stim 1.15.0 → 1.17.0

package/dist/{teardown-BYuQafiA.mjs → ownership-BMLqyBgJ.mjs}

@@ -1,22 +1,25 @@
 import { t as getExecutor } from "./exec-CaErVv7t.mjs";
-import { D as withConfigLock, H as projectDeviceSlots, _ as loadConfig, k as acquireAvdClaim, p as getProject, z as deviceSlotPlatforms } from "./config-D0DbpZtM.mjs";
+import { D as withConfigLock, H as projectDeviceSlots, _ as loadConfig, d as getConfigDir, k as acquireAvdClaim, p as getProject, z as deviceSlotPlatforms } from "./config-D0DbpZtM.mjs";
 import { n as ownership_claim_exports, t as process_identity_exports } from "./process-identity-BmRm1qV0.mjs";
-import { b as workspaceDir } from "./workspace-state-CL2V2Ons.mjs";
-import { y as repoRoot } from "./worktree-C0c5Udwa.mjs";
-import { t as withWorkspaceProcessLock } from "./workspace-process-lock-BL7Q0HCO.mjs";
-import { o as readAgentDeviceRecords } from "./activity-B2-kb7k0.mjs";
-import { l as phaseLine } from "./command-output-CliHHn7a.mjs";
-import { B as ownedAvdSystemImage, I as ownedAvdDirectory, J as resolveOwnedAvdSerial, L as ownedAvdMatchesConfiguration, M as listOrphanedAvdDirectories, O as listAdbDevices, X as shutdownAndroidEmulator, Z as sleepSync, _ as avdStorageRoots, ct as eraseParkedAfter, et as waitForAndroidEmulatorShutdown, f as assertOwnedAvdStopped, ft as readParked, h as avdPathExists, nt as wipeAvdUserData, pt as removeParkedAfter, rt as isStimOwnedAvd, ut as parkSim, x as deleteAvd } from "./android-Db2eEMaf.mjs";
-import { n as readCreatedDevices, r as recordCreatedDevice, t as forgetCreatedDevice } from "./created-devices-BwVb3liH.mjs";
-import { u as signalProcessTree } from "./metro-Di8EN2Tb.mjs";
-import { r as releaseBrowserPort } from "./named-ports-Dj_XBNaL.mjs";
-import { _ as removeSingletonFiles, c as webClaimRoot, f as webProfileDir, g as liveProfileHolder, h as chromeProcessState, i as clearWebRecord, o as readWebRecord, t as CDP_PORT_LABEL } from "./state-DFm77wRn.mjs";
-import { E as shutdownIosSim, _ as parseRuntimeVersion, a as deleteIosSim, b as renameIosSim, f as listIosDeviceTypes, g as parkedSimName, o as deleteParkedIosSim, s as eraseIosSim, w as resolveOwnedIosSim } from "./ios-3CtCRhwr.mjs";
-import { randomUUID } from "node:crypto";
-import { existsSync, lstatSync, realpathSync, renameSync, rmSync } from "node:fs";
-import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
+import { l as phaseLine } from "./command-output-CDAIFD-8.mjs";
+import { gt as repoRoot, q as resolveTailscaleBinary } from "./settings-Cfd-0r2d.mjs";
+import { o as pidExists, u as signalProcessTree } from "./metro-g8NqiJp-.mjs";
+import { g as workspaceAgentDeviceDir, v as workspaceDir } from "./workspace-state-DqcCbpE7.mjs";
+import { _ as removeSingletonFiles, c as webClaimRoot, f as webProfileDir, g as liveProfileHolder, h as chromeProcessState, i as clearWebRecord, o as readWebRecord, t as CDP_PORT_LABEL } from "./state-PeQiJuIu.mjs";
+import { t as agentDeviceDaemon, u as readAgentDeviceRecords } from "./activity-IRvJY_ru.mjs";
+import { n as readCreatedDevices, r as recordCreatedDevice, t as forgetCreatedDevice } from "./created-devices-CpvzBL25.mjs";
+import { B as ownedAvdSystemImage, I as ownedAvdDirectory, J as resolveOwnedAvdSerial, L as ownedAvdMatchesConfiguration, M as listOrphanedAvdDirectories, O as listAdbDevices, X as shutdownAndroidEmulator, Z as sleepSync, _ as avdStorageRoots, dt as parkSim, et as waitForAndroidEmulatorShutdown, f as assertOwnedAvdStopped, h as avdPathExists, it as isStimOwnedAvd, lt as eraseParkedAfter, mt as removeParkedAfter, nt as wipeAvdUserData, pt as readParked, x as deleteAvd } from "./android-B_YNZy61.mjs";
+import { E as shutdownIosSim, _ as parseRuntimeVersion, a as deleteIosSim, b as renameIosSim, f as listIosDeviceTypes, g as parkedSimName, o as deleteParkedIosSim, s as eraseIosSim, w as resolveOwnedIosSim } from "./ios-DSfnPfse.mjs";
+import { r as workspaceProcessLockPath, t as withWorkspaceProcessLock } from "./workspace-process-lock-2mNzOlaB.mjs";
+import { r as releaseBrowserPort } from "./named-ports-C8m8EQs2.mjs";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, unlinkSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { isDeepStrictEqual } from "node:util";
+import { resolve4 } from "node:dns/promises";
+import { request } from "node:https";
 //#region src/devices/agent-device-cleanup.ts
 function parseAgentDeviceSessions(output) {
 	const result = JSON.parse(output);
@@ -59,31 +62,23 @@ function deviceClaims(device) {
 		workspace: record.workspace && canonical(record.workspace)
 	}));
 }
+function explainFailure(error) {
+	const stdout = error?.stdout;
+	let failure;
+	try {
+		failure = typeof stdout === "string" ? JSON.parse(stdout)?.error : void 0;
+	} catch {
+		failure = void 0;
+	}
+	if (typeof failure?.message !== "string" || !failure.message) return error;
+	const reason = typeof failure.details?.reason === "string" ? ` (${failure.details.reason})` : "";
+	return /* @__PURE__ */ new Error(`agent-device refused: ${failure.message}${reason}`);
+}
 function report(message) {
 	process.stderr.write(`${phaseLine("device", message)}\n`);
 }
 function closeOwnedDeviceSessions(device, stillOwned, workspace, repoRoot) {
 	const exec = getExecutor();
-	const deadline = Date.now() + 15e3;
-	const run = (args) => {
-		const remaining = deadline - Date.now();
-		if (remaining <= 0) throw new Error("agent-device cleanup timed out");
-		return exec.runFile("agent-device", [
-			...args,
-			"--json",
-			"--daemon-transport",
-			"socket"
-		], {
-			timeoutMs: Math.min(5e3, remaining),
-			killSignal: "SIGKILL"
-		});
-	};
-	const list = () => parseAgentDeviceSessions(run([
-		"session",
-		"list",
-		"--session",
-		"stim-teardown-inventory"
-	]));
 	try {
 		if (!exec.findExecutable("agent-device")) return;
 		const root = workspace === void 0 ? void 0 : canonical(workspace);
@@ -93,24 +88,57 @@ function closeOwnedDeviceSessions(device, stillOwned, workspace, repoRoot) {
 			repoRoot: repoRoot && (canonical(repoRoot) ?? void 0),
 			claims: deviceClaims(device)
 		};
-		const sessions = list().filter((session) => isOwnDeviceSession(session, device, owner));
-		for (const session of sessions) try {
-			if (!list().some((current) => current.name === session.name && current.platform === session.platform && current.id === session.id && current.createdAt === session.createdAt)) continue;
-			if (!stillOwned(session.id)) continue;
-			if (JSON.parse(run([
-				"close",
+		const stateDir = root === void 0 ? void 0 : workspaceAgentDeviceDir(root);
+		const stateDirs = [void 0, ...stateDir && !["none", "dead"].includes(agentDeviceDaemon(stateDir)) ? [stateDir] : []];
+		for (const dir of stateDirs) {
+			const deadline = Date.now() + 15e3;
+			const run = (args) => {
+				const remaining = deadline - Date.now();
+				if (remaining <= 0) throw new Error("agent-device cleanup timed out");
+				try {
+					return exec.runFile("agent-device", [
+						...args,
+						...dir ? ["--state-dir", dir] : [],
+						"--json",
+						"--daemon-transport",
+						"socket"
+					], {
+						timeoutMs: Math.min(5e3, remaining),
+						killSignal: "SIGKILL"
+					});
+				} catch (error) {
+					throw explainFailure(error);
+				}
+			};
+			const list = () => parseAgentDeviceSessions(run([
+				"session",
+				"list",
 				"--session",
-				session.name,
-				"--session-lock",
-				"reject",
-				"--platform",
-				device.platform,
-				device.platform === "ios" ? "--udid" : "--serial",
-				session.id
-			]))?.success !== true) throw new Error("agent-device did not confirm session close");
-			report(`closed agent-device session ${session.name} on ${session.id}`);
-		} catch (error) {
-			report(`could not close agent-device session ${session.name} on ${session.id}: ${error.message}`);
+				"stim-teardown-inventory"
+			]));
+			try {
+				const sessions = list().filter((session) => isOwnDeviceSession(session, device, owner));
+				for (const session of sessions) try {
+					if (!list().some((current) => current.name === session.name && current.platform === session.platform && current.id === session.id && current.createdAt === session.createdAt)) continue;
+					if (!stillOwned(session.id)) continue;
+					if (JSON.parse(run([
+						"close",
+						"--session",
+						session.name,
+						"--session-lock",
+						"reject",
+						"--platform",
+						device.platform,
+						device.platform === "ios" ? "--udid" : "--serial",
+						session.id
+					]))?.success !== true) throw new Error("agent-device did not confirm session close");
+					report(`closed agent-device session ${session.name} on ${session.id}`);
+				} catch (error) {
+					report(`could not close agent-device session ${session.name} on ${session.id}: ${error.message}`);
+				}
+			} catch (error) {
+				report(`could not list agent-device sessions for ${device.platform === "ios" ? device.id : device.id ?? device.avdName}: ${error.message}`);
+			}
 		}
 	} catch (error) {
 		report(`could not list agent-device sessions for ${device.platform === "ios" ? device.id : device.id ?? device.avdName}: ${error.message}`);
@@ -715,4 +743,562 @@ async function teardownBrowserHeld(root, { deleteProfile = false } = {}) {
 	}
 }
 //#endregion
-export { teardownOwnedBrowser as a, teardownParkedIosSim as c, teardownOwnedAvd as i, eraseParkedIosSim as n, teardownOwnedIosSim as o, teardownBrowserHeld as r, teardownParkedAvd as s, eraseParkedAvd as t };
+//#region src/engine/public-http-probe.ts
+const DNS_TIMEOUT_MS = 5e3;
+async function resolveAddresses(hostname, signal) {
+	if (signal.aborted) throw signal.reason;
+	let timer;
+	let onAbort;
+	const unavailable = new Promise((_resolve, reject) => {
+		onAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) onAbort();
+		else timer = setTimeout(() => reject(/* @__PURE__ */ new Error("DNS lookup timed out")), DNS_TIMEOUT_MS);
+	});
+	try {
+		return await Promise.race([resolve4(hostname), unavailable]);
+	} finally {
+		clearTimeout(timer);
+		if (onAbort) signal.removeEventListener("abort", onAbort);
+	}
+}
+async function probePublicHttp(url, signal) {
+	try {
+		return (await fetch(url, {
+			signal,
+			redirect: "follow"
+		})).status;
+	} catch (error) {
+		const cause = error?.cause;
+		if (cause?.code !== "ENOTFOUND" && cause?.code !== "EAI_AGAIN") return null;
+	}
+	const hostname = new URL(url).hostname;
+	if (!hostname.endsWith(".trycloudflare.com")) return null;
+	let addresses;
+	try {
+		addresses = await resolveAddresses(hostname, signal);
+	} catch {
+		return null;
+	}
+	const firstAddress = addresses[0];
+	if (!firstAddress) return null;
+	return new Promise((resolve) => {
+		const request$1 = request(url, {
+			signal,
+			lookup: (_hostname, options, callback) => {
+				if (options.all) callback(null, addresses.map((address) => ({
+					address,
+					family: 4
+				})));
+				else callback(null, firstAddress, 4);
+			}
+		}, (response) => {
+			response.resume();
+			resolve(response.statusCode ?? null);
+		});
+		request$1.on("error", () => resolve(null));
+		request$1.end();
+	});
+}
+//#endregion
+//#region src/engine/tunnel.ts
+function tunnelArgv(provider, port, ngrokUrl, logFile, tailscaleBinary = "tailscale") {
+	if (provider === "tailscale") return {
+		bin: tailscaleBinary,
+		args: [
+			"serve",
+			`--https=${port}`,
+			`http://127.0.0.1:${port}`
+		]
+	};
+	if (provider === "cloudflared") return {
+		bin: "cloudflared",
+		args: [
+			"tunnel",
+			"--url",
+			`http://127.0.0.1:${port}`,
+			...logFile ? ["--logfile", logFile] : []
+		]
+	};
+	return {
+		bin: "ngrok",
+		args: [
+			"http",
+			String(port),
+			`--log=${logFile || "stdout"}`,
+			"--log-format=json",
+			...ngrokUrl ? ["--url", ngrokUrl] : []
+		]
+	};
+}
+const CLOUDFLARED_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+function parseCloudflaredLine(line) {
+	const match = line.match(CLOUDFLARED_URL_RE);
+	return match ? match[0] : null;
+}
+function parseNgrokLine(line) {
+	let data;
+	try {
+		data = JSON.parse(line);
+	} catch {
+		return null;
+	}
+	if (typeof data !== "object" || data === null) return null;
+	const url = data.url;
+	return typeof url === "string" && /^https?:\/\//i.test(url) ? url : null;
+}
+function parseTailscaleLine(line) {
+	return /^https:\/\/[^\s/]+\.ts\.net(:\d+)?\/?$/.test(line) ? line : null;
+}
+function parserFor(provider) {
+	if (provider === "tailscale") return parseTailscaleLine;
+	return provider === "cloudflared" ? parseCloudflaredLine : parseNgrokLine;
+}
+const URL_TIMEOUT_MS = 15e3;
+const REACHABLE_TIMEOUT_MS = 24e4;
+const REACHABLE_POLL_MS = 2e3;
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function withManagedTunnelLock(root, fn, options = {}) {
+	return withWorkspaceProcessLock(managedTunnelLockRoot(root), "metro-tunnel", fn, {
+		...options,
+		rejectOwnerPurposes: ["workspace removal"]
+	});
+}
+async function withManagedTunnelRemovalLock(root, fn, options = {}) {
+	return withWorkspaceProcessLock(managedTunnelLockRoot(root), "metro-tunnel", fn, {
+		...options,
+		ownerPurpose: "workspace removal"
+	});
+}
+async function withManagedRemoteWorktreeLock(worktreeRoot, fn, options = {}) {
+	return withWorkspaceProcessLock(managedRemoteWorktreeLockRoot(worktreeRoot), "managed-remote", fn, {
+		...options,
+		external: true,
+		rejectOwnerPurposes: ["worktree removal"]
+	});
+}
+async function withManagedRemoteWorktreeRemovalLock(worktreeRoot, fn, options = {}) {
+	return withWorkspaceProcessLock(managedRemoteWorktreeLockRoot(worktreeRoot), "managed-remote", fn, {
+		...options,
+		external: true,
+		ownerPurpose: "worktree removal"
+	});
+}
+function managedLockHolders(root) {
+	const locks = [{
+		label: "managed tunnel",
+		path: workspaceProcessLockPath(managedTunnelLockRoot(root), "metro-tunnel", false)
+	}, {
+		label: "managed remote",
+		path: workspaceProcessLockPath(managedRemoteWorktreeLockRoot(root), "managed-remote", true)
+	}];
+	const reasons = [];
+	for (const { label, path } of locks) {
+		const claims = (0, ownership_claim_exports.readClaimSet)(path);
+		const holder = claims.live[0];
+		if (holder) {
+			const purpose = typeof holder.details.purpose === "string" ? ` for ${holder.details.purpose}` : "";
+			reasons.push(`the ${label} lock is held${purpose}`);
+		} else if (claims.unresolved[0]) reasons.push(`the ${label} lock cannot be resolved: ${claims.unresolved[0].reason}`);
+	}
+	return reasons;
+}
+function managedTunnelLockRoot(root) {
+	const key = createHash("sha256").update(resolve(root)).digest("hex");
+	return join(getConfigDir(), "process-locks", key);
+}
+function managedRemoteWorktreeLockRoot(worktreeRoot) {
+	const key = createHash("sha256").update(resolve(worktreeRoot)).digest("hex");
+	return join(getConfigDir(), "process-locks", "worktrees", key);
+}
+async function defaultProbeReachable(url, signal) {
+	const status = await probePublicHttp(url, signal);
+	return status !== null && status > 0;
+}
+function waitForUrl(child, parseLine, timeoutMs) {
+	return new Promise((resolve) => {
+		let settled = false;
+		let lastLine = null;
+		let timer;
+		let onOut;
+		let onErr;
+		let onError;
+		let onExit;
+		const finish = (url, exited = false) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			child.stdout?.removeListener("data", onOut);
+			child.stderr?.removeListener("data", onErr);
+			child.removeListener("error", onError);
+			child.removeListener("exit", onExit);
+			resolve({
+				url,
+				exited,
+				lastLine
+			});
+		};
+		const onLine = (line) => {
+			if (settled) return;
+			if (line.trim()) lastLine = line.trim();
+			const url = parseLine(line);
+			if (url) finish(url);
+		};
+		const outReader = createLineReader(onLine);
+		const errReader = createLineReader(onLine);
+		onOut = (chunk) => outReader.push(chunk);
+		onErr = (chunk) => errReader.push(chunk);
+		onError = () => finish(null);
+		onExit = () => {
+			outReader.flush();
+			errReader.flush();
+			finish(null, true);
+		};
+		child.stdout?.setEncoding?.("utf-8");
+		child.stderr?.setEncoding?.("utf-8");
+		child.stdout?.on("data", onOut);
+		child.stderr?.on("data", onErr);
+		child.on("error", onError);
+		child.on("exit", onExit);
+		timer = setTimeout(() => finish(null), timeoutMs);
+	});
+}
+function waitForFileUrl(child, logFile, parseLine, timeoutMs) {
+	return new Promise((resolve) => {
+		let settled = false;
+		const finish = (url, exited = false) => {
+			if (settled) return;
+			settled = true;
+			clearInterval(interval);
+			clearTimeout(timer);
+			child.removeListener("error", onError);
+			child.removeListener("exit", onExit);
+			resolve({
+				url,
+				exited
+			});
+		};
+		const probe = () => {
+			try {
+				for (const line of readFileSync(logFile, "utf-8").split(/\r?\n/)) {
+					const url = parseLine(line);
+					if (url) return finish(url);
+				}
+			} catch {}
+		};
+		const onError = () => finish(null);
+		const onExit = () => finish(null, true);
+		child.on("error", onError);
+		child.on("exit", onExit);
+		const interval = setInterval(probe, 25);
+		const timer = setTimeout(() => finish(null), timeoutMs);
+		probe();
+	});
+}
+function createTunnelLogFile(provider) {
+	const dir = join(getConfigDir(), "tunnel-logs");
+	mkdirSync(dir, { recursive: true });
+	const path = join(dir, `${provider}-${randomUUID()}.log`);
+	closeSync(openSync(path, "wx", 384));
+	return path;
+}
+function removeTunnelLogFile(path) {
+	if (!path) return;
+	try {
+		unlinkSync(path);
+	} catch {}
+}
+function removeRecordedTunnelLogFile(path) {
+	if (!path) return;
+	const dir = resolve(join(getConfigDir(), "tunnel-logs"));
+	const resolved = resolve(path);
+	if (!resolved.startsWith(`${dir}${sep}`) || resolve(join(dir, basename(resolved))) !== resolved) return;
+	removeTunnelLogFile(resolved);
+}
+async function waitUntilReachable({ url, now, sleep, probe, timeoutMs }) {
+	const deadline = now() + timeoutMs;
+	for (;;) {
+		if (await probe(url, new AbortController().signal).catch(() => false)) return true;
+		if (now() >= deadline) return false;
+		await sleep(REACHABLE_POLL_MS);
+	}
+}
+const CLEANUP_TIMEOUT_MS = 1e3;
+const CLEANUP_POLL_MS = 25;
+async function startTunnel({ provider, port, spawnFn = null, urlTimeoutMs = URL_TIMEOUT_MS, reachableTimeoutMs = REACHABLE_TIMEOUT_MS, probeReachable = defaultProbeReachable, now = Date.now, sleep = defaultSleep, ngrokUrl = null, requireReachable = true, cleanupTimeoutMs = CLEANUP_TIMEOUT_MS, isChildAlive = pidExists, readProcessToken = process_identity_exports.captureProcessToken, logFile = null }) {
+	const spawn = spawnFn || ((cmd, args, opts) => getExecutor().spawn(cmd, args, opts));
+	const outputFile = provider === "tailscale" ? null : logFile || (spawnFn ? null : createTunnelLogFile(provider));
+	let child;
+	try {
+		const binary = provider === "tailscale" ? resolveTailscaleBinary((bin) => getExecutor().findExecutable(bin)) : provider;
+		if (!binary) throw new Error("Install Tailscale and sign in to your tailnet.");
+		const { bin, args } = tunnelArgv(provider, port, ngrokUrl, outputFile, binary);
+		child = spawn(bin, args, {
+			stdio: outputFile ? [
+				"ignore",
+				"ignore",
+				"ignore"
+			] : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			detached: true
+		});
+	} catch (err) {
+		removeTunnelLogFile(outputFile);
+		return {
+			failed: true,
+			reason: `Could not start ${provider}: ${describe(err)}`
+		};
+	}
+	let childExited = false;
+	child.once("exit", () => {
+		childExited = true;
+	});
+	const cleanup = async (alreadyExited = childExited) => {
+		const stopped = await terminateChild(child, {
+			alreadyExited,
+			timeoutMs: cleanupTimeoutMs,
+			now,
+			sleep,
+			isAlive: isChildAlive
+		});
+		if (stopped) removeTunnelLogFile(outputFile);
+		return stopped ? { status: "stopped" } : {
+			status: "failed",
+			reason: `Sent SIGKILL but could not confirm that pid ${child.pid ?? "unknown"} exited.`
+		};
+	};
+	const failAfterCleanup = async (reason, alreadyExited = childExited) => {
+		const stopped = await cleanup(alreadyExited);
+		return stopped.status === "stopped" ? {
+			failed: true,
+			reason
+		} : {
+			failed: true,
+			reason: `${reason} ${stopped.reason}`,
+			cleanupFailed: true
+		};
+	};
+	const pid = child.pid;
+	if (!pid) return failAfterCleanup(`${provider} started but reported no pid.`);
+	const captureChildIdentity = () => {
+		try {
+			return readProcessToken(pid);
+		} catch {
+			return null;
+		}
+	};
+	const initialProcessToken = captureChildIdentity();
+	if (!initialProcessToken) return failAfterCleanup(`${provider} started but its process identity token could not be read.`);
+	const { url, exited, lastLine } = outputFile ? await waitForFileUrl(child, outputFile, parserFor(provider), urlTimeoutMs) : await waitForUrl(child, parserFor(provider), urlTimeoutMs);
+	if (!url) return failAfterCleanup(exited ? provider === "tailscale" && lastLine ? `${provider} exited before printing a tunnel URL: ${lastLine}` : `${provider} exited before printing a tunnel URL.` : `${provider} did not print a tunnel URL within ${urlTimeoutMs}ms.`, exited || childExited);
+	if (!outputFile) resumeChildPipes(child);
+	if (requireReachable) {
+		if (!await waitUntilReachable({
+			url,
+			now,
+			sleep,
+			probe: probeReachable,
+			timeoutMs: reachableTimeoutMs
+		})) return failAfterCleanup(`${url} did not become reachable within ${reachableTimeoutMs}ms; ${provider} may still be registering, or the network path is blocked.`);
+	}
+	const finalProcessToken = captureChildIdentity();
+	if (!finalProcessToken || finalProcessToken !== initialProcessToken) return failAfterCleanup(`${provider} process identity changed before its tunnel could be recorded.`);
+	if (!outputFile) unrefChildPipes(child);
+	child.unref?.();
+	if (childExited) return failAfterCleanup(`${provider} exited before its tunnel could be recorded.`, true);
+	return {
+		url,
+		pid,
+		processToken: initialProcessToken,
+		logFile: outputFile,
+		cleanup: () => cleanup()
+	};
+}
+async function startTunnelSequence({ providers, port, ngrokUrl = null, requireReachable = true, start = startTunnel }) {
+	const failures = [];
+	for (const provider of providers) {
+		const result = await start({
+			provider,
+			port,
+			ngrokUrl: provider === "ngrok" ? ngrokUrl : null,
+			requireReachable
+		});
+		if (!("failed" in result)) return {
+			provider,
+			...result
+		};
+		failures.push(`${provider}: ${result.reason}`);
+		if (result.cleanupFailed) return {
+			failed: true,
+			reason: failures.join(" ")
+		};
+	}
+	return {
+		failed: true,
+		reason: failures.join(" ") || "No managed tunnel provider was selected."
+	};
+}
+function closeChildPipes(child) {
+	child.stdout?.destroy?.();
+	child.stderr?.destroy?.();
+}
+function unrefChildPipes(child) {
+	resumeChildPipes(child);
+	for (const stream of [child.stdout, child.stderr]) stream?.unref?.();
+}
+function resumeChildPipes(child) {
+	child.stdout?.resume?.();
+	child.stderr?.resume?.();
+}
+async function signalAndWaitForExit(child, signal, { timeoutMs, now, sleep, isAlive, platform }) {
+	let exited = false;
+	const onExit = () => {
+		exited = true;
+	};
+	child.once("exit", onExit);
+	try {
+		if (platform === "win32" && child.pid) signalProcessTree(child.pid, signal, { platform });
+		child.kill(signal);
+	} catch (err) {
+		child.removeListener("exit", onExit);
+		return isEsrch(err);
+	}
+	const hasExited = () => exited;
+	const deadline = now() + timeoutMs;
+	while (!hasExited() && now() < deadline) await sleep(CLEANUP_POLL_MS);
+	if (!hasExited() && child.pid && !isAlive(child.pid)) exited = true;
+	child.removeListener("exit", onExit);
+	return hasExited();
+}
+async function terminateChild(child, { alreadyExited, timeoutMs, now, sleep, isAlive, platform = process.platform }) {
+	if (alreadyExited) {
+		closeChildPipes(child);
+		return true;
+	}
+	if (await signalAndWaitForExit(child, "SIGTERM", {
+		timeoutMs,
+		now,
+		sleep,
+		isAlive,
+		platform
+	})) {
+		closeChildPipes(child);
+		return true;
+	}
+	const killed = await signalAndWaitForExit(child, "SIGKILL", {
+		timeoutMs,
+		now,
+		sleep,
+		isAlive,
+		platform
+	});
+	closeChildPipes(child);
+	return killed;
+}
+function describe(err) {
+	return err?.message || String(err);
+}
+const STOP_TIMEOUT_MS = 5e3;
+const STOP_POLL_MS = 100;
+function isEsrch(err) {
+	return err?.code === "ESRCH";
+}
+async function stopTunnel(record, { isAlive = pidExists, inspectIdentity = process_identity_exports.inspectProcessIdentity, platform = process.platform, kill = (pid) => signalProcessTree(pid, "SIGTERM", { platform }), now = Date.now, sleep = defaultSleep, timeoutMs = STOP_TIMEOUT_MS } = {}) {
+	const missing = () => {
+		removeRecordedTunnelLogFile(record?.logFile);
+		return { status: "missing" };
+	};
+	const pid = record?.pid;
+	if (!pid || !isAlive(pid)) return missing();
+	if (!record.processToken) return {
+		status: "failed",
+		reason: `tunnel pid ${pid} has no process identity token, so Stim cannot verify ownership. Keep the record. Inspect the process, stop it with the provider tooling, remove the stale metroTunnel state, and retry.`
+	};
+	const identity = inspectIdentity(record);
+	if (identity === "gone" || identity === "different") return missing();
+	if (identity !== "same") return {
+		status: "failed",
+		reason: `could not verify the process identity for tunnel pid ${pid}; refusing to signal it.`
+	};
+	try {
+		kill(pid);
+	} catch (err) {
+		return isEsrch(err) ? missing() : {
+			status: "failed",
+			reason: describe(err)
+		};
+	}
+	const deadline = now() + timeoutMs;
+	const exited = () => {
+		if (!isAlive(pid)) return true;
+		const current = inspectIdentity(record);
+		return current === "gone" || current === "different";
+	};
+	while (now() < deadline && !exited()) await sleep(STOP_POLL_MS);
+	if (!exited()) return {
+		status: "failed",
+		reason: `pid ${pid} did not exit within ${timeoutMs}ms.`
+	};
+	removeRecordedTunnelLogFile(record.logFile);
+	return { status: "stopped" };
+}
+//#endregion
+//#region src/supervisor/ownership.ts
+function resolveSupervisorTarget({ state, record, reservedPort, isAlive = pidExists, inspectIdentity = process_identity_exports.inspectProcessIdentity } = {}) {
+	const statePid = numberOrNull(state?.pid);
+	const recordPid = numberOrNull(record?.pid);
+	const pid = statePid ?? recordPid;
+	if (!pid) return { status: "none" };
+	if (statePid && recordPid && statePid !== recordPid) return {
+		status: "unverified",
+		pid,
+		reason: `workspace state.json records supervisor pid ${statePid} but the registry records pid ${recordPid}`
+	};
+	if (!isAlive(pid)) return {
+		status: "stale",
+		pid
+	};
+	const port = numberOrNull(state?.port) ?? numberOrNull(record?.port);
+	if (reservedPort !== null && reservedPort !== void 0 && port !== null && port !== reservedPort) return {
+		status: "unverified",
+		pid,
+		reason: `supervisor pid ${pid} records port ${port}, but this project reserved port ${reservedPort}`
+	};
+	if (reservedPort !== null && reservedPort !== void 0 && port === null) return {
+		status: "unverified",
+		pid,
+		reason: `supervisor pid ${pid} has no recorded port, so it cannot be matched against reserved port ${reservedPort}`
+	};
+	const identityRecord = statePid ? state : record;
+	if (statePid && recordPid && state?.processToken !== record?.processToken) return {
+		status: "unverified",
+		pid,
+		reason: "workspace state and registry process identities disagree"
+	};
+	const identity = inspectIdentity(identityRecord);
+	if (identity === "gone" || identity === "different") return {
+		status: "stale",
+		pid
+	};
+	if (identity !== "same") return {
+		status: "unverified",
+		pid,
+		reason: "the recorded process identity could not be verified"
+	};
+	return {
+		status: "ours",
+		processToken: identityRecord.processToken,
+		pid,
+		port,
+		mode: state?.mode ?? record?.mode ?? null,
+		startedAt: state?.startedAt ?? record?.startedAt ?? null
+	};
+}
+function numberOrNull(v) {
+	return typeof v === "number" && Number.isSafeInteger(v) && v > 0 ? v : null;
+}
+//#endregion
+export { teardownParkedAvd as _, terminateChild as a, withManagedTunnelLock as c, eraseParkedAvd as d, eraseParkedIosSim as f, teardownOwnedIosSim as g, teardownOwnedBrowser as h, stopTunnel as i, withManagedTunnelRemovalLock as l, teardownOwnedAvd as m, managedLockHolders as n, withManagedRemoteWorktreeLock as o, teardownBrowserHeld as p, startTunnelSequence as r, withManagedRemoteWorktreeRemovalLock as s, resolveSupervisorTarget as t, probePublicHttp as u, teardownParkedIosSim as v };