stim 1.20.2 → 1.22.0

package/dist/exec-DEoAhcze.mjs

@@ -0,0 +1,858 @@
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { ambientContext, ambientEnv } from "@stim-cli/core";
+import { createDebugLog, runId } from "@stim-cli/core/state";
+import { basename as basename$1, delimiter as delimiter$1, resolve as resolve$1 } from "path";
+import { execSync } from "child_process";
+import spawn from "cross-spawn";
+import which from "which";
+import { fileURLToPath } from "node:url";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+//#endregion
+//#region src/ownership-claim.ts
+var ownership_claim_exports = /* @__PURE__ */ __exportAll({});
+import * as import__stim_cli_core_ownership_claim from "@stim-cli/core/ownership-claim";
+__reExport(ownership_claim_exports, import__stim_cli_core_ownership_claim);
+//#endregion
+//#region src/debug-log.ts
+const debugLog = createDebugLog("cli", { base: () => ({ runId: runId() }) });
+//#endregion
+//#region src/report-runtime.ts
+const reports = /* @__PURE__ */ new WeakMap();
+function reportSignal(context) {
+	return context && reports.has(context) ? context.signal : void 0;
+}
+function trackReportResource(context, closed, cancel, signal = context?.signal, cleanupFailure) {
+	const state = context && reports.get(context);
+	if (!context || !state || !signal) return;
+	const { pending } = state;
+	const abort = () => {
+		const cancelled = Promise.resolve().then(cancel);
+		pending.set(cancelled, cleanupFailure);
+		cancelled.then(() => pending.delete(cancelled), (error) => {
+			state.failure ??= error;
+			pending.delete(cancelled);
+			pending.delete(closed);
+			signal.removeEventListener("abort", abort);
+			state.abort(error);
+		});
+	};
+	pending.set(closed, cleanupFailure);
+	const settled = () => {
+		signal.removeEventListener("abort", abort);
+		pending.delete(closed);
+	};
+	closed.then(settled, (error) => {
+		state.failure ??= error;
+		settled();
+		state.abort(error);
+	});
+	signal.addEventListener("abort", abort, { once: true });
+	if (signal.aborted) abort();
+}
+async function runReport(context, work, timeoutMs = 6e4) {
+	const controller = new AbortController();
+	const signal = AbortSignal.any([context.signal, controller.signal]);
+	const operation = {
+		...context,
+		signal,
+		output: ((stream, text) => {
+			if (!signal.aborted) context.output(stream, text);
+		})
+	};
+	const pending = /* @__PURE__ */ new Map();
+	const state = {
+		pending,
+		abort: (reason) => controller.abort(reason)
+	};
+	reports.set(operation, state);
+	const deadline = performance.now() + timeoutMs;
+	const expire = () => {
+		controller.abort(Object.assign(/* @__PURE__ */ new Error(`The report exceeded its ${timeoutMs / 1e3} second budget.`), { code: "STIM_REPORT_TIMEOUT" }));
+	};
+	const timer = setTimeout(expire, timeoutMs);
+	let rejectCancellation;
+	const cancelled = new Promise((_, reject) => {
+		rejectCancellation = reject;
+	});
+	const abort = () => rejectCancellation(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	const outcome = await (async () => {
+		try {
+			signal.throwIfAborted();
+			const result = await Promise.race([work(operation), cancelled]);
+			if (performance.now() >= deadline) expire();
+			signal.throwIfAborted();
+			return { result };
+		} catch (error) {
+			return { error };
+		}
+	})().finally(async () => {
+		clearTimeout(timer);
+		signal.removeEventListener("abort", abort);
+		controller.abort();
+		const cleanupDeadline = performance.now() + 35e3;
+		const expireCleanup = () => {
+			state.failure ??= [...pending.values()].find((failure) => failure !== void 0) ?? Object.assign(/* @__PURE__ */ new Error("Report cleanup did not finish within 35 seconds."), {
+				code: "STIM_CLAIM_UNAVAILABLE",
+				reportCleanup: true
+			});
+		};
+		let cleanupTimer;
+		try {
+			await Promise.race([(async () => {
+				while (pending.size) await Promise.allSettled(pending.keys());
+			})(), new Promise((resolve) => {
+				cleanupTimer = setTimeout(() => {
+					expireCleanup();
+					resolve();
+				}, 35e3);
+			})]);
+			if (performance.now() >= cleanupDeadline) expireCleanup();
+		} finally {
+			clearTimeout(cleanupTimer);
+		}
+	});
+	if ("failure" in state) throw state.failure;
+	if ("error" in outcome) throw outcome.error;
+	return outcome.result;
+}
+//#endregion
+//#region src/process-identity.ts
+var process_identity_exports = /* @__PURE__ */ __exportAll({});
+import * as import__stim_cli_core_process_identity from "@stim-cli/core/process-identity";
+__reExport(process_identity_exports, import__stim_cli_core_process_identity);
+//#endregion
+//#region src/engine/operation-state.ts
+const states = /* @__PURE__ */ new WeakMap();
+let detached;
+function fresh() {
+	return {
+		cancelled: null,
+		runSignal: void 0,
+		declaring: /* @__PURE__ */ new Set(),
+		running: /* @__PURE__ */ new Set(),
+		refusal: null,
+		handled: false,
+		draining: false,
+		exitCleanups: /* @__PURE__ */ new Set(),
+		buildMachineFlag: void 0,
+		takesSignals: false,
+		abortOperation: void 0
+	};
+}
+/** The state of `context`'s operation; code that is not passed a context yet shares one state per process. */
+function operationState(context) {
+	if (!context) return detached ??= fresh();
+	let state = states.get(context);
+	if (!state) {
+		state = fresh();
+		states.set(context, state);
+	}
+	return state;
+}
+/** Whether an abort reason asks the operation to terminate rather than interrupt it. */
+function isTermination(reason) {
+	return reason === "SIGTERM";
+}
+/** Keeps asynchronous work unwinding on the CLI's first interrupt until its owned work has settled. */
+async function withDrainingCancellation(context, signal, work) {
+	if (!context) return work();
+	const abort = () => {
+		const state = operationState(context);
+		state.handled = true;
+		if (!isTermination(context.signal.reason)) state.draining = true;
+	};
+	signal?.addEventListener("abort", abort, { once: true });
+	if (signal?.aborted) abort();
+	try {
+		return await work();
+	} finally {
+		signal?.removeEventListener("abort", abort);
+	}
+}
+//#endregion
+//#region src/engine/spawn-claims.ts
+/**
+* Record every child `context`'s operation later starts through `spawnDeclared` on `claim` until
+* `stopDeclaringSpawnsOn(context, claim)`.
+*/
+function declareSpawnsOn(context, claim) {
+	if (claim) operationState(context).declaring.add(claim);
+}
+function stopDeclaringSpawnsOn(context, claim) {
+	if (claim) operationState(context).declaring.delete(claim);
+}
+/**
+* Start a child that every claim `context`'s operation passed to `declareSpawnsOn` records until it exits. The child keeps
+* the caller's process group, so a terminal interrupt still reaches it; the claim follows the child
+* itself. A claim that cannot be marked stops the spawn rather than letting it run unprotected. A claim
+* records one child, so declared spawns must not overlap. `until: 'close'` also holds the declaration
+* while a launcher's child retains its stdio pipes after the launcher exits. A promise holds the declaration until
+* cleanup resolves; a rejection keeps the child record for recovery.
+*/
+function spawnDeclared(context, spawn, { until = "exit" } = {}) {
+	const { declaring, running, refusal } = operationState(context);
+	if (refusal !== null) throw new Error(refusal);
+	const claims = [...declaring];
+	if (claims.length === 0) return spawn();
+	const forget = () => {
+		for (const claim of claims) try {
+			(0, ownership_claim_exports.clearClaimChild)(claim);
+		} catch {}
+	};
+	let child;
+	try {
+		for (const claim of claims) (0, ownership_claim_exports.markClaimChildPending)(claim);
+		child = spawn();
+	} catch (error) {
+		forget();
+		throw error;
+	}
+	const pid = child.pid;
+	if (pid === void 0) {
+		forget();
+		return child;
+	}
+	running.add(child);
+	const captured = (0, process_identity_exports.captureProcessIdentity)(pid);
+	if (captured.ok) for (const claim of claims) try {
+		(0, ownership_claim_exports.setClaimChild)(claim, {
+			pid,
+			processToken: captured.token
+		});
+	} catch {}
+	const settled = () => {
+		running.delete(child);
+		forget();
+	};
+	if (typeof until === "string") child.once(until, settled);
+	else until.then(settled, () => {});
+	return child;
+}
+/** Refuse every later `spawnDeclared` of `context`'s operation with `reason` until `allowDeclaredSpawns`. */
+function refuseDeclaredSpawns(context, reason) {
+	operationState(context).refusal = reason;
+}
+function allowDeclaredSpawns(context) {
+	operationState(context).refusal = null;
+}
+/**
+* Send `signal` to every child `context`'s operation started through `spawnDeclared` that has not exited; returns how
+* many were signalled.
+*/
+function signalDeclaredSpawns(context, signal) {
+	let signalled = 0;
+	for (const child of operationState(context).running) {
+		if (child.exitCode !== null || child.signalCode !== null) continue;
+		try {
+			if (child.kill(signal)) signalled += 1;
+		} catch {}
+	}
+	return signalled;
+}
+//#endregion
+//#region src/engine/workspace-process-lock.ts
+const DEFAULT_WAIT_MS = 6e4;
+const POLL_MS = 25;
+var WorkspaceProcessCleanupError = class extends Error {
+	code = "STIM_CLAIM_UNAVAILABLE";
+	claims;
+	remedy;
+	constructor(claims, message, remedy) {
+		super(`${message} Its ownership claims remain held at ${claims.map((claim) => claim.path).join(", ")}.`);
+		this.claims = claims;
+		this.remedy = `${remedy} After verifying no child remains, remove only these claims: ${claims.map((claim) => (0, ownership_claim_exports.claimRemoveCommand)(claim.path)).join("; ")}`;
+	}
+};
+function workspaceProcessLockError(err) {
+	const code = err?.code;
+	if (code === "STIM_LOCK_REFUSED") return "refused";
+	if (code === "STIM_LOCK_TIMEOUT") return "timeout";
+	return null;
+}
+function workspaceProcessLockPath(root, name, external) {
+	return external ? join(root, `${name}.lock`) : join(root, ".stim", `${name}.lock`);
+}
+async function withWorkspaceProcessLock(root, name, fn, { now = Date.now, signal, sleep = (ms) => setTimeout$1(ms, void 0, { signal }), waitMs = DEFAULT_WAIT_MS, ownerPurpose, details = {}, onHeld, rejectOwnerPurposes = [], external = false, declareSpawnsFor } = {}) {
+	const path = workspaceProcessLockPath(root, name, external);
+	const deadline = now() + waitMs;
+	for (;;) {
+		signal?.throwIfAborted();
+		const attempt = (0, ownership_claim_exports.tryAcquireClaim)({
+			root: path,
+			mode: "exclusive",
+			label: `${name} lock`,
+			details: ownerPurpose ? {
+				...details,
+				purpose: ownerPurpose
+			} : details
+		});
+		if (attempt.pending) (0, ownership_claim_exports.releaseClaim)(attempt.pending);
+		if (attempt.acquired) {
+			if (declareSpawnsFor) declareSpawnsOn(declareSpawnsFor, attempt.acquired);
+			let retained = false;
+			try {
+				return await fn(attempt.acquired);
+			} catch (cause) {
+				retained = cause instanceof WorkspaceProcessCleanupError && cause.claims.includes(attempt.acquired);
+				throw cause;
+			} finally {
+				if (declareSpawnsFor) stopDeclaringSpawnsOn(declareSpawnsFor, attempt.acquired);
+				if (!retained) (0, ownership_claim_exports.releaseClaim)(attempt.acquired);
+			}
+		}
+		const holder = attempt.held ?? attempt.waitingFor?.[0];
+		const purpose = holder?.details.purpose;
+		if (typeof purpose === "string" && rejectOwnerPurposes.includes(purpose)) {
+			const error = /* @__PURE__ */ new Error(`The ${name} lock at ${path} is held for ${purpose}.`);
+			error.code = "STIM_LOCK_REFUSED";
+			throw error;
+		}
+		if (holder && onHeld) await onHeld(holder);
+		if (now() >= deadline) {
+			const error = /* @__PURE__ */ new Error(`Timed out waiting for the ${name} lock at ${path}.`);
+			error.code = "STIM_LOCK_TIMEOUT";
+			throw error;
+		}
+		await sleep(POLL_MS);
+	}
+}
+//#endregion
+//#region src/exec.ts
+const MAX_BUFFER = 67108864;
+function spawnReportProbe(file, args, opts, containProcessTree = false) {
+	if (process.platform !== "win32" || !containProcessTree && !reportSignal(ambientContext()) || !executableIn(file, opts.env ?? ambientEnv(), opts.cwd ?? process.cwd())) return spawn(file, args, opts);
+	const env = opts.env ?? ambientEnv();
+	const systemRoot = process.env.SystemRoot ?? process.env.SYSTEMROOT;
+	if (!systemRoot) throw new Error("SystemRoot is required to contain Windows report probes.");
+	return spawn(resolve$1(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), [
+		"-NoLogo",
+		"-NoProfile",
+		"-NonInteractive",
+		"-ExecutionPolicy",
+		"Bypass",
+		"-File",
+		fileURLToPath(new URL("../dist/windows-report.ps1", import.meta.url))
+	], {
+		...opts,
+		windowsHide: true,
+		env: {
+			...env,
+			STIM_REPORT_CHILD: JSON.stringify({
+				file,
+				args,
+				node: process.execPath,
+				entry: fileURLToPath(new URL("../dist/windows-report.mjs", import.meta.url))
+			})
+		}
+	});
+}
+function reportChild(child, signal, failed) {
+	const context = ambientContext();
+	const report = reportSignal(context);
+	signal ??= report;
+	if (!signal) return;
+	let rejectClosed;
+	let ended = false;
+	let finishNativeClose;
+	const nativeClosed = new Promise((resolve) => {
+		finishNativeClose = resolve;
+	});
+	const closed = new Promise((resolve, reject) => {
+		rejectClosed = reject;
+		child.once("close", () => {
+			ended = true;
+			finishNativeClose();
+			cancel().then(resolve, reject);
+		});
+	});
+	const pid = child.pid;
+	const captured = pid === void 0 ? null : (0, process_identity_exports.captureProcessIdentity)(pid);
+	const observe = () => {
+		if (pid === void 0) return "gone";
+		if (captured?.ok) return (0, process_identity_exports.inspectProcessIdentity)({
+			pid,
+			processToken: captured.token
+		});
+		if (process.platform === "win32") return ended ? "gone" : "unknown";
+		try {
+			process.kill(-pid, 0);
+		} catch (error) {
+			if (error instanceof Error && "code" in error && error.code === "ESRCH") return "gone";
+		}
+		return "unknown";
+	};
+	const refuse = (message) => {
+		const failure = Object.assign(new Error(message), {
+			code: "STIM_CLAIM_UNAVAILABLE",
+			reportCleanup: true
+		});
+		const error = failed?.(failure) ?? failure;
+		child.stdin?.destroy();
+		child.stdout?.destroy();
+		child.stderr?.destroy();
+		child.unref();
+		rejectClosed(error);
+		throw error;
+	};
+	let cancelled;
+	const cancel = () => cancelled ??= (async () => {
+		let identity = observe();
+		if (pid !== void 0) {
+			const deadline = performance.now() + 1e3;
+			while (identity === "unknown" && performance.now() < deadline) {
+				await setTimeout$1(50);
+				identity = observe();
+			}
+			if (identity === "unknown") refuse(`Cannot verify cleanup for report child ${pid}; its process or descendants were left untouched.`);
+		}
+		if (pid !== void 0 && captured?.ok && (identity === "same" || process.platform !== "win32" && identity === "gone")) {
+			if (process.platform === "win32") {
+				if (report) child.kill("SIGKILL");
+				else {
+					const killer = spawn("taskkill", [
+						"/PID",
+						String(pid),
+						"/T",
+						"/F"
+					], { stdio: "ignore" });
+					const timer = setTimeout(() => killer.kill("SIGKILL"), 5e3);
+					await new Promise((resolve) => {
+						killer.once("error", () => child.kill("SIGKILL"));
+						killer.once("close", (status) => {
+							if (status !== 0) child.kill("SIGKILL");
+							resolve();
+						});
+					});
+					clearTimeout(timer);
+				}
+			} else try {
+				process.kill(-pid, "SIGKILL");
+			} catch {
+				child.kill("SIGKILL");
+			}
+		}
+		child.stdin?.destroy();
+		child.stdout?.destroy();
+		child.stderr?.destroy();
+		if (!ended) {
+			let timer;
+			await Promise.race([nativeClosed, new Promise((resolve) => {
+				timer = setTimeout(resolve, 1e3);
+			})]);
+			clearTimeout(timer);
+			if (!ended) refuse(`Report child ${pid} did not close within the cleanup budget.`);
+		}
+		if (pid !== void 0 && process.platform !== "win32") {
+			const deadline = performance.now() + 1e3;
+			while ((0, ownership_claim_exports.processGroupAlive)(pid) && performance.now() < deadline) await setTimeout$1(25);
+			if ((0, ownership_claim_exports.processGroupAlive)(pid)) refuse(`Report child ${pid} still has descendants after cleanup.`);
+		}
+	})();
+	if (report) trackReportResource(context, closed, cancel, signal);
+	else {
+		const abort = () => {
+			cancel().catch(() => {});
+		};
+		const callerSignal = signal;
+		callerSignal.addEventListener("abort", abort, { once: true });
+		const settled = () => callerSignal.removeEventListener("abort", abort);
+		closed.then(settled, settled);
+		if (callerSignal.aborted) abort();
+	}
+	return {
+		cancel,
+		closed
+	};
+}
+function budgetMs(timeoutMs) {
+	if (timeoutMs === "unbounded") return void 0;
+	if (!(timeoutMs > 0)) throw new RangeError(`timeoutMs must be a positive number of milliseconds or 'unbounded', got ${timeoutMs}`);
+	return timeoutMs;
+}
+/** Whether an exec error is a child killed for exceeding its `timeoutMs`. */
+function isTimeoutError(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ETIMEDOUT";
+}
+function nameTimeout(error, command, timeoutMs) {
+	if (error?.code === "ETIMEDOUT" && error instanceof Error) error.message = `Command timed out after ${timeoutMs}ms: ${command}`;
+	return error;
+}
+const WINDOWS_BATCH_FILE = /\.(?:bat|cmd)$/i;
+const BATCH_UNSAFE_ARGUMENT = /["\r\n]/;
+function isUnsafeBatchSpawn(target, args, platform = process.platform) {
+	return platform === "win32" && WINDOWS_BATCH_FILE.test(target) && args.some((arg) => BATCH_UNSAFE_ARGUMENT.test(arg));
+}
+function executableIn(file, env, cwd) {
+	const windows = process.platform === "win32";
+	const value = (name) => env[name] ?? (windows ? Object.entries(env).find(([key, field]) => field !== void 0 && key.toUpperCase() === name)?.[1] : void 0);
+	const directory = typeof cwd === "string" ? cwd : fileURLToPath(cwd);
+	const path = file.includes("/") || windows && file.includes("\\");
+	const directories = path ? [""] : (value("PATH") ?? "").split(delimiter$1);
+	if (windows && !path) directories.unshift(directory);
+	for (const entry of directories) {
+		const candidate = resolve$1(directory, entry.replace(/^"(.*)"$/, "$1"), file);
+		const found = which.sync(candidate, {
+			nothrow: true,
+			path: "",
+			pathExt: value("PATHEXT") ?? ""
+		});
+		if (found) return found;
+	}
+	return null;
+}
+function refuseUnsafeBatchArguments(file, args, env = ambientEnv(), cwd = ambientContext()?.cwd ?? process.cwd()) {
+	if (process.platform !== "win32") return;
+	const target = executableIn(file, env, cwd) ?? file;
+	if (isUnsafeBatchSpawn(target, args)) throw new Error(`Refusing to run ${basename$1(target)}: an argument contains a character cmd.exe could misinterpret (a double quote or a line break).`);
+}
+function redactError(error, values) {
+	const secrets = values?.filter(Boolean) ?? [];
+	if (secrets.length === 0 || !error || typeof error !== "object") return error;
+	const scrub = (text) => secrets.reduce((acc, secret) => acc.split(secret).join("***"), text);
+	const fields = error;
+	for (const key of Object.getOwnPropertyNames(error)) {
+		const value = fields[key];
+		if (typeof value === "string") fields[key] = scrub(value);
+		else if (Array.isArray(value)) fields[key] = value.map((item) => typeof item === "string" ? scrub(item) : item);
+	}
+	return error;
+}
+const defaultExecutor = {
+	reportSignal: () => reportSignal(ambientContext()),
+	run(cmd, { timeoutMs, killSignal, cwd, env }) {
+		const opts = {
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			maxBuffer: MAX_BUFFER
+		};
+		const timeout = budgetMs(timeoutMs);
+		if (timeout !== void 0) opts.timeout = timeout;
+		if (killSignal) opts.killSignal = killSignal;
+		const childCwd = cwd ?? ambientContext()?.cwd;
+		if (childCwd) opts.cwd = childCwd;
+		if (env || ambientContext()) opts.env = {
+			...ambientEnv(),
+			...env
+		};
+		try {
+			return String(execSync(cmd, opts)).trim();
+		} catch (error) {
+			throw nameTimeout(error, cmd, timeoutMs);
+		}
+	},
+	runFile(file, args = [], { timeoutMs, killSignal, cwd, env, omitEnv, input, untrimmed, rejectStderr, detachedSilent, redact }) {
+		const opts = {
+			encoding: "utf-8",
+			stdio: detachedSilent ? "ignore" : [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			maxBuffer: MAX_BUFFER
+		};
+		if (detachedSilent) opts.detached = true;
+		const timeout = budgetMs(timeoutMs);
+		if (timeout !== void 0) opts.timeout = timeout;
+		if (killSignal) opts.killSignal = killSignal;
+		const childCwd = cwd ?? ambientContext()?.cwd;
+		if (childCwd) opts.cwd = childCwd;
+		if (input !== void 0) opts.input = input;
+		if (env || omitEnv?.length || ambientContext()) {
+			const childEnv = {
+				...ambientEnv(),
+				...env
+			};
+			for (const key of omitEnv ?? []) delete childEnv[key];
+			opts.env = childEnv;
+		}
+		refuseUnsafeBatchArguments(file, args, opts.env, opts.cwd);
+		const result = spawn.sync(file, args, opts);
+		if (result.error) throw redactError(nameTimeout(Object.assign(result.error, result), [file, ...args].join(" "), timeoutMs), redact);
+		if (result.status !== 0 || rejectStderr && String(result.stderr ?? "").trim()) {
+			const stderr = String(result.stderr ?? "");
+			const message = `Command failed: ${[file, ...args].join(" ")}${stderr ? `\n${stderr}` : ""}`;
+			throw redactError(Object.assign(new Error(message), result), redact);
+		}
+		if (detachedSilent) return "";
+		return untrimmed ? String(result.stdout) : String(result.stdout).trim();
+	},
+	runFileAsync(file, args = [], { timeoutMs, killSignal, cwd, env, omitEnv, input, untrimmed, rejectStderr, onSpawn, declareFor, detachedSilent, containProcessTree, cleanupOnExit, redact, signal: callSignal }) {
+		const command = [file, ...args].join(" ");
+		return new Promise((resolve, reject) => {
+			const report = callSignal ?? reportSignal(ambientContext());
+			report?.throwIfAborted();
+			const timeout = budgetMs(timeoutMs);
+			const opts = detachedSilent ? {
+				stdio: "ignore",
+				detached: true
+			} : { stdio: [
+				input === void 0 ? "ignore" : "pipe",
+				"pipe",
+				"pipe"
+			] };
+			if (report && process.platform !== "win32") opts.detached = true;
+			const childCwd = cwd ?? ambientContext()?.cwd;
+			if (childCwd) opts.cwd = childCwd;
+			if (env || omitEnv?.length || ambientContext()) {
+				const childEnv = {
+					...ambientEnv(),
+					...env
+				};
+				for (const key of omitEnv ?? []) delete childEnv[key];
+				opts.env = childEnv;
+			}
+			refuseUnsafeBatchArguments(file, args, opts.env, opts.cwd);
+			const claims = declareFor ? [...operationState(declareFor).declaring] : [];
+			let clearDeclaration;
+			let retainDeclaration;
+			const declaration = claims.length > 0 && report ? new Promise((resolveDeclaration, rejectDeclaration) => {
+				clearDeclaration = resolveDeclaration;
+				retainDeclaration = rejectDeclaration;
+			}) : void 0;
+			const start = () => spawnReportProbe(file, args, opts, containProcessTree || Boolean(report));
+			const child = declareFor ? spawnDeclared(declareFor, start, declaration ? { until: declaration } : {}) : start();
+			let lifetime;
+			let cancel;
+			let timer;
+			try {
+				lifetime = reportChild(child, report, (error) => {
+					const failure = claims.length ? Object.assign(new WorkspaceProcessCleanupError(claims, error.message, "Verify the child and its descendants have stopped."), { reportCleanup: true }) : error;
+					clearTimeout(timer);
+					return failure;
+				});
+				cancel = lifetime?.cancel;
+				if (cleanupOnExit && cancel) child.once("exit", () => {
+					clearTimeout(timer);
+					cancel?.().catch(reject);
+				});
+				lifetime?.closed.catch(reject);
+				if (declaration) lifetime?.closed.then(clearDeclaration, retainDeclaration);
+				onSpawn?.(child);
+			} catch (error) {
+				if (cancel) cancel().then(() => lifetime?.closed).then(() => reject(error), reject);
+				else {
+					if (!report) child.kill("SIGKILL");
+					reject(error);
+				}
+				return;
+			}
+			if (input !== void 0) {
+				child.stdin?.on("error", () => {});
+				child.stdin?.end(input);
+			}
+			const stdout = [];
+			const stderr = [];
+			let timedOut = false;
+			let overflowed = false;
+			let bufferedBytes = 0;
+			const capture = (chunks, chunk) => {
+				if (overflowed) return;
+				const remaining = MAX_BUFFER - bufferedBytes;
+				if (chunk.length <= remaining) {
+					chunks.push(chunk);
+					bufferedBytes += chunk.length;
+				} else {
+					if (remaining > 0) chunks.push(chunk.subarray(0, remaining));
+					bufferedBytes = MAX_BUFFER;
+					overflowed = true;
+					if (cancel) cancel().catch(reject);
+					else {
+						child.kill("SIGKILL");
+						child.stdin?.destroy();
+						child.stdout?.destroy();
+						child.stderr?.destroy();
+					}
+				}
+			};
+			timer = timeout === void 0 ? void 0 : setTimeout(() => {
+				timedOut = true;
+				if (cancel) cancel().catch(reject);
+				else {
+					child.kill(killSignal ?? "SIGTERM");
+					child.stdin?.destroy();
+					child.stdout?.destroy();
+					child.stderr?.destroy();
+				}
+			}, timeout);
+			child.stdout?.on("data", (chunk) => capture(stdout, chunk));
+			child.stderr?.on("data", (chunk) => capture(stderr, chunk));
+			child.on("error", (error) => {
+				clearTimeout(timer);
+				reject(redactError(error, redact));
+			});
+			const finish = async (status, signal) => {
+				clearTimeout(timer);
+				await lifetime?.closed;
+				const discardOutput = (timedOut || overflowed || report?.aborted) && redact?.some(Boolean);
+				const out = discardOutput ? "" : Buffer.concat(stdout).toString("utf-8");
+				const err = discardOutput ? "" : Buffer.concat(stderr).toString("utf-8");
+				const result = {
+					status,
+					signal,
+					stdout: out,
+					stderr: err
+				};
+				if (report?.aborted) reject(report.reason);
+				else if (timedOut) reject(redactError(nameTimeout(Object.assign(new Error(command), result, { code: "ETIMEDOUT" }), command, timeoutMs), redact));
+				else if (overflowed) reject(redactError(Object.assign(/* @__PURE__ */ new Error(`Command output exceeded ${MAX_BUFFER} bytes: ${command}`), result, { code: "ENOBUFS" }), redact));
+				else if (status !== 0 || rejectStderr && err.trim()) reject(redactError(Object.assign(/* @__PURE__ */ new Error(`Command failed: ${command}${err ? `\n${err}` : ""}`), result), redact));
+				else resolve(detachedSilent ? "" : untrimmed ? out : out.trim());
+			};
+			child.on("close", (status, signal) => {
+				finish(status, signal).catch(reject);
+			});
+		});
+	},
+	runQuiet(cmd, opts) {
+		budgetMs(opts.timeoutMs);
+		try {
+			return this.run(cmd, opts);
+		} catch {
+			return null;
+		}
+	},
+	runFileQuiet(file, args, opts) {
+		budgetMs(opts.timeoutMs);
+		try {
+			return this.runFile(file, args, opts);
+		} catch {
+			return null;
+		}
+	},
+	runFileQuietAsync(file, args, opts) {
+		budgetMs(opts.timeoutMs);
+		return this.runFileAsync(file, args, opts).catch(() => null);
+	},
+	spawn(cmd, args = [], opts = {}) {
+		const report = reportSignal(ambientContext());
+		report?.throwIfAborted();
+		const context = ambientContext();
+		const childOpts = context ? {
+			...opts,
+			cwd: opts.cwd ?? context.cwd,
+			env: opts.env ?? context.env
+		} : opts;
+		if (report && process.platform !== "win32") childOpts.detached = true;
+		refuseUnsafeBatchArguments(cmd, args, childOpts.env ?? ambientEnv(), childOpts.cwd);
+		const claims = report ? [...operationState(context).declaring] : [];
+		const child = spawnReportProbe(cmd, args, childOpts);
+		reportChild(child, void 0, (error) => claims.length ? Object.assign(new WorkspaceProcessCleanupError(claims, error.message, "Verify the child and its descendants have stopped."), { reportCleanup: true }) : error);
+		return child;
+	},
+	findExecutable(name, options = {}) {
+		return executableIn(name, options.env ?? ambientEnv(), options.cwd ?? ambientContext()?.cwd ?? process.cwd());
+	}
+};
+/** The program a call runs, without its arguments: those can carry tokens. */
+const programOf = (command) => basename$1(command.trim().split(/\s+/)[0] ?? "");
+function outcomeOf(error) {
+	const { status, signal, code } = error ?? {};
+	return {
+		ok: false,
+		...typeof status === "number" ? { exit: status } : {},
+		...signal ? { signal } : {},
+		...code ? { code } : {}
+	};
+}
+let executionId = 0;
+function timedSync(fn, program) {
+	return (...args) => {
+		if (!debugLog.enabled()) return fn(...args);
+		const id = ++executionId;
+		const name = program(...args);
+		const started = performance.now();
+		debugLog.log("exec.start", {
+			program: name,
+			executionId: id
+		});
+		try {
+			const out = fn(...args);
+			debugLog.log("exec", {
+				program: name,
+				executionId: id,
+				ms: Math.round(performance.now() - started),
+				ok: true
+			});
+			return out;
+		} catch (error) {
+			debugLog.log("exec", {
+				program: name,
+				executionId: id,
+				ms: Math.round(performance.now() - started),
+				...outcomeOf(error)
+			});
+			throw error;
+		}
+	};
+}
+let active = {
+	...defaultExecutor,
+	run: timedSync((cmd, opts) => defaultExecutor.run(cmd, opts), programOf),
+	runFile: timedSync((file, args, opts) => defaultExecutor.runFile(file, args, opts), (file) => basename$1(file)),
+	async runFileAsync(file, args, opts) {
+		if (!debugLog.enabled()) return defaultExecutor.runFileAsync(file, args, opts);
+		const id = ++executionId;
+		const name = basename$1(file);
+		const started = performance.now();
+		debugLog.log("exec.start", {
+			program: name,
+			executionId: id
+		});
+		try {
+			const out = await defaultExecutor.runFileAsync(file, args, opts);
+			debugLog.log("exec", {
+				program: name,
+				executionId: id,
+				ms: Math.round(performance.now() - started),
+				ok: true
+			});
+			return out;
+		} catch (error) {
+			debugLog.log("exec", {
+				program: name,
+				executionId: id,
+				ms: Math.round(performance.now() - started),
+				...outcomeOf(error)
+			});
+			throw error;
+		}
+	}
+};
+function getExecutor() {
+	return active;
+}
+//#endregion
+export { __require as C, __commonJSMin as S, reportSignal as _, workspaceProcessLockError as a, debugLog as b, declareSpawnsOn as c, spawnDeclared as d, stopDeclaringSpawnsOn as f, process_identity_exports as g, withDrainingCancellation as h, withWorkspaceProcessLock as i, refuseDeclaredSpawns as l, operationState as m, isTimeoutError as n, workspaceProcessLockPath as o, isTermination as p, WorkspaceProcessCleanupError as r, allowDeclaredSpawns as s, getExecutor as t, signalDeclaredSpawns as u, runReport as v, ownership_claim_exports as x, trackReportResource as y };