@ai-development-environment/control-agent 0.0.30 → 0.0.32

package/dist/control-agent.js

@@ -2288,6 +2288,7 @@ var IOS_DEPLOY_JOB_KIND = "ios.build.deploy";
 var IOS_EXPORT_JOB_KIND = "ios.archive.export";
 var IOS_TEST_RESULTS_JOB_KIND = "ios.test-results.parse";
 var IOS_COVERAGE_REPORT_JOB_KIND = "ios.coverage.generate";
+var IOS_SIGNING_INSPECT_JOB_KIND = "ios.signing.inspect";
 var IOS_BUILD_JOB_KINDS = [
   IOS_SOURCE_DISCOVER_JOB_KIND,
   IOS_SOURCE_PARSE_JOB_KIND,
@@ -2299,7 +2300,8 @@ var IOS_BUILD_JOB_KINDS = [
   IOS_DEPLOY_JOB_KIND,
   IOS_EXPORT_JOB_KIND,
   IOS_TEST_RESULTS_JOB_KIND,
-  IOS_COVERAGE_REPORT_JOB_KIND
+  IOS_COVERAGE_REPORT_JOB_KIND,
+  IOS_SIGNING_INSPECT_JOB_KIND
 ];
 var BUILD_ACTIONS = [
   "BUILD",
@@ -2840,6 +2842,29 @@ function parseBuildExportPayload(value) {
     settings: parseBuildExportSettings(input.settings)
   };
 }
+function provisioningProfileType(profile) {
+  if (profile.getTaskAllow) return "DEVELOPMENT";
+  if (profile.provisionsAllDevices) return "ENTERPRISE";
+  return profile.hasProvisionedDevices ? "AD_HOC" : "APP_STORE";
+}
+function parseBuildSigningInspectPayload(value) {
+  const input = objectValue6(value, "build signing payload");
+  return {
+    buildId: stringValue6(input.buildId, "build signing payload.buildId"),
+    codebaseId: stringValue6(
+      input.codebaseId,
+      "build signing payload.codebaseId"
+    ),
+    artifactDirectory: stringValue6(
+      input.artifactDirectory,
+      "build signing payload.artifactDirectory"
+    ),
+    archiveRelativePath: safeRelativePath2(
+      input.archiveRelativePath,
+      "build signing payload.archiveRelativePath"
+    )
+  };
+}
 
 // src/inventory.ts
 var AGENT_VERSION = "0.1.0";
@@ -2980,64 +3005,159 @@ function runCloudflared(payload, timeoutMs, signal, onLog) {
   });
 }
 
-// src/handlers/ccusage.ts
-import { Buffer as Buffer2 } from "node:buffer";
-var MAX_CCUSAGE_STDOUT_BYTES = 16 * 1024 * 1024;
-function validateCcusagePayload(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    throw new Error("ccusage.report payload must be an object");
+// src/handlers/signing.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readdir, stat as stat2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { basename, join as join2, relative, sep } from "node:path";
+
+// ../agent-contract/src/plist.ts
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function plistValue(value) {
+  if (typeof value === "boolean") return value ? "<true/>" : "<false/>";
+  if (typeof value === "string") return `<string>${xmlEscape(value)}</string>`;
+  if (typeof value === "number" && Number.isInteger(value)) {
+    return `<integer>${value}</integer>`;
   }
-  const keys = Object.keys(payload);
-  if (keys.length > 0) {
-    throw new Error(`Unexpected ccusage.report payload field: ${keys[0]}`);
+  if (Array.isArray(value)) {
+    return `<array>${value.map((entry) => plistValue(entry)).join("")}</array>`;
   }
-  return {};
+  if (value && typeof value === "object") {
+    return `<dict>${Object.entries(value).map(([key, entry]) => `<key>${xmlEscape(key)}</key>${plistValue(entry)}`).join("")}</dict>`;
+  }
+  throw new Error("Unsupported plist value");
 }
-async function runCcusage(payload, timeoutMs, signal, onLog) {
-  validateCcusagePayload(payload);
-  const stdout = [];
-  let stdoutBytes = 0;
-  let exceededLimit = false;
-  const result = await runProcess({
-    command: "ccusage",
-    args: ["--json"],
-    timeoutMs,
-    signal,
-    onLog: async (log) => {
-      if (log.stream !== "STDOUT") {
-        await onLog(log);
-        return;
+function plistDocument(value) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">${plistValue(value)}</plist>
+`;
+}
+var ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'"
+};
+function decodeText(value) {
+  return value.replace(
+    /&(#x?[0-9a-fA-F]+|[a-z]+);/g,
+    (match, entity) => {
+      if (entity.startsWith("#x") || entity.startsWith("#X")) {
+        return String.fromCodePoint(Number.parseInt(entity.slice(2), 16));
       }
-      const lineBytes = Buffer2.byteLength(log.message, "utf8") + 1;
-      if (stdoutBytes + lineBytes > MAX_CCUSAGE_STDOUT_BYTES) {
-        exceededLimit = true;
-        return;
+      if (entity.startsWith("#")) {
+        return String.fromCodePoint(Number.parseInt(entity.slice(1), 10));
       }
-      stdoutBytes += lineBytes;
-      stdout.push(log.message);
+      return ENTITIES[entity] ?? match;
+    }
+  );
+}
+function nextTag(xml, from) {
+  let index = from;
+  for (; ; ) {
+    const start = xml.indexOf("<", index);
+    if (start < 0) return null;
+    if (xml.startsWith("<!--", start)) {
+      const close2 = xml.indexOf("-->", start);
+      if (close2 < 0) return null;
+      index = close2 + 3;
+      continue;
+    }
+    if (xml.startsWith("<?", start) || xml.startsWith("<!", start)) {
+      const close2 = xml.indexOf(">", start);
+      if (close2 < 0) return null;
+      index = close2 + 1;
+      continue;
+    }
+    const close = xml.indexOf(">", start);
+    if (close < 0) return null;
+    const raw = xml.slice(start + 1, close);
+    const closing = raw.startsWith("/");
+    const selfClosing = raw.endsWith("/");
+    const name = raw.slice(closing ? 1 : 0, selfClosing ? raw.length - 1 : raw.length).trim().split(/\s/)[0];
+    return { name, closing, selfClosing, end: close + 1 };
+  }
+}
+function textUntilClose(xml, from, name) {
+  const close = xml.indexOf(`</${name}`, from);
+  if (close < 0) throw new Error(`Unterminated <${name}> in plist`);
+  const end = xml.indexOf(">", close);
+  return [decodeText(xml.slice(from, close)), end + 1];
+}
+var MAX_DEPTH = 64;
+function parseValue(xml, from, depth) {
+  if (depth > MAX_DEPTH) throw new Error("plist nesting is too deep");
+  const tag = nextTag(xml, from);
+  if (!tag || tag.closing) throw new Error("Expected a plist value");
+  if (tag.selfClosing) {
+    switch (tag.name) {
+      case "true":
+        return [true, tag.end];
+      case "false":
+        return [false, tag.end];
+      case "dict":
+        return [{}, tag.end];
+      case "array":
+        return [[], tag.end];
+      default:
+        return ["", tag.end];
+    }
+  }
+  switch (tag.name) {
+    case "dict": {
+      const result = {};
+      let cursor = tag.end;
+      for (; ; ) {
+        const next = nextTag(xml, cursor);
+        if (!next) throw new Error("Unterminated <dict> in plist");
+        if (next.closing && next.name === "dict") return [result, next.end];
+        if (next.name !== "key") throw new Error("Expected <key> in <dict>");
+        const [key, afterKey] = textUntilClose(xml, next.end, "key");
+        const [value, afterValue] = parseValue(xml, afterKey, depth + 1);
+        result[key] = value;
+        cursor = afterValue;
+      }
+    }
+    case "array": {
+      const result = [];
+      let cursor = tag.end;
+      for (; ; ) {
+        const next = nextTag(xml, cursor);
+        if (!next) throw new Error("Unterminated <array> in plist");
+        if (next.closing && next.name === "array") return [result, next.end];
+        const [value, afterValue] = parseValue(xml, cursor, depth + 1);
+        result.push(value);
+        cursor = afterValue;
+      }
+    }
+    case "integer":
+    case "real": {
+      const [text2, end] = textUntilClose(xml, tag.end, tag.name);
+      return [Number(text2.trim()), end];
+    }
+    // Dates and data are returned verbatim: callers need the timestamp text and
+    // never the certificate bytes, so decoding them would only cost memory.
+    case "string":
+    case "date":
+    case "data": {
+      const [text2, end] = textUntilClose(xml, tag.end, tag.name);
+      return [tag.name === "string" ? text2 : text2.trim(), end];
+    }
+    default: {
+      const [, end] = textUntilClose(xml, tag.end, tag.name);
+      return [null, end];
     }
-  });
-  if (result.exitCode !== 0 || result.cancelled || result.timedOut || result.signal !== null) {
-    return result;
-  }
-  if (exceededLimit) {
-    throw new Error(
-      `ccusage JSON exceeded the ${MAX_CCUSAGE_STDOUT_BYTES} byte limit`
-    );
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout.join("\n"));
-  } catch {
-    throw new Error("ccusage returned malformed JSON");
   }
-  return { ...result, report: parseCcusageReport(parsed) };
 }
-
-// src/handlers/build-data.ts
-import { lstat, opendir, readdir, realpath, rm } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { basename, dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+function parsePlist(xml) {
+  const start = xml.indexOf("<plist");
+  const from = start < 0 ? 0 : xml.indexOf(">", start) + 1;
+  return parseValue(xml, from, 0)[0];
+}
 
 // src/capture-command.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -3107,7 +3227,333 @@ function captureCommand(options) {
   });
 }
 
+// src/handlers/signing.ts
+var PROFILE_DIRECTORIES = [
+  join2(
+    homedir2(),
+    "Library",
+    "Developer",
+    "Xcode",
+    "UserData",
+    "Provisioning Profiles"
+  ),
+  join2(homedir2(), "Library", "MobileDevice", "Provisioning Profiles")
+];
+var PROFILE_EXTENSIONS = [".mobileprovision", ".provisionprofile"];
+function text(value) {
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function stringList(value) {
+  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+async function decodeProfile(path, timeoutMs, signal) {
+  try {
+    const result = await captureCommand({
+      command: "/usr/bin/security",
+      args: ["cms", "-D", "-i", path],
+      timeoutMs: Math.min(timeoutMs, 1e4),
+      signal
+    });
+    if (result.exitCode !== 0 || !result.stdout.trim()) return null;
+    const parsed = parsePlist(result.stdout);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function toProfile(uuid, raw, now) {
+  const name = text(raw.Name);
+  if (!name) return null;
+  const entitlements = raw.Entitlements && typeof raw.Entitlements === "object" ? raw.Entitlements : {};
+  const applicationIdentifier = text(entitlements["application-identifier"]);
+  const teamId = stringList(raw.TeamIdentifier)[0] ?? text(entitlements["com.apple.developer.team-identifier"]);
+  const bundleId = applicationIdentifier ? applicationIdentifier.replace(/^[A-Z0-9]+\./, "") : "*";
+  const expiresAt = text(raw.ExpirationDate);
+  const expiry = expiresAt ? Date.parse(expiresAt) : Number.NaN;
+  return {
+    uuid,
+    name,
+    teamId: teamId ?? null,
+    teamName: text(raw.TeamName),
+    bundleId,
+    type: provisioningProfileType({
+      getTaskAllow: entitlements["get-task-allow"] === true,
+      hasProvisionedDevices: stringList(raw.ProvisionedDevices).length > 0,
+      provisionsAllDevices: raw.ProvisionsAllDevices === true
+    }),
+    platforms: stringList(raw.Platform),
+    expiresAt,
+    expired: Number.isFinite(expiry) ? expiry < now : false,
+    xcodeManaged: raw.IsXcodeManaged === true,
+    certificateSha1s: certificateFingerprints(raw.DeveloperCertificates)
+  };
+}
+function certificateFingerprints(value) {
+  return stringList(value).flatMap((encoded) => {
+    try {
+      const der = Buffer.from(encoded.replace(/\s+/g, ""), "base64");
+      if (!der.length) return [];
+      return [createHash2("sha1").update(der).digest("hex").toUpperCase()];
+    } catch {
+      return [];
+    }
+  });
+}
+async function readProfiles(timeoutMs, signal) {
+  const profiles = /* @__PURE__ */ new Map();
+  const now = Date.now();
+  for (const directory of PROFILE_DIRECTORIES) {
+    let entries;
+    try {
+      entries = await readdir(directory);
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!PROFILE_EXTENSIONS.some((suffix) => entry.endsWith(suffix)))
+        continue;
+      signal.throwIfAborted();
+      const raw = await decodeProfile(
+        join2(directory, entry),
+        timeoutMs,
+        signal
+      );
+      if (!raw) continue;
+      const uuid = text(raw.UUID) ?? basename(entry).replace(/\.[^.]+$/, "");
+      const profile = toProfile(uuid, raw, now);
+      if (profile && !profiles.has(profile.uuid)) {
+        profiles.set(profile.uuid, profile);
+      }
+    }
+  }
+  return dedupeProfiles([...profiles.values()]).sort(
+    (left, right) => left.name.localeCompare(right.name)
+  );
+}
+function dedupeProfiles(profiles) {
+  const best = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    const key = [
+      profile.name,
+      profile.type,
+      profile.bundleId,
+      profile.teamId ?? "",
+      [...profile.platforms].sort().join(","),
+      [...profile.certificateSha1s].sort().join(",")
+    ].join("\0");
+    const existing = best.get(key);
+    if (!existing || (profile.expiresAt ?? "") > (existing.expiresAt ?? "") || // Stable tie-break so repeated inspections return the same profile.
+    profile.expiresAt === existing.expiresAt && profile.uuid < existing.uuid) {
+      best.set(key, profile);
+    }
+  }
+  return [...best.values()];
+}
+var IDENTITY_PATTERN = /^\s*\d+\)\s+([0-9A-F]{40})\s+"(.+)"\s*$/i;
+async function readIdentities(timeoutMs, signal) {
+  try {
+    const result = await captureCommand({
+      command: "/usr/bin/security",
+      args: ["find-identity", "-v", "-p", "codesigning"],
+      timeoutMs: Math.min(timeoutMs, 1e4),
+      signal
+    });
+    if (result.exitCode !== 0) return [];
+    const identities = /* @__PURE__ */ new Map();
+    for (const line of result.stdout.split("\n")) {
+      const match = IDENTITY_PATTERN.exec(line);
+      if (!match) continue;
+      const [, sha1, name] = match;
+      const team = /\(([A-Z0-9]{10})\)\s*$/.exec(name);
+      identities.set(sha1, { sha1, name, teamId: team?.[1] ?? null });
+    }
+    return [...identities.values()];
+  } catch {
+    return [];
+  }
+}
+async function readArchiveBundles(archivePath, timeoutMs, signal) {
+  const products = join2(archivePath, "Products");
+  const bundles = [];
+  const queue = [products];
+  while (queue.length) {
+    signal.throwIfAborted();
+    const current = queue.shift();
+    let entries;
+    try {
+      entries = await readdir(current, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink() || !entry.isDirectory()) continue;
+      const path = join2(current, entry.name);
+      const signable = /\.(app|appex)$/.test(entry.name);
+      if (!signable) {
+        if (!/\.[A-Za-z0-9]+$/.test(entry.name)) queue.push(path);
+        continue;
+      }
+      const bundleId = await bundleIdentifier(path, timeoutMs, signal);
+      if (bundleId) {
+        bundles.push({
+          bundleId,
+          name: basename(entry.name).replace(/\.(app|appex)$/, ""),
+          relativePath: relative(archivePath, path).split(sep).join("/"),
+          ...await embeddedProfile(path, timeoutMs, signal)
+        });
+      }
+      queue.push(path);
+    }
+  }
+  return bundles.sort(
+    (left, right) => left.relativePath.localeCompare(right.relativePath)
+  );
+}
+async function bundleIdentifier(bundlePath, timeoutMs, signal) {
+  try {
+    const result = await captureCommand({
+      command: "/usr/bin/plutil",
+      args: [
+        "-extract",
+        "CFBundleIdentifier",
+        "raw",
+        "-o",
+        "-",
+        join2(bundlePath, "Info.plist")
+      ],
+      timeoutMs: Math.min(timeoutMs, 5e3),
+      signal
+    });
+    const value = result.stdout.trim();
+    return result.exitCode === 0 && value ? value : null;
+  } catch {
+    return null;
+  }
+}
+async function embeddedProfile(bundlePath, timeoutMs, signal) {
+  for (const name of [
+    "embedded.mobileprovision",
+    "embedded.provisionprofile"
+  ]) {
+    const path = join2(bundlePath, name);
+    try {
+      await stat2(path);
+    } catch {
+      continue;
+    }
+    const raw = await decodeProfile(path, timeoutMs, signal);
+    if (raw) {
+      return {
+        embeddedProfileUuid: text(raw.UUID),
+        embeddedProfileName: text(raw.Name)
+      };
+    }
+  }
+  return { embeddedProfileUuid: null, embeddedProfileName: null };
+}
+function teamsFrom(profiles, identities) {
+  const teams = /* @__PURE__ */ new Map();
+  for (const profile of profiles) {
+    if (!profile.teamId) continue;
+    const existing = teams.get(profile.teamId);
+    if (!existing && profile.teamName)
+      teams.set(profile.teamId, profile.teamName);
+    else if (!existing) teams.set(profile.teamId, profile.teamId);
+  }
+  for (const identity of identities) {
+    if (!identity.teamId || teams.has(identity.teamId)) continue;
+    const name = /^[^:]+:\s*(.+?)\s*\([A-Z0-9]{10}\)\s*$/.exec(identity.name);
+    teams.set(identity.teamId, name?.[1] ?? identity.teamId);
+  }
+  return [...teams.entries()].map(([id, name]) => ({ id, name })).sort((left, right) => left.name.localeCompare(right.name));
+}
+async function inspectSigningAssets(archivePath, timeoutMs, signal) {
+  const [profiles, identities, bundles] = await Promise.all([
+    readProfiles(timeoutMs, signal),
+    readIdentities(timeoutMs, signal),
+    readArchiveBundles(archivePath, timeoutMs, signal)
+  ]);
+  return {
+    teams: teamsFrom(profiles, identities),
+    identities,
+    profiles,
+    bundles
+  };
+}
+var inspectIosSigning = async (payload, timeoutMs, signal) => {
+  const input = parseBuildSigningInspectPayload(payload);
+  const archivePath = join2(input.artifactDirectory, input.archiveRelativePath);
+  const inspection = await inspectSigningAssets(archivePath, timeoutMs, signal);
+  return {
+    exitCode: 0,
+    signal: null,
+    timedOut: false,
+    cancelled: false,
+    ...inspection
+  };
+};
+
+// src/handlers/ccusage.ts
+import { Buffer as Buffer2 } from "node:buffer";
+var MAX_CCUSAGE_STDOUT_BYTES = 16 * 1024 * 1024;
+function validateCcusagePayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("ccusage.report payload must be an object");
+  }
+  const keys = Object.keys(payload);
+  if (keys.length > 0) {
+    throw new Error(`Unexpected ccusage.report payload field: ${keys[0]}`);
+  }
+  return {};
+}
+async function runCcusage(payload, timeoutMs, signal, onLog) {
+  validateCcusagePayload(payload);
+  const stdout = [];
+  let stdoutBytes = 0;
+  let exceededLimit = false;
+  const result = await runProcess({
+    command: "ccusage",
+    args: ["--json"],
+    timeoutMs,
+    signal,
+    onLog: async (log) => {
+      if (log.stream !== "STDOUT") {
+        await onLog(log);
+        return;
+      }
+      const lineBytes = Buffer2.byteLength(log.message, "utf8") + 1;
+      if (stdoutBytes + lineBytes > MAX_CCUSAGE_STDOUT_BYTES) {
+        exceededLimit = true;
+        return;
+      }
+      stdoutBytes += lineBytes;
+      stdout.push(log.message);
+    }
+  });
+  if (result.exitCode !== 0 || result.cancelled || result.timedOut || result.signal !== null) {
+    return result;
+  }
+  if (exceededLimit) {
+    throw new Error(
+      `ccusage JSON exceeded the ${MAX_CCUSAGE_STDOUT_BYTES} byte limit`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout.join("\n"));
+  } catch {
+    throw new Error("ccusage returned malformed JSON");
+  }
+  return { ...result, report: parseCcusageReport(parsed) };
+}
+
 // src/handlers/build-data.ts
+import { lstat, opendir, readdir as readdir2, realpath, rm } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join3, resolve } from "node:path";
 var successfulProcess = {
   exitCode: 0,
   signal: null,
@@ -3124,7 +3570,7 @@ function safeRelativePath3(value) {
 }
 async function configuredRoots(payload) {
   if (payload.mode === "DEFAULT") {
-    return [join2(homedir2(), "Library", "Developer", "Xcode", "DerivedData")];
+    return [join3(homedir3(), "Library", "Developer", "Xcode", "DerivedData")];
   }
   if (payload.mode === "ABSOLUTE") {
     if (!payload.path || !isAbsolute(payload.path)) {
@@ -3173,7 +3619,7 @@ async function scanRoot(configuredRoot, timeoutMs, signal) {
   }
   let children;
   try {
-    children = await readdir(rootPath2, { withFileTypes: true });
+    children = await readdir2(rootPath2, { withFileTypes: true });
   } catch (error) {
     return {
       entries: [],
@@ -3184,9 +3630,9 @@ async function scanRoot(configuredRoot, timeoutMs, signal) {
   for (const child of children) {
     signal.throwIfAborted();
     if (!child.isDirectory()) continue;
-    const path = join2(rootPath2, child.name);
+    const path = join3(rootPath2, child.name);
     const projectPath = await workspacePath(
-      join2(path, "info.plist"),
+      join3(path, "info.plist"),
       timeoutMs,
       signal
     );
@@ -3228,7 +3674,7 @@ function assertDirectChild(rootPath2, path) {
   }
   const root = resolve(rootPath2);
   const target2 = resolve(path);
-  if (target2 === root || dirname2(target2) !== root || basename(target2) !== basename(path)) {
+  if (target2 === root || dirname2(target2) !== root || basename2(target2) !== basename2(path)) {
     throw new Error("Build Data target must be a direct child of its root");
   }
 }
@@ -3242,7 +3688,7 @@ async function allocatedBytes(path, signal) {
   try {
     for await (const entry of directory) {
       signal.throwIfAborted();
-      total += await allocatedBytes(join2(path, entry.name), signal);
+      total += await allocatedBytes(join3(path, entry.name), signal);
     }
   } finally {
     await directory.close().catch(() => void 0);
@@ -3310,9 +3756,9 @@ var deleteBuildData = async (rawPayload, _timeoutMs, signal) => {
 };
 
 // src/handlers/codebases.ts
-import { readdir as readdir2, realpath as realpath2, stat as stat2 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
+import { readdir as readdir3, realpath as realpath2, stat as stat3 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
 var successfulProcess2 = {
   exitCode: 0,
   signal: null,
@@ -3389,7 +3835,7 @@ function baseSnapshot(folder) {
 }
 async function fetchedAt(commonDirectory) {
   try {
-    return (await stat2(join3(commonDirectory, "FETCH_HEAD"))).mtime.toISOString();
+    return (await stat3(join4(commonDirectory, "FETCH_HEAD"))).mtime.toISOString();
   } catch {
     return null;
   }
@@ -3400,7 +3846,7 @@ async function inspectCodebaseProcess(selectedFolder, timeoutMs, signal, expecte
   let selected;
   try {
     selected = await realpath2(fallbackFolder);
-    if (!(await stat2(selected)).isDirectory())
+    if (!(await stat3(selected)).isDirectory())
       throw new Error("Folder is not a directory");
   } catch (error) {
     return {
@@ -3568,23 +4014,23 @@ async function inspectCodebase(selectedFolder, timeoutMs, signal, expectedOrigin
 }
 var browseCodebaseDirectories = async (payload) => {
   const input = codebaseBrowsePayload(payload);
-  const homePath = await realpath2(homedir3());
+  const homePath = await realpath2(homedir4());
   const path = await realpath2(input.path ? resolve2(input.path) : homePath);
-  if (!(await stat2(path)).isDirectory())
+  if (!(await stat3(path)).isDirectory())
     throw new Error("Path is not a directory");
-  const candidates = await readdir2(path, { withFileTypes: true });
+  const candidates = await readdir3(path, { withFileTypes: true });
   const entries = [];
   for (const candidate of candidates) {
     if (candidate.isDirectory()) {
       entries.push({
         name: candidate.name,
-        path: join3(path, candidate.name),
+        path: join4(path, candidate.name),
         hidden: candidate.name.startsWith(".")
       });
     } else if (candidate.isSymbolicLink()) {
       try {
-        const target2 = join3(path, candidate.name);
-        if ((await stat2(target2)).isDirectory()) {
+        const target2 = join4(path, candidate.name);
+        if ((await stat3(target2)).isDirectory()) {
           entries.push({
             name: candidate.name,
             path: target2,
@@ -4154,14 +4600,14 @@ import {
   mkdir as mkdir2,
   readFile as readFile2,
   realpath as realpath3,
-  readdir as readdir3,
+  readdir as readdir4,
   rename as rename2,
   rm as rm2,
-  stat as stat3,
+  stat as stat4,
   writeFile as writeFile2
 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join4, relative, resolve as resolve3, sep } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3, sep as sep2 } from "node:path";
 import { promisify } from "node:util";
 var executeFile = promisify(execFile);
 var successfulProcess3 = {
@@ -4216,27 +4662,27 @@ var PROJECT_ROOTS = {
 };
 async function directoryExists(path) {
   try {
-    return (await stat3(path)).isDirectory();
+    return (await stat4(path)).isDirectory();
   } catch {
     return false;
   }
 }
 async function configuredTools(tools) {
-  const homePath = homedir4();
+  const homePath = homedir5();
   return Promise.all(
     AI_TOOLS.filter((tool) => tools.includes(tool)).map(async (tool) => ({
       tool,
-      configured: await directoryExists(join4(homePath, ...CONFIG_PATHS[tool])),
+      configured: await directoryExists(join5(homePath, ...CONFIG_PATHS[tool])),
       homePath
     }))
   );
 }
 function rootPath(location) {
-  const base = location.scope === "GLOBAL" ? homedir4() : location.folder;
+  const base = location.scope === "GLOBAL" ? homedir5() : location.folder;
   const parts = location.scope === "GLOBAL" ? GLOBAL_ROOTS[location.rootKind] : PROJECT_ROOTS[location.rootKind];
   const path = resolve3(base, ...parts);
   const normalizedBase = resolve3(base);
-  if (path !== normalizedBase && !path.startsWith(`${normalizedBase}${sep}`)) {
+  if (path !== normalizedBase && !path.startsWith(`${normalizedBase}${sep2}`)) {
     throw new Error("Skill root escaped its configured base directory");
   }
   return path;
@@ -4248,12 +4694,12 @@ async function listPackageFiles(skillDirectory) {
   const files = [];
   let totalBytes = 0;
   const visit = async (directory) => {
-    for (const entry of await readdir3(directory, { withFileTypes: true })) {
-      const path = join4(directory, entry.name);
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
+      const path = join5(directory, entry.name);
       const metadata = await lstat2(path);
       if (metadata.isSymbolicLink()) {
         throw new Error(
-          `Nested symbolic link is not supported: ${relative(skillDirectory, path)}`
+          `Nested symbolic link is not supported: ${relative2(skillDirectory, path)}`
         );
       }
       if (metadata.isDirectory()) {
@@ -4265,14 +4711,14 @@ async function listPackageFiles(skillDirectory) {
         throw new Error("Skill contains too many files");
       if (metadata.size > MAX_SKILL_FILE_BYTES) {
         throw new Error(
-          `${relative(skillDirectory, path)} exceeds the per-file limit`
+          `${relative2(skillDirectory, path)} exceeds the per-file limit`
         );
       }
       totalBytes += metadata.size;
       if (totalBytes > MAX_SKILL_PACKAGE_BYTES)
         throw new Error("Skill exceeds the package size limit");
       files.push({
-        path: relative(skillDirectory, path).split(sep).join("/"),
+        path: relative2(skillDirectory, path).split(sep2).join("/"),
         contentsBase64: (await readFile2(path)).toString("base64"),
         executable: (metadata.mode & 73) !== 0
       });
@@ -4295,7 +4741,7 @@ async function readPackage(directory) {
   const frontmatter = parseSkillMetadata(
     Buffer.from(definition.contentsBase64, "base64").toString("utf8")
   );
-  if (frontmatter.name !== directory.split(sep).at(-1)) {
+  if (frontmatter.name !== directory.split(sep2).at(-1)) {
     throw new Error("Skill name must match its directory name");
   }
   return {
@@ -4336,12 +4782,12 @@ async function scanRoot2(location, configured, targets, warnings) {
   if (!consumers.length) return [];
   const target2 = targetForFolder(targets, location.folder);
   const installations = [];
-  for (const entry of await readdir3(root, { withFileTypes: true })) {
+  for (const entry of await readdir4(root, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const directory = join4(root, entry.name);
+    const directory = join5(root, entry.name);
     try {
       const skillPackage = await readPackage(directory);
-      const relativeDirectory = location.folder ? relative(location.folder, directory).split(sep).join("/") : "";
+      const relativeDirectory = location.folder ? relative2(location.folder, directory).split(sep2).join("/") : "";
       installations.push({
         ...location,
         codebaseId: target2?.codebaseId ?? null,
@@ -4417,7 +4863,7 @@ var readSkills = async (payload) => {
     }
     packages.push({
       ...request,
-      package: await readPackage(join4(root, request.skillName))
+      package: await readPackage(join5(root, request.skillName))
     });
   }
   return { ...successfulProcess3, packages };
@@ -4452,7 +4898,7 @@ async function updateManagedExclude(folder, relativeSkillPath, present) {
       if (line.trim()) managed.add(line.trim());
     }
   }
-  const pattern = `/${relativeSkillPath.split(sep).join("/").replace(/^\/+/, "")}/`;
+  const pattern = `/${relativeSkillPath.split(sep2).join("/").replace(/^\/+/, "")}/`;
   if (present) managed.add(pattern);
   else managed.delete(pattern);
   const block = managed.size ? `${MANAGED_EXCLUDE_START}
@@ -4467,7 +4913,7 @@ ${MANAGED_EXCLUDE_END}` : "";
 }
 async function assertUntracked(location, skillDirectory) {
   if (location.scope !== "PROJECT") return;
-  const relativeDirectory = relative(location.folder, skillDirectory).split(sep).join("/");
+  const relativeDirectory = relative2(location.folder, skillDirectory).split(sep2).join("/");
   if (await trackedProjectPath(location.folder, relativeDirectory)) {
     throw new Error(
       `${relativeDirectory} is tracked by Git and cannot be managed automatically`
@@ -4479,16 +4925,16 @@ async function writePackage(location, skillPackage) {
     throw new Error("New skill copies may only be written to shared roots");
   }
   const root = rootPath(location);
-  const destination = join4(root, skillPackage.name);
+  const destination = join5(root, skillPackage.name);
   await assertUntracked(location, destination);
   await mkdir2(root, { recursive: true });
-  const temporary = join4(root, `.${skillPackage.name}.${randomUUID()}.tmp`);
-  const backup = join4(root, `.${skillPackage.name}.${randomUUID()}.bak`);
+  const temporary = join5(root, `.${skillPackage.name}.${randomUUID()}.tmp`);
+  const backup = join5(root, `.${skillPackage.name}.${randomUUID()}.bak`);
   await mkdir2(temporary, { recursive: true });
   try {
     for (const file of skillPackage.files) {
       const path = resolve3(temporary, ...file.path.split("/"));
-      if (!path.startsWith(`${temporary}${sep}`))
+      if (!path.startsWith(`${temporary}${sep2}`))
         throw new Error("Skill file escaped temporary directory");
       await mkdir2(dirname4(path), { recursive: true });
       await writeFile2(path, Buffer.from(file.contentsBase64, "base64"));
@@ -4521,7 +4967,7 @@ var applySkills = async (payload) => {
   for (const operation of operations) {
     const root = rootPath(operation);
     const skillName = operation.kind === "WRITE" ? operation.package.name : operation.skillName;
-    const destination = join4(root, skillName);
+    const destination = join5(root, skillName);
     await assertUntracked(operation, destination);
     if (operation.kind === "WRITE") {
       await writePackage(operation, operation.package);
@@ -4541,7 +4987,7 @@ var applySkills = async (payload) => {
     if (operation.scope === "PROJECT" && operation.manageGitExclude) {
       await updateManagedExclude(
         operation.folder,
-        relative(operation.folder, destination),
+        relative2(operation.folder, destination),
         operation.kind === "WRITE"
       );
     }
@@ -4551,16 +4997,16 @@ var applySkills = async (payload) => {
 
 // src/handlers/worktrees.ts
 import { createWriteStream, watch } from "node:fs";
-import { mkdtemp, open, readFile as readFile3, realpath as realpath4, rm as rm3, stat as stat4 } from "node:fs/promises";
+import { mkdtemp, open, readFile as readFile3, realpath as realpath4, rm as rm3, stat as stat5 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { basename as basename2, dirname as dirname5, join as join5, relative as relative3 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join6, relative as relative4 } from "node:path";
 import { spawn as spawn4 } from "node:child_process";
 
 // src/git-code-state.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
 import { lstat as lstat3, readlink } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve4, sep as sep3 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function gitEnvironment() {
   return {
@@ -4574,8 +5020,8 @@ function remainingTimeoutMs(deadline) {
 }
 function containedPath(folder, path) {
   const absolutePath = resolve4(folder, path);
-  const difference = relative2(folder, absolutePath);
-  if (!difference || difference === ".." || difference.startsWith(`..${sep2}`) || isAbsolute3(difference)) {
+  const difference = relative3(folder, absolutePath);
+  if (!difference || difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute3(difference)) {
     return null;
   }
   return absolutePath;
@@ -4684,7 +5130,7 @@ async function worktreeCodeStateHash(folder, timeoutMs, signal) {
     if (head.exitCode !== 0 || untracked.exitCode !== 0 || submodules.exitCode !== 0 || operation.signal.aborted) {
       return null;
     }
-    const hash = createHash2("sha256");
+    const hash = createHash3("sha256");
     hash.update("head\0");
     hash.update(head.stdout.trim());
     hash.update("\0diff\0");
@@ -4963,7 +5409,7 @@ async function origin(folder, timeoutMs, signal) {
 }
 async function validateWorktree(input, timeoutMs, signal) {
   const folder = await realpath4(input.folder);
-  if (!(await stat4(folder)).isDirectory())
+  if (!(await stat5(folder)).isDirectory())
     throw new Error("Worktree is missing");
   const observedGitDirectory = await gitDirectory(folder, timeoutMs, signal);
   if (observedGitDirectory !== input.gitDirectory) {
@@ -5047,7 +5493,7 @@ async function inspectWorktreeItem(folderValue2, rootFolder, baseBranch, primary
     return {
       gitDirectory: gitDir,
       folder,
-      relativePath: relative3(rootFolder, folder) || ".",
+      relativePath: relative4(rootFolder, folder) || ".",
       primary,
       branch,
       headSha: headResult.exitCode === 0 ? headResult.stdout.trim() : null,
@@ -5074,7 +5520,7 @@ async function inspectWorktreeItem(folderValue2, rootFolder, baseBranch, primary
     return {
       gitDirectory: folderValue2,
       folder: folderValue2,
-      relativePath: relative3(rootFolder, folderValue2) || ".",
+      relativePath: relative4(rootFolder, folderValue2) || ".",
       primary,
       branch: null,
       headSha: null,
@@ -5190,12 +5636,12 @@ function parseNumstat(value) {
 }
 async function untrackedLines(folder, path) {
   try {
-    const file = await stat4(`${folder}/${path}`);
+    const file = await stat5(`${folder}/${path}`);
     if (!file.isFile() || file.size > 1024 * 1024) return null;
     const contents = await readFile3(`${folder}/${path}`);
     if (contents.includes(0)) return null;
-    const text = contents.toString("utf8");
-    return text ? text.split("\n").length - (text.endsWith("\n") ? 1 : 0) : 0;
+    const text2 = contents.toString("utf8");
+    return text2 ? text2.split("\n").length - (text2.endsWith("\n") ? 1 : 0) : 0;
   } catch {
     return null;
   }
@@ -5401,7 +5847,7 @@ async function comparisonSides(input, folder, timeoutMs, signal) {
   if (!input.path) return { before: null, after: null };
   const path = input.path;
   const previousPath = input.previousPath ?? path;
-  const currentPath = join5(folder, path);
+  const currentPath = join6(folder, path);
   if (input.scope === "UNTRACKED") {
     return { before: null, after: { kind: "FILE", path: currentPath } };
   }
@@ -5485,8 +5931,8 @@ async function availableSide(side, folder, timeoutMs, signal) {
   }
   try {
     const resolved = await realpath4(side.path);
-    const difference = relative3(folder, resolved);
-    return difference !== ".." && !difference.startsWith("../") && (await stat4(resolved)).isFile();
+    const difference = relative4(folder, resolved);
+    return difference !== ".." && !difference.startsWith("../") && (await stat5(resolved)).isFile();
   } catch {
     return false;
   }
@@ -5557,7 +6003,7 @@ async function inspectRequestedDiff(input, folder, timeoutMs, signal) {
   let patch;
   if (input.scope === "UNTRACKED") {
     const bounded = await readBoundedFile(
-      join5(folder, input.path),
+      join6(folder, input.path),
       MAX_DIFF_BYTES
     );
     const contents = bounded.contents;
@@ -5728,7 +6174,7 @@ var downloadWorktreeDiffAsset = async (payload, timeoutMs, signal, _onLog, conte
   try {
     if (selected.kind === "FILE") {
       uploadPath = await realpath4(selected.path);
-      const difference = relative3(folder, uploadPath);
+      const difference = relative4(folder, uploadPath);
       if (difference === ".." || difference.startsWith("../")) {
         throw new Error("Diff image resolves outside the worktree");
       }
@@ -5745,8 +6191,8 @@ var downloadWorktreeDiffAsset = async (payload, timeoutMs, signal, _onLog, conte
       if (!/^\d+$/.test(size) || Number(size) > 20 * 1024 * 1024) {
         throw new Error("Diff image exceeds the 20 MiB limit");
       }
-      temporaryDirectory = await mkdtemp(join5(tmpdir(), "ade-diff-image-"));
-      uploadPath = join5(temporaryDirectory, basename2(input.path));
+      temporaryDirectory = await mkdtemp(join6(tmpdir(), "ade-diff-image-"));
+      uploadPath = join6(temporaryDirectory, basename3(input.path));
       await writeGitObject(
         folder,
         selected.specification,
@@ -5755,14 +6201,14 @@ var downloadWorktreeDiffAsset = async (payload, timeoutMs, signal, _onLog, conte
         signal
       );
     }
-    const information = await stat4(uploadPath);
+    const information = await stat5(uploadPath);
     if (!information.isFile() || information.size > 20 * 1024 * 1024) {
       throw new Error("Diff image exceeds the 20 MiB limit");
     }
     await context.uploadBuildArtifact({
       uploadId: input.uploadId,
       path: uploadPath,
-      filename: basename2(input.path),
+      filename: basename3(input.path),
       contentType: imageContentType(input.path)
     });
     return successfulProcess4;
@@ -5906,7 +6352,7 @@ async function chooseNewBranch(folder, candidates, allowedCurrentBranch, timeout
 }
 async function validateBranchRoot(input, timeoutMs, signal) {
   const rootFolder = await realpath4(input.rootFolder);
-  if (!(await stat4(rootFolder)).isDirectory()) {
+  if (!(await stat5(rootFolder)).isDirectory()) {
     throw new Error("Base repository is missing");
   }
   if (await origin(rootFolder, timeoutMs, signal) !== input.expectedOrigin) {
@@ -5969,13 +6415,13 @@ var branchWorktree = async (payload, timeoutMs, signal) => {
     timeoutMs,
     signal
   ) : input.candidates[0];
-  const targetFolder = input.action === "CREATE" ? join5(
+  const targetFolder = input.action === "CREATE" ? join6(
     dirname5(rootFolder),
-    `${basename2(rootFolder)}-${branch.replaceAll("/", "-")}`
+    `${basename3(rootFolder)}-${branch.replaceAll("/", "-")}`
   ) : changeFolder;
   if (input.action === "CREATE") {
     try {
-      await stat4(targetFolder);
+      await stat5(targetFolder);
       throw new Error(`Worktree folder already exists: ${targetFolder}`);
     } catch (error) {
       if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
@@ -6209,12 +6655,12 @@ var checkoutMovedWorktree = async (payload, timeoutMs, signal) => {
         `Branch ${input.branch} is already checked out in ${occupiedFolder}`
       );
     }
-    targetFolder = join5(
+    targetFolder = join6(
       dirname5(rootFolder),
-      `${basename2(rootFolder)}-${input.branch.replaceAll("/", "-")}`
+      `${basename3(rootFolder)}-${input.branch.replaceAll("/", "-")}`
     );
     try {
-      await stat4(targetFolder);
+      await stat5(targetFolder);
       throw new Error(`Worktree folder already exists: ${targetFolder}`);
     } catch (error) {
       if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") {
@@ -6375,7 +6821,7 @@ var checkoutMovedWorktree = async (payload, timeoutMs, signal) => {
 var deleteWorktree = async (payload, timeoutMs, signal) => {
   const input = worktreeDeleteJobPayload(payload);
   const rootFolder = await realpath4(input.rootFolder);
-  if (!(await stat4(rootFolder)).isDirectory()) {
+  if (!(await stat5(rootFolder)).isDirectory()) {
     throw new Error("Base repository is missing");
   }
   if (await origin(rootFolder, timeoutMs, signal) !== input.expectedOrigin) {
@@ -6569,30 +7015,31 @@ var operateWorktree = async (payload, timeoutMs, signal) => {
 };
 
 // src/handlers/builds.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
 import {
   cp,
   mkdir as mkdir3,
   mkdtemp as mkdtemp2,
   open as open2,
-  readdir as readdir4,
+  readdir as readdir5,
   readFile as readFile4,
   realpath as realpath5,
   rename as rename3,
   rm as rm4,
-  stat as stat5,
+  stat as stat6,
   writeFile as writeFile3
 } from "node:fs/promises";
-import { createWriteStream as createWriteStream2 } from "node:fs";
+import { createReadStream as createReadStream3, createWriteStream as createWriteStream2 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
+import { pipeline } from "node:stream/promises";
 import {
-  basename as basename3,
+  basename as basename4,
   dirname as dirname6,
   isAbsolute as isAbsolute4,
-  join as join6,
-  relative as relative4,
+  join as join7,
+  relative as relative5,
   resolve as resolve5,
-  sep as sep3
+  sep as sep4
 } from "node:path";
 import { spawn as spawn5 } from "node:child_process";
 var successfulProcess5 = {
@@ -6651,7 +7098,7 @@ function requireSuccess3(result, fallback) {
 }
 async function validateWorktree2(input, timeoutMs, signal) {
   const folder = await realpath5(input.folder);
-  if (!(await stat5(folder)).isDirectory())
+  if (!(await stat6(folder)).isDirectory())
     throw new Error("Worktree is missing");
   const gitDirectory2 = requireSuccess3(
     await command2(
@@ -6685,8 +7132,8 @@ async function validateWorktree2(input, timeoutMs, signal) {
 }
 function containedPath2(root, relativePath) {
   const target2 = resolve5(root, relativePath);
-  const difference = relative4(root, target2);
-  if (difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+  const difference = relative5(root, target2);
+  if (difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
     throw new Error("Path must stay within the worktree");
   }
   return target2;
@@ -6694,11 +7141,11 @@ function containedPath2(root, relativePath) {
 async function validateSource(root, source) {
   const target2 = containedPath2(root, source.relativePath);
   const resolved = await realpath5(target2);
-  const difference = relative4(root, resolved);
-  if (difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+  const difference = relative5(root, resolved);
+  if (difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
     throw new Error("Build source resolves outside the worktree");
   }
-  const information = await stat5(resolved);
+  const information = await stat6(resolved);
   if (source.kind === "PACKAGE" && !information.isFile()) {
     throw new Error("Package.swift is missing");
   }
@@ -6712,10 +7159,10 @@ async function discoverSourcesInFolder(folder) {
   const queue = [folder];
   while (queue.length && sources.length < DISCOVERY_LIMIT) {
     const current = queue.shift();
-    for (const entry of await readdir4(current, { withFileTypes: true })) {
+    for (const entry of await readdir5(current, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) continue;
-      const absolute = join6(current, entry.name);
-      const path = relative4(folder, absolute).split(sep3).join("/");
+      const absolute = join7(current, entry.name);
+      const path = relative5(folder, absolute).split(sep4).join("/");
       if (entry.isDirectory()) {
         if (entry.name.endsWith(".xcodeproj")) {
           sources.push({ kind: "PROJECT", relativePath: path });
@@ -6785,7 +7232,7 @@ function metadataFromList(value) {
   };
 }
 async function workspaceProjectPaths(workspacePath2, folder) {
-  const contentsPath = join6(workspacePath2, "contents.xcworkspacedata");
+  const contentsPath = join7(workspacePath2, "contents.xcworkspacedata");
   let contents;
   try {
     contents = await readFile4(contentsPath, "utf8");
@@ -6807,14 +7254,14 @@ async function workspaceProjectPaths(workspacePath2, folder) {
   const projects = [];
   for (const location of locations) {
     const candidate = resolve5(dirname6(workspacePath2), location);
-    const difference = relative4(folder, candidate);
-    if (difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+    const difference = relative5(folder, candidate);
+    if (difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
       continue;
     }
     try {
       const resolved = await realpath5(candidate);
-      const resolvedDifference = relative4(folder, resolved);
-      if (resolvedDifference === ".." || resolvedDifference.startsWith(`..${sep3}`) || isAbsolute4(resolvedDifference) || !(await stat5(resolved)).isDirectory()) {
+      const resolvedDifference = relative5(folder, resolved);
+      if (resolvedDifference === ".." || resolvedDifference.startsWith(`..${sep4}`) || isAbsolute4(resolvedDifference) || !(await stat6(resolved)).isDirectory()) {
         continue;
       }
       projects.push(resolved);
@@ -7029,8 +7476,8 @@ function genericBuildDestinations(action) {
   ];
 }
 async function listPhysicalDevices(timeoutMs, signal) {
-  const directory = await mkdtemp2(join6(tmpdir2(), "ade-devices-"));
-  const output = join6(directory, "devices.json");
+  const directory = await mkdtemp2(join7(tmpdir2(), "ade-devices-"));
+  const output = join7(directory, "devices.json");
   try {
     const result = await command2(
       "xcrun",
@@ -7428,7 +7875,7 @@ function actionArgument(action) {
   }[action];
 }
 function xcodeBuildArguments(input) {
-  const resultBundle = join6(input.artifactDirectory, "result.xcresult");
+  const resultBundle = join7(input.artifactDirectory, "result.xcresult");
   const sourcePath = containedPath2(input.folder, input.source.relativePath);
   const usesCapturedTestProducts = input.action === "TEST_WITHOUT_BUILDING";
   const args = [
@@ -7450,13 +7897,13 @@ function xcodeBuildArguments(input) {
   if (input.action === "ARCHIVE") {
     args.push(
       "-archivePath",
-      join6(input.artifactDirectory, "archive.xcarchive")
+      join7(input.artifactDirectory, "archive.xcarchive")
     );
   }
   if (input.action === "BUILD_FOR_TESTING") {
     args.push(
       "-testProductsPath",
-      join6(input.artifactDirectory, "test-products.xctestproducts")
+      join7(input.artifactDirectory, "test-products.xctestproducts")
     );
   }
   if (input.action === "TEST_WITHOUT_BUILDING" && input.advancedSettings.priorTestProductsPath) {
@@ -7519,15 +7966,15 @@ function classifyFailure(output) {
 }
 async function runHook(options) {
   const phaseDirectory = options.phase === "PRE_BUILD" ? "pre" : "post";
-  const directory = join6(
+  const directory = join7(
     options.input.artifactDirectory,
     "hooks",
     phaseDirectory
   );
   const prefix = `${String(options.script.position).padStart(3, "0")}-${options.script.id}`;
-  const file = join6(directory, `${prefix}.mjs`);
-  const runner = join6(directory, `${prefix}.runner.mjs`);
-  const log = join6(directory, `${prefix}.log`);
+  const file = join7(directory, `${prefix}.mjs`);
+  const runner = join7(directory, `${prefix}.runner.mjs`);
+  const log = join7(directory, `${prefix}.log`);
   const started = Date.now();
   try {
     await mkdir3(directory, { recursive: true, mode: 448 });
@@ -7542,7 +7989,7 @@ async function runHook(options) {
     await writeFile3(
       runner,
       `import { readFile } from "node:fs/promises";
-const hookModule = await import(${JSON.stringify(`./${basename3(file)}`)});
+const hookModule = await import(${JSON.stringify(`./${basename4(file)}`)});
 if (hookModule.default !== undefined && typeof hookModule.default !== "function") {
   throw new TypeError("The default build hook export must be a function");
 }
@@ -7579,7 +8026,7 @@ if (typeof hookModule.default === "function") {
       exitCode: result.exitCode,
       durationMs: Date.now() - started,
       causedBuildFailure: failed && options.script.failureBehavior === "FAIL_BUILD",
-      outputRelativePath: relative4(options.input.artifactDirectory, log),
+      outputRelativePath: relative5(options.input.artifactDirectory, log),
       error: failed ? cleanError3(result.output || "Build hook failed") : null
     };
   } catch (hookError) {
@@ -7592,44 +8039,75 @@ if (typeof hookModule.default === "function") {
       exitCode: null,
       durationMs: Date.now() - started,
       causedBuildFailure: !options.signal.aborted && options.script.failureBehavior === "FAIL_BUILD",
-      outputRelativePath: relative4(options.input.artifactDirectory, log),
+      outputRelativePath: relative5(options.input.artifactDirectory, log),
       error
     };
   }
 }
 async function pathExists(path) {
   try {
-    await stat5(path);
+    await stat6(path);
     return true;
   } catch {
     return false;
   }
 }
 async function pathSize(path) {
-  const information = await stat5(path);
+  const information = await stat6(path);
   if (information.isFile()) return information.size;
   if (!information.isDirectory()) return 0;
   let size = 0;
-  for (const entry of await readdir4(path, { withFileTypes: true })) {
+  for (const entry of await readdir5(path, { withFileTypes: true })) {
     if (entry.isSymbolicLink()) continue;
-    size += await pathSize(join6(path, entry.name));
+    size += await pathSize(join7(path, entry.name));
   }
   return size;
 }
 async function fileChecksum(path) {
   try {
-    const information = await stat5(path);
-    if (!information.isFile() || information.size > 256 * 1024 * 1024)
-      return null;
-    return createHash3("sha256").update(await readFile4(path)).digest("hex");
+    const information = await stat6(path);
+    if (!information.isFile()) return null;
+    const hash = createHash4("sha256");
+    await pipeline(createReadStream3(path), hash);
+    return hash.digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function plistString(plistPath, keyPath, timeoutMs, signal) {
+  try {
+    const result = await command2(
+      "/usr/bin/plutil",
+      ["-extract", keyPath, "raw", "-o", "-", plistPath],
+      Math.min(timeoutMs, 5e3),
+      signal
+    );
+    const value = result.stdout.trim();
+    return result.exitCode === 0 && value ? value : null;
   } catch {
     return null;
   }
 }
+async function archiveApplicationProperties(archivePath, timeoutMs, signal) {
+  const plistPath = join7(archivePath, "Info.plist");
+  const read = (key) => plistString(plistPath, `ApplicationProperties.${key}`, timeoutMs, signal);
+  const [bundleIdentifier2, bundleShortVersion, bundleVersion, applicationPath] = await Promise.all([
+    read("CFBundleIdentifier"),
+    read("CFBundleShortVersionString"),
+    read("CFBundleVersion"),
+    read("ApplicationPath")
+  ]);
+  return {
+    bundleIdentifier: bundleIdentifier2,
+    bundleShortVersion,
+    bundleVersion,
+    applicationName: applicationPath ? basename4(applicationPath).replace(/\.app$/, "") : null
+  };
+}
 async function artifact(root, kind, path, metadata = {}) {
   return {
     kind,
-    relativePath: relative4(root, path).split(sep3).join("/"),
+    relativePath: relative5(root, path).split(sep4).join("/"),
     sizeBytes: await pathSize(path),
     checksum: await fileChecksum(path),
     metadata
@@ -7657,7 +8135,7 @@ function testSourceFile(node, suite) {
     node.sourceFile
   ].find((value) => typeof value === "string" && !!value);
   if (explicit) {
-    return { file: basename3(explicit), filePath: explicit };
+    return { file: basename4(explicit), filePath: explicit };
   }
   const identifier = typeof node.nodeIdentifier === "string" ? node.nodeIdentifier : "";
   const identifierOwner = identifier.split("/")[0]?.trim();
@@ -7770,9 +8248,9 @@ function normalizeCoverage(value) {
   };
 }
 async function writeJsonReport(input, kind, timeoutMs, signal) {
-  const resultBundle = join6(input.artifactDirectory, "result.xcresult");
+  const resultBundle = join7(input.artifactDirectory, "result.xcresult");
   const filename = kind === "TEST_RESULTS" ? "test-results.json" : "code-coverage.json";
-  const destination = join6(input.artifactDirectory, filename);
+  const destination = join7(input.artifactDirectory, filename);
   const temporary = `${destination}.tmp-${randomUUID2()}`;
   try {
     if (!await pathExists(resultBundle)) {
@@ -7907,7 +8385,7 @@ async function snapshotCoverageChanges(input, folder, timeoutMs, signal) {
   const types = changeTypesFromStatus(status2.stdout);
   for (const path of untracked.stdout.split("\0").filter(Boolean)) {
     try {
-      const contents = await readFile4(join6(folder, path));
+      const contents = await readFile4(join7(folder, path));
       if (contents.includes(0)) continue;
       const lineCount = contents.length ? contents.toString("utf8").split("\n").length - (contents.toString("utf8").endsWith("\n") ? 1 : 0) : 0;
       lines.set(
@@ -7936,12 +8414,12 @@ async function addChangedCoverage(report, changes, input, folder, timeoutMs, sig
   let changedExecutableLines = 0;
   for (const change of changes) {
     const coveragePath = coveragePaths.find(
-      (candidate) => relative4(folder, candidate).split(sep3).join("/") === change.path
+      (candidate) => relative5(folder, candidate).split(sep4).join("/") === change.path
     );
     let covered = 0;
     let executable = 0;
     if (coveragePath && change.lines.length) {
-      const temporary2 = join6(
+      const temporary2 = join7(
         input.artifactDirectory,
         `.changed-coverage-${randomUUID2()}.json`
       );
@@ -8002,7 +8480,7 @@ async function addChangedCoverage(report, changes, input, folder, timeoutMs, sig
     changedLineCoverage: changedExecutableLines ? changedCoveredLines / changedExecutableLines : null
   };
   const data = { ...report.data, changedFiles };
-  const destination = join6(input.artifactDirectory, "worktree-coverage.json");
+  const destination = join7(input.artifactDirectory, "worktree-coverage.json");
   const temporary = `${destination}.tmp-${randomUUID2()}`;
   await writeFile3(temporary, JSON.stringify({ summary, data }, null, 2), {
     mode: 384
@@ -8050,13 +8528,13 @@ async function findFiles(root, predicate, limit = 20) {
     const current = queue.shift();
     let entries;
     try {
-      entries = await readdir4(current, { withFileTypes: true });
+      entries = await readdir5(current, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (entry.isSymbolicLink()) continue;
-      const path = join6(current, entry.name);
+      const path = join7(current, entry.name);
       if (entry.isDirectory()) queue.push(path);
       else if (entry.isFile() && predicate(entry.name)) results.push(path);
       if (results.length >= limit) break;
@@ -8066,7 +8544,7 @@ async function findFiles(root, predicate, limit = 20) {
 }
 async function captureArtifacts(input, folder, signal, includeProducts = true) {
   const artifacts = [];
-  const resultBundle = join6(input.artifactDirectory, "result.xcresult");
+  const resultBundle = join7(input.artifactDirectory, "result.xcresult");
   if (await pathExists(resultBundle)) {
     const coverageProbe = await command2(
       "xcrun",
@@ -8093,7 +8571,7 @@ async function captureArtifacts(input, folder, signal, includeProducts = true) {
     );
   }
   if (!includeProducts) return artifacts;
-  const archivePath = join6(input.artifactDirectory, "archive.xcarchive");
+  const archivePath = join7(input.artifactDirectory, "archive.xcarchive");
   if (await pathExists(archivePath)) {
     artifacts.push(
       await artifact(input.artifactDirectory, "ARCHIVE", archivePath)
@@ -8116,10 +8594,10 @@ async function captureArtifacts(input, folder, signal, includeProducts = true) {
   if (apps.length === 1) {
     const settings = apps[0].buildSettings;
     const productName = settings.FULL_PRODUCT_NAME ?? settings.WRAPPER_NAME;
-    const source = settings.TARGET_BUILD_DIR && productName ? join6(settings.TARGET_BUILD_DIR, productName) : null;
+    const source = settings.TARGET_BUILD_DIR && productName ? join7(settings.TARGET_BUILD_DIR, productName) : null;
     if (source && await pathExists(source)) {
-      const productDirectory = join6(input.artifactDirectory, "products");
-      const destination = join6(productDirectory, basename3(source));
+      const productDirectory = join7(input.artifactDirectory, "products");
+      const destination = join7(productDirectory, basename4(source));
       await mkdir3(productDirectory, { recursive: true, mode: 448 });
       await rm4(destination, { recursive: true, force: true });
       await cp(source, destination, {
@@ -8136,7 +8614,7 @@ async function captureArtifacts(input, folder, signal, includeProducts = true) {
     }
   }
   if (input.action === "BUILD_FOR_TESTING") {
-    const testDirectory = join6(
+    const testDirectory = join7(
       input.artifactDirectory,
       "test-products.xctestproducts"
     );
@@ -8151,7 +8629,7 @@ async function captureArtifacts(input, folder, signal, includeProducts = true) {
       )) {
         artifacts.push(
           await artifact(input.artifactDirectory, "XCTESTRUN", file, {
-            testPlan: basename3(file, ".xctestrun")
+            testPlan: basename4(file, ".xctestrun")
           })
         );
       }
@@ -8171,14 +8649,14 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     const testProductsPath = input.advancedSettings.priorTestProductsPath;
     const xctestrunPath = input.advancedSettings.priorXctestrunPath;
     if (testProductsPath) {
-      if (!testProductsPath.endsWith(".xctestproducts") || !await pathExists(testProductsPath) || !(await stat5(testProductsPath)).isDirectory()) {
+      if (!testProductsPath.endsWith(".xctestproducts") || !await pathExists(testProductsPath) || !(await stat6(testProductsPath)).isDirectory()) {
         throw new Error("The captured test-products artifact is unavailable");
       }
-    } else if (!xctestrunPath?.endsWith(".xctestrun") || !await pathExists(xctestrunPath) || !(await stat5(xctestrunPath)).isFile()) {
+    } else if (!xctestrunPath?.endsWith(".xctestrun") || !await pathExists(xctestrunPath) || !(await stat6(xctestrunPath)).isFile()) {
       throw new Error("The captured .xctestrun artifact is unavailable");
     }
   }
-  if (!isAbsolute4(input.artifactDirectory) || basename3(input.artifactDirectory) !== input.buildId) {
+  if (!isAbsolute4(input.artifactDirectory) || basename4(input.artifactDirectory) !== input.buildId) {
     throw new Error("Build artifact directory is invalid");
   }
   const sourceStateHash = await worktreeCodeStateHash(
@@ -8187,11 +8665,11 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     signal
   );
   await mkdir3(input.artifactDirectory, { recursive: true, mode: 448 });
-  const rawLog = join6(input.artifactDirectory, "build.log");
+  const rawLog = join7(input.artifactDirectory, "build.log");
   const logger = new BuildLogger(input.buildId, context, rawLog, process.env);
   try {
     const scriptExecutions = [];
-    const contextPath = join6(input.artifactDirectory, "context.json");
+    const contextPath = join7(input.artifactDirectory, "context.json");
     const baseHookContext = {
       buildId: input.buildId,
       branch: input.branch ?? null,
@@ -8424,7 +8902,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
 };
 var generateIosBuildReport = async (payload, timeoutMs, signal, onLog) => {
   const input = parseBuildReportPayload(payload);
-  if (!isAbsolute4(input.artifactDirectory) || basename3(input.artifactDirectory) !== input.buildId) {
+  if (!isAbsolute4(input.artifactDirectory) || basename4(input.artifactDirectory) !== input.buildId) {
     throw new Error("Build artifact directory is invalid");
   }
   if (signal.aborted) return { ...successfulProcess5, cancelled: true };
@@ -8467,25 +8945,25 @@ var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context
   const target2 = await realpath5(
     containedPath2(root, input.artifactRelativePath)
   );
-  const difference = relative4(root, target2);
-  if (!difference || difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute4(difference)) {
+  const difference = relative5(root, target2);
+  if (!difference || difference === ".." || difference.startsWith(`..${sep4}`) || isAbsolute4(difference)) {
     throw new Error("Build artifact resolves outside the build folder");
   }
-  const information = await stat5(target2);
+  const information = await stat6(target2);
   let uploadPath = target2;
-  let filename = basename3(target2);
+  let filename = basename4(target2);
   let contentType = "application/octet-stream";
   let temporaryArchive = null;
   try {
     if (information.isDirectory()) {
-      temporaryArchive = join6(
+      temporaryArchive = join7(
         tmpdir2(),
         `ade-build-artifact-${randomUUID2()}.tar.gz`
       );
       requireSuccess3(
         await command2(
           "tar",
-          ["-czf", temporaryArchive, "-C", dirname6(target2), basename3(target2)],
+          ["-czf", temporaryArchive, "-C", dirname6(target2), basename4(target2)],
           timeoutMs,
           signal
         ),
@@ -8548,24 +9026,24 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
   if (!await pathExists(appPath) || !appPath.endsWith(".app")) {
     throw new Error("Runnable app artifact is missing");
   }
-  const deploymentsDirectory = join6(input.artifactDirectory, "deployments");
+  const deploymentsDirectory = join7(input.artifactDirectory, "deployments");
   await mkdir3(deploymentsDirectory, { recursive: true, mode: 448 });
   const logger = new BuildLogger(
     input.buildId,
     context,
-    join6(deploymentsDirectory, "deployments.log"),
+    join7(deploymentsDirectory, "deployments.log"),
     process.env
   );
   try {
     const outcomes = [];
     for (const deployment of input.deployments) {
-      const directory = join6(
+      const directory = join7(
         input.artifactDirectory,
         "deployments",
         deployment.id
       );
       await mkdir3(directory, { recursive: true, mode: 448 });
-      const logPath = join6(directory, "deployment.log");
+      const logPath = join7(directory, "deployment.log");
       const started = Date.now();
       let failure = null;
       try {
@@ -8719,7 +9197,7 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
         status: signal.aborted ? "CANCELLED" : failure ? "FAILED" : "SUCCEEDED",
         error: failure,
         durationMs: Date.now() - started,
-        outputRelativePath: relative4(input.artifactDirectory, logPath)
+        outputRelativePath: relative5(input.artifactDirectory, logPath)
       });
       if (signal.aborted) break;
     }
@@ -8735,17 +9213,6 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
     await logger.close();
   }
 };
-function xml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function plistValue(value) {
-  if (typeof value === "boolean") return value ? "<true/>" : "<false/>";
-  if (typeof value === "string") return `<string>${xml(value)}</string>`;
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    return `<dict>${Object.entries(value).map(([key, entry]) => `<key>${xml(key)}</key>${plistValue(entry)}`).join("")}</dict>`;
-  }
-  throw new Error("Unsupported export plist value");
-}
 function exportPlist(settings) {
   const method = {
     DEBUGGING: "debugging",
@@ -8767,10 +9234,7 @@ function exportPlist(settings) {
   if (Object.keys(settings.provisioningProfiles).length) {
     values.provisioningProfiles = settings.provisioningProfiles;
   }
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">${plistValue(values)}</plist>
-`;
+  return plistDocument(values);
 }
 var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
   const input = parseBuildExportPayload(payload);
@@ -8786,14 +9250,14 @@ var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
   if (!await pathExists(archivePath) || !archivePath.endsWith(".xcarchive")) {
     throw new Error("Archive artifact is missing");
   }
-  const exportDirectory = join6(
+  const exportDirectory = join7(
     input.artifactDirectory,
     "exports",
     input.exportId
   );
   await mkdir3(exportDirectory, { recursive: true, mode: 448 });
-  const plistPath = join6(exportDirectory, "ExportOptions.plist");
-  const logPath = join6(exportDirectory, "export.log");
+  const plistPath = join7(exportDirectory, "ExportOptions.plist");
+  const logPath = join7(exportDirectory, "export.log");
   await writeFile3(plistPath, exportPlist(input.settings), { mode: 384 });
   const logger = new BuildLogger(input.buildId, context, logPath, process.env);
   try {
@@ -8825,14 +9289,30 @@ var exportIosArchive = async (payload, timeoutMs, signal, _onLog, context) => {
       signal: result.signal,
       timedOut: result.timedOut,
       cancelled: result.cancelled,
-      outputRelativePath: relative4(input.artifactDirectory, exportDirectory),
+      outputRelativePath: relative5(input.artifactDirectory, exportDirectory),
       sizeBytes: result.exitCode === 0 ? await pathSize(exportDirectory) : null,
-      error: result.exitCode === 0 ? null : cleanError3(result.output)
+      error: result.exitCode === 0 ? null : cleanError3(result.output),
+      artifacts: result.exitCode === 0 ? await exportedArtifacts(input, exportDirectory, archivePath, signal) : []
     };
   } finally {
     await logger.close();
   }
 };
+async function exportedArtifacts(input, exportDirectory, archivePath, signal) {
+  const [ipaPath] = await findFiles(
+    exportDirectory,
+    (name) => name.endsWith(".ipa"),
+    5
+  );
+  if (!ipaPath) return [];
+  return [
+    await artifact(input.artifactDirectory, "IPA", ipaPath, {
+      exportId: input.exportId,
+      exportMethod: input.settings.method,
+      ...await archiveApplicationProperties(archivePath, 1e4, signal)
+    })
+  ];
+}
 
 // src/handlers/index.ts
 var handlers = {
@@ -8869,7 +9349,8 @@ var handlers = {
   [IOS_DEPLOY_JOB_KIND]: deployIosBuild,
   [IOS_EXPORT_JOB_KIND]: exportIosArchive,
   [IOS_TEST_RESULTS_JOB_KIND]: generateIosBuildReport,
-  [IOS_COVERAGE_REPORT_JOB_KIND]: generateIosBuildReport
+  [IOS_COVERAGE_REPORT_JOB_KIND]: generateIosBuildReport,
+  [IOS_SIGNING_INSPECT_JOB_KIND]: inspectIosSigning
 };
 
 // src/repository-coordinator.ts