {
+                cause,
+                diagnostics: { map_path: this.path, error_message: message(cause) },
+            });
+    }
+    async close(previousError) {
+        const failures = [];
+        let processReleased = this.#supervisor === undefined;
+        if (this.#supervisor !== undefined) {
+            const stopped = await this.#supervisor.stop();
+            if (stopped.status === "incomplete")
+                failures.push(stopped.reason);
+            else {
+                processReleased = true;
+                this.#supervisor = undefined;
+            }
+        }
+        if (processReleased && this.#runtime !== undefined) {
+            try {
+                await this.#runtime.close();
+                this.#runtime = undefined;
+            }
+            catch (cause) {
+                failures.push(message(cause));
+            }
+        }
+        return failures.length === 0
+            ? undefined
+            : new SourceMapCleanupFailure(this, [
+                this.#runId,
+                ...(this.#runtime === undefined ? [] : [this.#runtime.path]),
+            ], {
+                map_path: this.path,
+                cleanup_failures: failures,
+                previous_error: previousError,
+                codec_pid: this.#supervisor?.launch.process.pid ?? null,
+            });
+    }
+}
+const message = (cause) => cause instanceof Error ? cause.message : String(cause);