@invarn/cibuild 2.6.2 → 2.6.3

package/dist/src/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAMA,OAAO,uBAAuB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AASA,OAAO,uBAAuB,CAAC"}

package/dist/src/cli.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { resolve, extname } from "node:path";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
+// Static — see the note in `yaml/steps/android.ts`. `pkg` cannot evaluate a
+// dynamic `import()` of a builtin.
+import { createInterface } from "node:readline";
 import prompts from "prompts";
 import { SecretsManager } from "./yaml/secrets-manager.js";
 import "./yaml/steps/index.js"; // Initialize step registry
@@ -255,7 +258,6 @@ Examples:
             }
             else {
                 // Collect value interactively via readline (handles multiline paste cleanly)
-                const { createInterface } = await import('node:readline');
                 console.log(`\n  Enter value for ${varName}`);
                 console.log('  Paste content, then type . on its own line and press Enter:\n');
                 if (process.stdin.isTTY) {

package/dist/src/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA0I3E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiJ3E"}

package/dist/src/commands/run.js

@@ -109,6 +109,13 @@ export async function handleRunCommand(opts = {}) {
             await runner.runPipeline(pipeline, conversionResult.warnings, conversionResult.skippedSteps);
         }
         else if (isJavaScriptModule) {
+            // The one dynamic import that has to stay dynamic: the specifier is a
+            // user-supplied path, so no bundler can inline it. That means this
+            // branch does NOT work in the `pkg`-built macOS binary — it throws
+            // `Invalid host defined options` before the module loads. Nothing
+            // reaches it today: every curated template is YAML, and the runner only
+            // ever executes YAML pipelines. If JS pipelines are ever exposed as a
+            // supported path, they need a loader that does not rely on `import()`.
             console.log(`Loading pipeline: ${pipelinePath}`);
             const pipelineUrl = pathToFileURL(pipelinePath).href;
             const pipelineModule = await import(pipelineUrl);

package/dist/src/yaml/interactive-prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive-prompts.d.ts","sourceRoot":"","sources":["../../../src/yaml/interactive-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,cAAc,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM;IAK7D;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC;IA4FxB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;YACW,WAAW;IAWzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAyBhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;YACW,eAAe;IAuC7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"interactive-prompts.d.ts","sourceRoot":"","sources":["../../../src/yaml/interactive-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,cAAc,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM;IAK7D;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC;IA4FxB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;YACW,WAAW;IAWzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAyBhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;YACW,eAAe;IAqC7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/src/yaml/interactive-prompts.js

@@ -2,6 +2,9 @@
  * Interactive prompts for missing environment variables
  * Allows users to fill in missing values or cancel the build
  */
+// Static — see the note in `steps/android.ts`. `pkg` cannot evaluate a
+// dynamic `import()` of a builtin.
+import { spawn } from 'node:child_process';
 import prompts from 'prompts';
 /**
  * Interactive prompt manager for collecting missing environment variables
@@ -212,7 +215,6 @@ Finish with a short "Follow-up questions" numbered list only if clarification wo
      * @param text Text to copy
      */
     async copyToClipboard(text) {
-        const { spawn } = await import('child_process');
         return new Promise((resolve, reject) => {
             // Detect platform and use appropriate clipboard command
             const platform = process.platform;

package/dist/src/yaml/step-validator-check-failure.test.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Unit tests for what happens when a pre-execution check cannot run.
+ *
+ * A check that *ran* and found nothing, and a check that *threw* before it
+ * tested anything, are different events. Until 2026-09-01 they were reported
+ * identically: the throw was wrapped in a `Check failed:` message and carried
+ * the requirement's own declared severity. For the Java JDK requirement that
+ * severity is `info` — chosen because the check looks in several places and a
+ * miss is not fatal — so a check that never looked anywhere at all was
+ * reported as information and read as noise.
+ *
+ * It was not noise. The released macOS binary is built with `pkg`, which
+ * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
+ * check opened with two of them and threw `Invalid host defined options` on
+ * every macOS build. It went unseen for as long as the fleet has existed.
+ *
+ * Two rules are pinned here:
+ *   1. a throw is reported at `warning`, whatever the requirement declares;
+ *   2. no check may reach for a Node builtin through a dynamic import, because
+ *      nothing else in the test suite can see that failure — under plain
+ *      `node`, and in the npm bundle, the code works.
+ */
+export {};
+//# sourceMappingURL=step-validator-check-failure.test.d.ts.map

package/dist/src/yaml/step-validator-check-failure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator-check-failure.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-check-failure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/src/yaml/step-validator-check-failure.test.js

@@ -0,0 +1,130 @@
+/**
+ * Unit tests for what happens when a pre-execution check cannot run.
+ *
+ * A check that *ran* and found nothing, and a check that *threw* before it
+ * tested anything, are different events. Until 2026-09-01 they were reported
+ * identically: the throw was wrapped in a `Check failed:` message and carried
+ * the requirement's own declared severity. For the Java JDK requirement that
+ * severity is `info` — chosen because the check looks in several places and a
+ * miss is not fatal — so a check that never looked anywhere at all was
+ * reported as information and read as noise.
+ *
+ * It was not noise. The released macOS binary is built with `pkg`, which
+ * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
+ * check opened with two of them and threw `Invalid host defined options` on
+ * every macOS build. It went unseen for as long as the fleet has existed.
+ *
+ * Two rules are pinned here:
+ *   1. a throw is reported at `warning`, whatever the requirement declares;
+ *   2. no check may reach for a Node builtin through a dynamic import, because
+ *      nothing else in the test suite can see that failure — under plain
+ *      `node`, and in the npm bundle, the code works.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { registerStep } from './steps/registry.js';
+import { BaseStepExecutor } from './steps/base.js';
+import { StepValidator } from './step-validator.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** A step whose single requirement behaves however the test needs it to. */
+function stepWhoseCheck(severity, check) {
+    const name = `probe-${Math.random().toString(36).slice(2)}`;
+    class ProbeStep extends BaseStepExecutor {
+        async execute() {
+            return this.createScriptStep('echo probe', name);
+        }
+        getValidationRequirements() {
+            return [
+                {
+                    category: 'command',
+                    name: 'probe-tool',
+                    description: 'A tool the probe step needs',
+                    timing: 'pre-execution',
+                    severity,
+                    check,
+                },
+            ];
+        }
+    }
+    registerStep(name, new ProbeStep());
+    return name;
+}
+async function validate(stepName) {
+    const validator = new StepValidator({
+        format_version: '1',
+        meta: { invarn: { stack: 'macos-xcode-26.4' } },
+        workflows: { primary: { steps: [{ [`${stepName}@1.0.0`]: { inputs: {} } }] } },
+    }, 'primary', config);
+    return validator.validateWorkflow();
+}
+describe('a check that could not run', () => {
+    test('is reported as a warning even though the requirement declares info', async () => {
+        const name = stepWhoseCheck('info', async () => {
+            throw new Error('Invalid host defined options');
+        });
+        const result = await validate(name);
+        expect(result.counts).toMatchObject({ errors: 0, warnings: 1, info: 0 });
+        expect(result.issues[0].requirement.severity).toBe('warning');
+        expect(result.issues[0].result.message).toBe('Check failed: Invalid host defined options');
+    });
+    test('does not turn a hard requirement into a soft one', async () => {
+        const name = stepWhoseCheck('error', async () => {
+            throw new Error('boom');
+        });
+        const result = await validate(name);
+        // An `error` requirement whose check throws must not be downgraded — that
+        // would let a pipeline proceed past a requirement nothing verified.
+        expect(result.counts).toMatchObject({ errors: 1, warnings: 0, info: 0 });
+        expect(result.valid).toBe(false);
+    });
+    test('leaves a check that ran and failed at its declared severity', async () => {
+        const name = stepWhoseCheck('info', async () => ({
+            passed: false,
+            message: 'Java 17 not found',
+        }));
+        const result = await validate(name);
+        // The whole point of the distinction: this check *worked*. `info` is the
+        // right severity for it and must survive.
+        expect(result.counts).toMatchObject({ errors: 0, warnings: 0, info: 1 });
+        expect(result.issues[0].result.message).toBe('Java 17 not found');
+    });
+});
+/**
+ * The structural half.
+ *
+ * esbuild leaves a dynamic `import()` of a Node builtin in the bundle — the
+ * builtins are external — and `pkg` then cannot evaluate it. Relative
+ * specifiers are inlined by the bundler and are unaffected, which is why
+ * `envman` and `fidelity-trim` work while the JDK check did not.
+ *
+ * There is no runtime test that can catch this: it reproduces only in a
+ * `pkg`-built binary, and `./test.sh` runs under plain `node`. So the rule is
+ * enforced on the source.
+ */
+describe('no source file reaches for a Node builtin through a dynamic import', () => {
+    const BUILTIN = /await import\(\s*['"](?:node:)?(fs|path|os|child_process|readline|crypto|util|url|http|https|net|stream|zlib|tty|events)(?:\/[\w-]+)?['"]\s*\)/;
+    function sourceFiles(dir) {
+        return readdirSync(dir).flatMap((entry) => {
+            const full = join(dir, entry);
+            if (statSync(full).isDirectory())
+                return sourceFiles(full);
+            if (!full.endsWith('.ts') || full.endsWith('.test.ts'))
+                return [];
+            return [full];
+        });
+    }
+    test('src is clean', () => {
+        // Jest runs from the package root; `src` is the whole surface that gets
+        // bundled into the released binary.
+        const offenders = sourceFiles(join(process.cwd(), 'src'))
+            .flatMap((file) => readFileSync(file, 'utf8')
+            .split('\n')
+            .map((line, i) => ({ file, line: line.trim(), n: i + 1 }))
+            .filter(({ line }) => BUILTIN.test(line)))
+            .map(({ file, n, line }) => `${file.replace(/.*\/src\//, 'src/')}:${n}  ${line}`);
+        expect(offenders).toEqual([]);
+    });
+});
+//# sourceMappingURL=step-validator-check-failure.test.js.map

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAsDjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -280,10 +280,22 @@ export class StepValidator {
                 }
             }
             catch (error) {
+                // A check that threw did not run. That is a different event from a
+                // check that ran and found nothing, and it must not inherit the
+                // severity chosen for the latter: `info` is a reasonable verdict for
+                // "looked in several places, found no JDK" and a useless one for
+                // "never looked". Reported at `warning` so it is visible on the first
+                // build — a check whose own failure reads as information can stay
+                // broken for as long as nobody reads carefully.
+                //
+                // `error` is never downgraded. A hard requirement nothing could verify
+                // is not softer than one that was verified and failed.
                 return {
                     stepName,
                     stepIndex,
-                    requirement,
+                    requirement: requirement.severity === 'error'
+                        ? requirement
+                        : { ...requirement, severity: 'warning' },
                     result: {
                         passed: false,
                         message: `Check failed: ${error instanceof Error ? error.message : String(error)}`,

package/dist/src/yaml/steps/android.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA8E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}
+{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA0E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}

package/dist/src/yaml/steps/android.js

@@ -1,6 +1,13 @@
 /**
  * Android step implementations (set-java-version, gradle-build, android-lint, android-unit-test)
  */
+// Static, deliberately. The released macOS binary is built with `pkg`, which
+// cannot evaluate a dynamic `import()` of a builtin — esbuild leaves those
+// external, so they survive into the bundle as real imports and throw
+// `Invalid host defined options` at runtime. A validation check that reaches
+// for one never runs on a runner.
+import { existsSync, readFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { BaseStepExecutor } from './base.js';
 /**
  * Set Java version step executor
@@ -28,8 +35,6 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
      * Matches the logic in execute() method
      */
     async checkJavaVersionWithHomebrew(version) {
-        const { existsSync } = await import('node:fs');
-        const { execSync } = await import('node:child_process');
         // Check Homebrew paths first (same order as execute())
         const homebrewPaths = [
             `/opt/homebrew/opt/openjdk@${version}`, // Apple Silicon
@@ -48,7 +53,6 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
             const jbrPath = '/Applications/Android Studio.app/Contents/jbr/Contents/Home';
             if (existsSync(jbrPath)) {
                 try {
-                    const { readFileSync } = await import('node:fs');
                     const releaseContent = readFileSync(`${jbrPath}/release`, 'utf-8');
                     const jbrVersionMatch = /JAVA_VERSION="(\d+)/.exec(releaseContent);
                     if (jbrVersionMatch && jbrVersionMatch[1] === String(version)) {

package/dist/src/yaml/steps/bitrise-android-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitrise-android-tools.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/bitrise-android-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,gBAAgB;IACnE,yBAAyB,CACvB,OAAO,EAAE,yBAAyB,EAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiD1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyJlH"}
+{"version":3,"file":"bitrise-android-tools.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/bitrise-android-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,gBAAgB;IACnE,yBAAyB,CACvB,OAAO,EAAE,yBAAyB,EAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA+C1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyJlH"}

package/dist/src/yaml/steps/bitrise-android-tools.js

@@ -2,6 +2,10 @@
  * Bitrise install-missing-android-tools step implementation
  * Maps Bitrise install-missing-android-tools@* to CI Build Android environment setup
  */
+// Static — see the note in `android.ts`. A dynamic `import()` of a builtin
+// throws under the `pkg`-built binary the macOS runners use.
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { BaseStepExecutor } from './base.js';
 /**
  * Bitrise install-missing-android-tools step executor (FR-3)
@@ -28,8 +32,6 @@ export class BitriseAndroidToolsStepExecutor extends BaseStepExecutor {
                         };
                     }
                     // Check if we can auto-detect
-                    const { existsSync } = await import('node:fs');
-                    const { homedir } = await import('node:os');
                     const homeDir = homedir();
                     const commonPaths = [
                         `${homeDir}/Library/Android/sdk`, // macOS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",