@invarn/cibuild 2.6.1 → 2.6.3

package/dist/src/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAMA,OAAO,uBAAuB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AASA,OAAO,uBAAuB,CAAC"}

package/dist/src/cli.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { resolve, extname } from "node:path";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
+// Static — see the note in `yaml/steps/android.ts`. `pkg` cannot evaluate a
+// dynamic `import()` of a builtin.
+import { createInterface } from "node:readline";
 import prompts from "prompts";
 import { SecretsManager } from "./yaml/secrets-manager.js";
 import "./yaml/steps/index.js"; // Initialize step registry
@@ -255,7 +258,6 @@ Examples:
             }
             else {
                 // Collect value interactively via readline (handles multiline paste cleanly)
-                const { createInterface } = await import('node:readline');
                 console.log(`\n  Enter value for ${varName}`);
                 console.log('  Paste content, then type . on its own line and press Enter:\n');
                 if (process.stdin.isTTY) {

package/dist/src/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA0I3E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiJ3E"}

package/dist/src/commands/run.js

@@ -109,6 +109,13 @@ export async function handleRunCommand(opts = {}) {
             await runner.runPipeline(pipeline, conversionResult.warnings, conversionResult.skippedSteps);
         }
         else if (isJavaScriptModule) {
+            // The one dynamic import that has to stay dynamic: the specifier is a
+            // user-supplied path, so no bundler can inline it. That means this
+            // branch does NOT work in the `pkg`-built macOS binary — it throws
+            // `Invalid host defined options` before the module loads. Nothing
+            // reaches it today: every curated template is YAML, and the runner only
+            // ever executes YAML pipelines. If JS pipelines are ever exposed as a
+            // supported path, they need a loader that does not rely on `import()`.
             console.log(`Loading pipeline: ${pipelinePath}`);
             const pipelineUrl = pathToFileURL(pipelinePath).href;
             const pipelineModule = await import(pipelineUrl);

package/dist/src/yaml/interactive-prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive-prompts.d.ts","sourceRoot":"","sources":["../../../src/yaml/interactive-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,cAAc,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM;IAK7D;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC;IA4FxB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;YACW,WAAW;IAWzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAyBhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;YACW,eAAe;IAuC7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"interactive-prompts.d.ts","sourceRoot":"","sources":["../../../src/yaml/interactive-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,cAAc,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM;IAK7D;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC;IA4FxB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;YACW,WAAW;IAWzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAyBhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;YACW,eAAe;IAqC7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/src/yaml/interactive-prompts.js

@@ -2,6 +2,9 @@
  * Interactive prompts for missing environment variables
  * Allows users to fill in missing values or cancel the build
  */
+// Static — see the note in `steps/android.ts`. `pkg` cannot evaluate a
+// dynamic `import()` of a builtin.
+import { spawn } from 'node:child_process';
 import prompts from 'prompts';
 /**
  * Interactive prompt manager for collecting missing environment variables
@@ -212,7 +215,6 @@ Finish with a short "Follow-up questions" numbered list only if clarification wo
      * @param text Text to copy
      */
     async copyToClipboard(text) {
-        const { spawn } = await import('child_process');
         return new Promise((resolve, reject) => {
             // Detect platform and use appropriate clipboard command
             const platform = process.platform;

package/dist/src/yaml/meta-helpers.d.ts

@@ -16,4 +16,13 @@
  */
 import type { YAMLCIBuildMeta, YAMLPipeline } from './types.js';
 export declare function getInvarnMeta(pipeline: YAMLPipeline): YAMLCIBuildMeta | undefined;
+/**
+ * Whether the pipeline *declares* an app that spans both mobile platforms.
+ *
+ * Read only from the explicit declaration, never inferred from the steps.
+ * Inference would defeat the point: a workflow that mixes platforms by mistake
+ * is exactly what the gate exists to catch, and it looks identical to one that
+ * does so on purpose.
+ */
+export declare function declaresMultiplatformApp(pipeline: YAMLPipeline): boolean;
 //# sourceMappingURL=meta-helpers.d.ts.map

package/dist/src/yaml/meta-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-helpers.d.ts","sourceRoot":"","sources":["../../../src/yaml/meta-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,SAAS,CAEjF"}
+{"version":3,"file":"meta-helpers.d.ts","sourceRoot":"","sources":["../../../src/yaml/meta-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,SAAS,CAEjF;AAiBD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAGxE"}

package/dist/src/yaml/meta-helpers.js

@@ -17,4 +17,30 @@
 export function getInvarnMeta(pipeline) {
     return pipeline.meta?.invarn ?? pipeline.meta?.['cibuild.io'];
 }
+/**
+ * App types whose build is inherently both platforms in a single pass, and so
+ * whose one workflow legitimately holds both android and ios steps.
+ *
+ * A Kotlin Multiplatform build is the case that forced this: gradle assembles
+ * the XCFramework that `xcodebuild` then consumes, in that order, on one
+ * machine. It cannot be split — a workflow is one dispatch and two workflows
+ * share no filesystem, so the artifact would never reach the second half.
+ *
+ * `ios` and `android` are single-platform by definition. `other` means the app
+ * type was never classified, and an unclassified app has not declared anything
+ * — silence is not permission.
+ */
+const MULTIPLATFORM_APP_TYPES = new Set(['kmm']);
+/**
+ * Whether the pipeline *declares* an app that spans both mobile platforms.
+ *
+ * Read only from the explicit declaration, never inferred from the steps.
+ * Inference would defeat the point: a workflow that mixes platforms by mistake
+ * is exactly what the gate exists to catch, and it looks identical to one that
+ * does so on purpose.
+ */
+export function declaresMultiplatformApp(pipeline) {
+    const platform = getInvarnMeta(pipeline)?.platform;
+    return platform !== undefined && MULTIPLATFORM_APP_TYPES.has(platform);
+}
 //# sourceMappingURL=meta-helpers.js.map

package/dist/src/yaml/step-validator-check-failure.test.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Unit tests for what happens when a pre-execution check cannot run.
+ *
+ * A check that *ran* and found nothing, and a check that *threw* before it
+ * tested anything, are different events. Until 2026-09-01 they were reported
+ * identically: the throw was wrapped in a `Check failed:` message and carried
+ * the requirement's own declared severity. For the Java JDK requirement that
+ * severity is `info` — chosen because the check looks in several places and a
+ * miss is not fatal — so a check that never looked anywhere at all was
+ * reported as information and read as noise.
+ *
+ * It was not noise. The released macOS binary is built with `pkg`, which
+ * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
+ * check opened with two of them and threw `Invalid host defined options` on
+ * every macOS build. It went unseen for as long as the fleet has existed.
+ *
+ * Two rules are pinned here:
+ *   1. a throw is reported at `warning`, whatever the requirement declares;
+ *   2. no check may reach for a Node builtin through a dynamic import, because
+ *      nothing else in the test suite can see that failure — under plain
+ *      `node`, and in the npm bundle, the code works.
+ */
+export {};
+//# sourceMappingURL=step-validator-check-failure.test.d.ts.map

package/dist/src/yaml/step-validator-check-failure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator-check-failure.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-check-failure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/src/yaml/step-validator-check-failure.test.js

@@ -0,0 +1,130 @@
+/**
+ * Unit tests for what happens when a pre-execution check cannot run.
+ *
+ * A check that *ran* and found nothing, and a check that *threw* before it
+ * tested anything, are different events. Until 2026-09-01 they were reported
+ * identically: the throw was wrapped in a `Check failed:` message and carried
+ * the requirement's own declared severity. For the Java JDK requirement that
+ * severity is `info` — chosen because the check looks in several places and a
+ * miss is not fatal — so a check that never looked anywhere at all was
+ * reported as information and read as noise.
+ *
+ * It was not noise. The released macOS binary is built with `pkg`, which
+ * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
+ * check opened with two of them and threw `Invalid host defined options` on
+ * every macOS build. It went unseen for as long as the fleet has existed.
+ *
+ * Two rules are pinned here:
+ *   1. a throw is reported at `warning`, whatever the requirement declares;
+ *   2. no check may reach for a Node builtin through a dynamic import, because
+ *      nothing else in the test suite can see that failure — under plain
+ *      `node`, and in the npm bundle, the code works.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { registerStep } from './steps/registry.js';
+import { BaseStepExecutor } from './steps/base.js';
+import { StepValidator } from './step-validator.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** A step whose single requirement behaves however the test needs it to. */
+function stepWhoseCheck(severity, check) {
+    const name = `probe-${Math.random().toString(36).slice(2)}`;
+    class ProbeStep extends BaseStepExecutor {
+        async execute() {
+            return this.createScriptStep('echo probe', name);
+        }
+        getValidationRequirements() {
+            return [
+                {
+                    category: 'command',
+                    name: 'probe-tool',
+                    description: 'A tool the probe step needs',
+                    timing: 'pre-execution',
+                    severity,
+                    check,
+                },
+            ];
+        }
+    }
+    registerStep(name, new ProbeStep());
+    return name;
+}
+async function validate(stepName) {
+    const validator = new StepValidator({
+        format_version: '1',
+        meta: { invarn: { stack: 'macos-xcode-26.4' } },
+        workflows: { primary: { steps: [{ [`${stepName}@1.0.0`]: { inputs: {} } }] } },
+    }, 'primary', config);
+    return validator.validateWorkflow();
+}
+describe('a check that could not run', () => {
+    test('is reported as a warning even though the requirement declares info', async () => {
+        const name = stepWhoseCheck('info', async () => {
+            throw new Error('Invalid host defined options');
+        });
+        const result = await validate(name);
+        expect(result.counts).toMatchObject({ errors: 0, warnings: 1, info: 0 });
+        expect(result.issues[0].requirement.severity).toBe('warning');
+        expect(result.issues[0].result.message).toBe('Check failed: Invalid host defined options');
+    });
+    test('does not turn a hard requirement into a soft one', async () => {
+        const name = stepWhoseCheck('error', async () => {
+            throw new Error('boom');
+        });
+        const result = await validate(name);
+        // An `error` requirement whose check throws must not be downgraded — that
+        // would let a pipeline proceed past a requirement nothing verified.
+        expect(result.counts).toMatchObject({ errors: 1, warnings: 0, info: 0 });
+        expect(result.valid).toBe(false);
+    });
+    test('leaves a check that ran and failed at its declared severity', async () => {
+        const name = stepWhoseCheck('info', async () => ({
+            passed: false,
+            message: 'Java 17 not found',
+        }));
+        const result = await validate(name);
+        // The whole point of the distinction: this check *worked*. `info` is the
+        // right severity for it and must survive.
+        expect(result.counts).toMatchObject({ errors: 0, warnings: 0, info: 1 });
+        expect(result.issues[0].result.message).toBe('Java 17 not found');
+    });
+});
+/**
+ * The structural half.
+ *
+ * esbuild leaves a dynamic `import()` of a Node builtin in the bundle — the
+ * builtins are external — and `pkg` then cannot evaluate it. Relative
+ * specifiers are inlined by the bundler and are unaffected, which is why
+ * `envman` and `fidelity-trim` work while the JDK check did not.
+ *
+ * There is no runtime test that can catch this: it reproduces only in a
+ * `pkg`-built binary, and `./test.sh` runs under plain `node`. So the rule is
+ * enforced on the source.
+ */
+describe('no source file reaches for a Node builtin through a dynamic import', () => {
+    const BUILTIN = /await import\(\s*['"](?:node:)?(fs|path|os|child_process|readline|crypto|util|url|http|https|net|stream|zlib|tty|events)(?:\/[\w-]+)?['"]\s*\)/;
+    function sourceFiles(dir) {
+        return readdirSync(dir).flatMap((entry) => {
+            const full = join(dir, entry);
+            if (statSync(full).isDirectory())
+                return sourceFiles(full);
+            if (!full.endsWith('.ts') || full.endsWith('.test.ts'))
+                return [];
+            return [full];
+        });
+    }
+    test('src is clean', () => {
+        // Jest runs from the package root; `src` is the whole surface that gets
+        // bundled into the released binary.
+        const offenders = sourceFiles(join(process.cwd(), 'src'))
+            .flatMap((file) => readFileSync(file, 'utf8')
+            .split('\n')
+            .map((line, i) => ({ file, line: line.trim(), n: i + 1 }))
+            .filter(({ line }) => BUILTIN.test(line)))
+            .map(({ file, n, line }) => `${file.replace(/.*\/src\//, 'src/')}:${n}  ${line}`);
+        expect(offenders).toEqual([]);
+    });
+});
+//# sourceMappingURL=step-validator-check-failure.test.js.map

package/dist/src/yaml/step-validator.d.ts

@@ -22,6 +22,7 @@ export declare class StepValidator {
     private yamlFilePath?;
     private availableOutputs;
     private establishedPlatform;
+    private readonly spansPlatforms;
     constructor(pipeline: YAMLPipeline, workflowName: string, config: CIConfig, yamlFilePath?: string);
     /**
      * Validates all steps in the workflow.

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;gBAGtD,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IAwBvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IA8M3D;;OAEG;YACW,mBAAmB;IAsDjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -8,6 +8,7 @@
 import { getStepExecutor, hasStep, getStepMetadata } from './steps/registry.js';
 import { EnvResolver } from './env-resolver.js';
 import { detectPlatformInfo } from './platform-detector.js';
+import { declaresMultiplatformApp } from './meta-helpers.js';
 // POSIX env vars the shell always provides — don't flag these as undeclared.
 // The runner's guest shell seeds HOME, TMPDIR, PATH, etc.; requiring
 // pipelines to redeclare them forces literal-path-only scripts.
@@ -45,6 +46,10 @@ export class StepValidator {
     availableOutputs = new Map();
     // Platform established by the first platform-specific step ('ios' or 'android')
     establishedPlatform = null;
+    // True when the pipeline declares an app that is inherently both platforms
+    // (KMM today), so one workflow may legitimately hold android and ios steps.
+    // Read from the declaration only — see `declaresMultiplatformApp`.
+    spansPlatforms;
     constructor(pipeline, workflowName, config, yamlFilePath) {
         this.pipeline = pipeline;
         this.workflowName = workflowName;
@@ -54,6 +59,7 @@ export class StepValidator {
         if (!this.workflow) {
             throw new Error(`Workflow '${workflowName}' not found in pipeline`);
         }
+        this.spansPlatforms = declaresMultiplatformApp(pipeline);
         // Create env resolver for variable interpolation
         const platformInfo = detectPlatformInfo(pipeline, workflowName);
         this.envResolver = new EnvResolver(pipeline, this.workflow, workflowName, platformInfo.platform, platformInfo.stack, yamlFilePath);
@@ -78,7 +84,11 @@ export class StepValidator {
             // Platform compatibility check
             const stepMetadata = getStepMetadata(parsedStep.name);
             const stepPlatform = stepMetadata?.platform ?? 'all';
-            if (stepPlatform !== 'all') {
+            // A declared multiplatform app is exempt: its build spans both platforms
+            // by construction, so there is no single platform for a step to conflict
+            // with. Everything else — including an app that declares nothing, or
+            // declares one platform and then mixes — is still refused below.
+            if (stepPlatform !== 'all' && !this.spansPlatforms) {
                 if (this.establishedPlatform === null) {
                     // First platform-specific step establishes the workflow platform
                     this.establishedPlatform = stepPlatform;
@@ -270,10 +280,22 @@ export class StepValidator {
                 }
             }
             catch (error) {
+                // A check that threw did not run. That is a different event from a
+                // check that ran and found nothing, and it must not inherit the
+                // severity chosen for the latter: `info` is a reasonable verdict for
+                // "looked in several places, found no JDK" and a useless one for
+                // "never looked". Reported at `warning` so it is visible on the first
+                // build — a check whose own failure reads as information can stay
+                // broken for as long as nobody reads carefully.
+                //
+                // `error` is never downgraded. A hard requirement nothing could verify
+                // is not softer than one that was verified and failed.
                 return {
                     stepName,
                     stepIndex,
-                    requirement,
+                    requirement: requirement.severity === 'error'
+                        ? requirement
+                        : { ...requirement, severity: 'warning' },
                     result: {
                         passed: false,
                         message: `Check failed: ${error instanceof Error ? error.message : String(error)}`,

package/dist/src/yaml/step-validator.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Unit tests for the pre-execution platform gate.
+ *
+ * A workflow's platform is established by its first platform-specific step,
+ * and any later step of a different platform is refused. That rule is right
+ * for an app that targets one platform and wrong for one that targets both:
+ * a Kotlin Multiplatform build is *inherently* android-then-ios — gradle
+ * assembles the XCFramework that `xcodebuild` then consumes — and there is no
+ * way to split it, because a workflow is one dispatch on one machine and two
+ * workflows share no filesystem.
+ *
+ * On 2026-09-01 that cost a real build: a generated KMM pipeline was refused
+ * before a single step ran. These tests pin the narrow relaxation that fixes
+ * it — permitted only where the pipeline *declares* a multiplatform app,
+ * never inferred from the steps themselves.
+ */
+import '../yaml/steps/index.js';
+//# sourceMappingURL=step-validator.test.d.ts.map

package/dist/src/yaml/step-validator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,wBAAwB,CAAC"}

package/dist/src/yaml/step-validator.test.js

@@ -0,0 +1,140 @@
+/**
+ * Unit tests for the pre-execution platform gate.
+ *
+ * A workflow's platform is established by its first platform-specific step,
+ * and any later step of a different platform is refused. That rule is right
+ * for an app that targets one platform and wrong for one that targets both:
+ * a Kotlin Multiplatform build is *inherently* android-then-ios — gradle
+ * assembles the XCFramework that `xcodebuild` then consumes — and there is no
+ * way to split it, because a workflow is one dispatch on one machine and two
+ * workflows share no filesystem.
+ *
+ * On 2026-09-01 that cost a real build: a generated KMM pipeline was refused
+ * before a single step ran. These tests pin the narrow relaxation that fixes
+ * it — permitted only where the pipeline *declares* a multiplatform app,
+ * never inferred from the steps themselves.
+ */
+import { describe, test, expect } from '@jest/globals';
+import '../yaml/steps/index.js';
+import { StepValidator } from './step-validator.js';
+import { PlatformDetectionError } from './platform-detector.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** What every curated template declares, and what the detector reads first. */
+const STACK = 'macos-xcode-26.4';
+/**
+ * A KMM build in one workflow: gradle establishes android, xcodebuild follows.
+ *
+ * The stack is not decoration. `PlatformDetector` resolves the host OS from it
+ * first and only falls back to reading the steps — where a mixed workflow
+ * throws before this validator ever runs. Every curated template declares a
+ * stack, so this is the gate a real pipeline actually meets.
+ *
+ * `getInvarnMeta` takes `meta.invarn` as a whole when it is present, so a test
+ * about the legacy block has to omit `meta.invarn` entirely.
+ */
+function kmmShapedPipeline({ invarn, legacy } = {}, { stack = true } = {}) {
+    const base = stack ? { stack: STACK } : {};
+    const meta = legacy && !invarn
+        ? { 'cibuild.io': { ...base, ...legacy } }
+        : {
+            invarn: { ...base, ...invarn },
+            ...(legacy ? { 'cibuild.io': { ...base, ...legacy } } : {}),
+        };
+    return {
+        format_version: '1',
+        meta,
+        workflows: {
+            primary: {
+                steps: [
+                    { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
+                    {
+                        'xcodebuild@1.0.0': {
+                            inputs: {
+                                project_path: 'iosApp/iosApp.xcodeproj',
+                                scheme: 'iosApp',
+                                destination: 'generic/platform=iOS Simulator',
+                            },
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+async function platformIssues(pipeline) {
+    const validator = new StepValidator(pipeline, 'primary', config);
+    const result = await validator.validateWorkflow();
+    return (result.issuesByCategory.get('platform') ?? []).map((i) => i.requirement.name);
+}
+describe('StepValidator platform gate', () => {
+    test('refuses a mixed workflow that declares no app platform', async () => {
+        expect(await platformIssues(kmmShapedPipeline())).toEqual(['xcodebuild']);
+    });
+    test('permits a mixed workflow that declares a KMM app', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'kmm' } }))).toEqual([]);
+    });
+    test('permits it through the legacy meta.cibuild.io block too', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ legacy: { platform: 'kmm' } }))).toEqual([]);
+    });
+    // meta.invarn wins as a whole when both blocks are present, so a stale
+    // `kmm` under the legacy key must not grant permission the current block
+    // withholds.
+    test('lets meta.invarn withhold what a stale meta.cibuild.io granted', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'android' }, legacy: { platform: 'kmm' } }))).toEqual(['xcodebuild']);
+    });
+    // The regression this relaxation could introduce. A declared platform, never
+    // inference: an ios step in a workflow that says it is android stays refused.
+    test('still refuses an ios step in a declared-android workflow', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'android' } }))).toEqual([
+            'xcodebuild',
+        ]);
+    });
+    test('still refuses an android step in a declared-ios workflow', async () => {
+        const iosFirst = {
+            format_version: '1',
+            meta: { invarn: { stack: STACK, platform: 'ios' } },
+            workflows: {
+                primary: {
+                    steps: [
+                        { 'xcodebuild@1.0.0': { inputs: { project_path: 'App.xcodeproj', scheme: 'App' } } },
+                        { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
+                    ],
+                },
+            },
+        };
+        expect(await platformIssues(iosFirst)).toEqual(['gradle-build']);
+    });
+    // 'other' means the app type was not classified. An unclassified app has not
+    // declared that it spans platforms; silence is not permission.
+    test('still refuses when the declared platform is other', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'other' } }))).toEqual([
+            'xcodebuild',
+        ]);
+    });
+    // The declaration is about mixing, not about skipping the gate: a
+    // single-platform workflow was never at risk either way.
+    test('leaves a single-platform workflow alone whatever it declares', async () => {
+        const androidOnly = {
+            format_version: '1',
+            meta: { invarn: { stack: STACK, platform: 'kmm' } },
+            workflows: {
+                primary: {
+                    steps: [
+                        { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
+                    ],
+                },
+            },
+        };
+        expect(await platformIssues(androidOnly)).toEqual([]);
+    });
+    // Declaring the app's platform does not tell the detector which host OS to
+    // ask for, and a mixed workflow cannot be read off its steps. That refusal
+    // is `PlatformDetector`'s and comes first — it is not relaxed here, and its
+    // own message already says what to add.
+    test('does not substitute for the stack a mixed workflow still needs', async () => {
+        const noStack = kmmShapedPipeline({ invarn: { platform: 'kmm' } }, { stack: false });
+        expect(() => new StepValidator(noStack, 'primary', config)).toThrow(PlatformDetectionError);
+    });
+});
+//# sourceMappingURL=step-validator.test.js.map

package/dist/src/yaml/steps/android.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA8E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}
+{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA0E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}

package/dist/src/yaml/steps/android.js

@@ -1,6 +1,13 @@
 /**
  * Android step implementations (set-java-version, gradle-build, android-lint, android-unit-test)
  */
+// Static, deliberately. The released macOS binary is built with `pkg`, which
+// cannot evaluate a dynamic `import()` of a builtin — esbuild leaves those
+// external, so they survive into the bundle as real imports and throw
+// `Invalid host defined options` at runtime. A validation check that reaches
+// for one never runs on a runner.
+import { existsSync, readFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { BaseStepExecutor } from './base.js';
 /**
  * Set Java version step executor
@@ -28,8 +35,6 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
      * Matches the logic in execute() method
      */
     async checkJavaVersionWithHomebrew(version) {
-        const { existsSync } = await import('node:fs');
-        const { execSync } = await import('node:child_process');
         // Check Homebrew paths first (same order as execute())
         const homebrewPaths = [
             `/opt/homebrew/opt/openjdk@${version}`, // Apple Silicon
@@ -48,7 +53,6 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
             const jbrPath = '/Applications/Android Studio.app/Contents/jbr/Contents/Home';
             if (existsSync(jbrPath)) {
                 try {
-                    const { readFileSync } = await import('node:fs');
                     const releaseContent = readFileSync(`${jbrPath}/release`, 'utf-8');
                     const jbrVersionMatch = /JAVA_VERSION="(\d+)/.exec(releaseContent);
                     if (jbrVersionMatch && jbrVersionMatch[1] === String(version)) {

package/dist/src/yaml/steps/bitrise-android-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitrise-android-tools.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/bitrise-android-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,gBAAgB;IACnE,yBAAyB,CACvB,OAAO,EAAE,yBAAyB,EAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiD1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyJlH"}
+{"version":3,"file":"bitrise-android-tools.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/bitrise-android-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,gBAAgB;IACnE,yBAAyB,CACvB,OAAO,EAAE,yBAAyB,EAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA+C1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyJlH"}

package/dist/src/yaml/steps/bitrise-android-tools.js

@@ -2,6 +2,10 @@
  * Bitrise install-missing-android-tools step implementation
  * Maps Bitrise install-missing-android-tools@* to CI Build Android environment setup
  */
+// Static — see the note in `android.ts`. A dynamic `import()` of a builtin
+// throws under the `pkg`-built binary the macOS runners use.
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { BaseStepExecutor } from './base.js';
 /**
  * Bitrise install-missing-android-tools step executor (FR-3)
@@ -28,8 +32,6 @@ export class BitriseAndroidToolsStepExecutor extends BaseStepExecutor {
                         };
                     }
                     // Check if we can auto-detect
-                    const { existsSync } = await import('node:fs');
-                    const { homedir } = await import('node:os');
                     const homeDir = homedir();
                     const commonPaths = [
                         `${homeDir}/Library/Android/sdk`, // macOS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",