@invarn/cibuild 2.9.4 → 2.9.7

package/dist/src/yaml/step-validator.js

@@ -1,466 +0,0 @@
-/**
- * Pre-execution validation orchestrator
- *
- * Validates all steps in a workflow BEFORE execution begins.
- * All validation checks are READ-ONLY and safe to run on the user's machine.
- * This enables catching all issues at once instead of failing on the first error.
- */
-import { getStepExecutor, hasStep, getStepMetadata } from './steps/registry.js';
-import { EnvResolver } from './env-resolver.js';
-import { shellAssignedNames } from './shell-assignments.js';
-import { detectPlatformInfo } from './platform-detector.js';
-import { declaresMultiplatformApp } from './meta-helpers.js';
-// POSIX env vars the shell always provides — don't flag these as undeclared.
-// The runner's guest shell seeds HOME, TMPDIR, PATH, etc.; requiring
-// pipelines to redeclare them forces literal-path-only scripts.
-const POSIX_ENV_ALLOWLIST = new Set([
-    'HOME',
-    'USER',
-    'PATH',
-    'TMPDIR',
-    'TMP',
-    'TEMP',
-    'SHELL',
-    'LANG',
-    'LC_ALL',
-    'PWD',
-    'LOGNAME',
-    'HOSTNAME',
-    // Runner-provided vars (set in the sandbox execution script)
-    'CIBUILD_USER_HOME',
-    'CIBUILD_SCRATCH',
-    'JAVA_HOME',
-]);
-/**
- * StepValidator orchestrates pre-execution validation for a workflow.
- * It iterates through all steps, collects validation requirements,
- * runs pre-execution checks, and aggregates all issues.
- */
-export class StepValidator {
-    pipeline;
-    workflow;
-    workflowName;
-    config;
-    envResolver;
-    yamlFilePath;
-    // Track outputs provided by earlier steps for dependency validation
-    availableOutputs = new Map();
-    // Platform established by the first platform-specific step ('ios' or 'android')
-    establishedPlatform = null;
-    // True when the pipeline declares an app that is inherently both platforms
-    // (KMM today), so one workflow may legitimately hold android and ios steps.
-    // Read from the declaration only — see `declaresMultiplatformApp`.
-    spansPlatforms;
-    constructor(pipeline, workflowName, config, yamlFilePath) {
-        this.pipeline = pipeline;
-        this.workflowName = workflowName;
-        this.workflow = pipeline.workflows[workflowName];
-        this.config = config;
-        this.yamlFilePath = yamlFilePath;
-        if (!this.workflow) {
-            throw new Error(`Workflow '${workflowName}' not found in pipeline`);
-        }
-        this.spansPlatforms = declaresMultiplatformApp(pipeline);
-        // Create env resolver for variable interpolation
-        const platformInfo = detectPlatformInfo(pipeline, workflowName);
-        this.envResolver = new EnvResolver(pipeline, this.workflow, workflowName, platformInfo.platform, platformInfo.stack, yamlFilePath);
-    }
-    /**
-     * Validates all steps in the workflow.
-     * Returns a complete validation result with all issues grouped by step and category.
-     */
-    async validateWorkflow() {
-        const issues = [];
-        const issuesByStep = new Map();
-        const issuesByCategory = new Map();
-        let stepIndex = 0;
-        for (const yamlStep of this.workflow.steps) {
-            const parsedStep = this.parseStep(yamlStep, stepIndex);
-            // Skip unrecognized steps (they'll be handled by converter with warnings)
-            if (!hasStep(parsedStep.name)) {
-                stepIndex++;
-                continue;
-            }
-            const executor = getStepExecutor(parsedStep.name);
-            // Platform compatibility check
-            const stepMetadata = getStepMetadata(parsedStep.name);
-            const stepPlatform = stepMetadata?.platform ?? 'all';
-            // A declared multiplatform app is exempt: its build spans both platforms
-            // by construction, so there is no single platform for a step to conflict
-            // with. Everything else — including an app that declares nothing, or
-            // declares one platform and then mixes — is still refused below.
-            if (stepPlatform !== 'all' && !this.spansPlatforms) {
-                if (this.establishedPlatform === null) {
-                    // First platform-specific step establishes the workflow platform
-                    this.establishedPlatform = stepPlatform;
-                }
-                else if (this.establishedPlatform !== stepPlatform) {
-                    // This step conflicts with the established platform
-                    const platformIssue = {
-                        stepName: parsedStep.title || parsedStep.name,
-                        stepIndex,
-                        requirement: {
-                            category: 'platform',
-                            name: parsedStep.name,
-                            description: `'${parsedStep.name}' is an ${stepPlatform} step but this workflow targets ${this.establishedPlatform}`,
-                            timing: 'pre-execution',
-                            severity: 'error',
-                            hint: `Remove this step or move it to a dedicated ${stepPlatform} workflow`,
-                            check: async () => ({
-                                passed: false,
-                                message: `Cross-platform step: '${parsedStep.name}' (${stepPlatform}) cannot be used in an ${this.establishedPlatform} workflow`,
-                            }),
-                        },
-                        result: {
-                            passed: false,
-                            message: `Cross-platform step: '${parsedStep.name}' (${stepPlatform}) cannot be used in an ${this.establishedPlatform} workflow`,
-                        },
-                    };
-                    issues.push(platformIssue);
-                    const stepIssues = issuesByStep.get(platformIssue.stepName) || [];
-                    stepIssues.push(platformIssue);
-                    issuesByStep.set(platformIssue.stepName, stepIssues);
-                    const catIssues = issuesByCategory.get('platform') || [];
-                    catIssues.push(platformIssue);
-                    issuesByCategory.set('platform', catIssues);
-                    stepIndex++;
-                    continue;
-                }
-            }
-            // Skip all validation for steps that will be skipped in local mode
-            if (this.config.local && executor.isSkippedInLocalMode?.()) {
-                if (executor.getOutputs) {
-                    for (const output of executor.getOutputs()) {
-                        this.availableOutputs.set(output.name, { stepName: parsedStep.name, output });
-                    }
-                }
-                stepIndex++;
-                continue;
-            }
-            // Get validation requirements if the executor supports it
-            if (executor.getValidationRequirements) {
-                // Interpolate inputs (but don't throw on missing vars during validation)
-                let interpolatedInputs = parsedStep.inputs;
-                try {
-                    interpolatedInputs = this.envResolver.interpolateObject(parsedStep.inputs, parsedStep.title || parsedStep.name);
-                }
-                catch {
-                    // Interpolation failed because a variable isn't set yet.
-                    // Use a lenient copy: strip unresolved $VAR / ${VAR} references to ''
-                    // so getValidationRequirements can correctly detect them as missing.
-                    interpolatedInputs = this.stripUnresolvedVars(parsedStep.inputs);
-                }
-                const requirements = executor.getValidationRequirements(interpolatedInputs, this.envResolver.getAll(), this.config);
-                // Validate each requirement
-                for (const req of requirements) {
-                    const issue = await this.validateRequirement(req, parsedStep.title || parsedStep.name, stepIndex);
-                    if (issue) {
-                        issues.push(issue);
-                        // Group by step
-                        const stepIssues = issuesByStep.get(issue.stepName) || [];
-                        stepIssues.push(issue);
-                        issuesByStep.set(issue.stepName, stepIssues);
-                        // Group by category
-                        const catIssues = issuesByCategory.get(issue.requirement.category) || [];
-                        catIssues.push(issue);
-                        issuesByCategory.set(issue.requirement.category, catIssues);
-                    }
-                }
-                // Auto-discover any $VAR references in raw inputs that aren't covered above
-                const resolvedEnv = this.envResolver.getAll();
-                const alreadyDeclared = new Set(requirements.map((r) => r.name));
-                const referencedVars = this.extractVariableReferences(parsedStep.inputs);
-                // Variables the step's own shell sets are not values anyone owes it.
-                const selfAssigned = shellAssignedNames(parsedStep.inputs);
-                for (const varName of referencedVars) {
-                    // Skip POSIX vars the shell always provides
-                    if (POSIX_ENV_ALLOWLIST.has(varName))
-                        continue;
-                    // Skip anything this step's script assigns itself — a computed local
-                    // reads like a required input, and refusing on one stops a pipeline
-                    // for a value nothing was ever meant to supply.
-                    if (selfAssigned.has(varName))
-                        continue;
-                    // Skip if already in resolved env (use hasOwnProperty so empty-string
-                    // values set by the YAML/secrets are still treated as "provided")
-                    if (Object.prototype.hasOwnProperty.call(resolvedEnv, varName))
-                        continue;
-                    // Skip if the runner (or the surrounding shell) already exported
-                    // the var into our process.env. The sandbox runner delivers
-                    // dispatch-supplied `execution.env` / `execution.secrets` this
-                    // way — without this fallback, bash-style `$VAR` refs in
-                    // repo-hosted YAML (human CLI flow) would false-trigger the
-                    // auto-discovery even though they resolve at shell runtime.
-                    if (Object.prototype.hasOwnProperty.call(process.env, varName))
-                        continue;
-                    // Skip if provided as output by an earlier step
-                    if (this.availableOutputs.has(varName))
-                        continue;
-                    // Skip if already declared by getValidationRequirements
-                    if (alreadyDeclared.has(varName))
-                        continue;
-                    // Skip if already added by a previous step
-                    if (issues.some((i) => i.requirement.name === varName))
-                        continue;
-                    // Skippable steps won't block the build if they fail — downgrade to warning
-                    // so missing vars don't prevent the run when the step can safely be skipped.
-                    const severity = parsedStep.is_skippable ? 'warning' : 'error';
-                    const req = {
-                        category: 'environment',
-                        name: varName,
-                        description: `${varName} is not set`,
-                        timing: 'pre-execution',
-                        severity,
-                        check: async () => ({ passed: false, message: `${varName} is not set` }),
-                    };
-                    const issue = await this.validateRequirement(req, parsedStep.title || parsedStep.name, stepIndex);
-                    if (issue) {
-                        issues.push(issue);
-                        const stepIssues = issuesByStep.get(issue.stepName) || [];
-                        stepIssues.push(issue);
-                        issuesByStep.set(issue.stepName, stepIssues);
-                        const catIssues = issuesByCategory.get(issue.requirement.category) || [];
-                        catIssues.push(issue);
-                        issuesByCategory.set(issue.requirement.category, catIssues);
-                    }
-                }
-            }
-            // Record outputs this step provides for later steps
-            if (executor.getOutputs) {
-                for (const output of executor.getOutputs()) {
-                    this.availableOutputs.set(output.name, {
-                        stepName: parsedStep.name,
-                        output,
-                    });
-                }
-            }
-            stepIndex++;
-        }
-        // Count issues by severity
-        const counts = {
-            errors: issues.filter((i) => i.requirement.severity === 'error').length,
-            warnings: issues.filter((i) => i.requirement.severity === 'warning').length,
-            info: issues.filter((i) => i.requirement.severity === 'info').length,
-        };
-        return {
-            valid: counts.errors === 0,
-            issues,
-            issuesByStep,
-            issuesByCategory,
-            counts,
-        };
-    }
-    /**
-     * Validates a single requirement and returns an issue if it fails
-     */
-    async validateRequirement(requirement, stepName, stepIndex) {
-        // Skip runtime-only checks (they can't be validated before execution)
-        if (requirement.timing === 'runtime') {
-            // For runtime dependencies, check if the providing step exists earlier
-            if (requirement.providedBy) {
-                const provider = this.availableOutputs.get(requirement.name);
-                if (!provider) {
-                    // Nothing declares this name as an output, so say where it does come
-                    // from and leave it at that. `providedBy` is prose: most of these
-                    // requirements are named after a path or a command rather than a
-                    // step output, so the lookup above was never going to match one, and
-                    // the sentence must stay true when the source is not a step at all.
-                    return {
-                        stepName,
-                        stepIndex,
-                        requirement,
-                        result: {
-                            passed: false,
-                            message: `'${requirement.name}' is not here yet — expected from ${requirement.providedBy} at runtime`,
-                        },
-                    };
-                }
-            }
-            return null; // Skip other runtime checks
-        }
-        // Run the check if available
-        if (requirement.check) {
-            try {
-                const result = await requirement.check();
-                if (!result.passed) {
-                    return {
-                        stepName,
-                        stepIndex,
-                        requirement,
-                        result,
-                    };
-                }
-            }
-            catch (error) {
-                // A check that threw did not run. That is a different event from a
-                // check that ran and found nothing, and it must not inherit the
-                // severity chosen for the latter: `info` is a reasonable verdict for
-                // "looked in several places, found no JDK" and a useless one for
-                // "never looked". Reported at `warning` so it is visible on the first
-                // build — a check whose own failure reads as information can stay
-                // broken for as long as nobody reads carefully.
-                //
-                // `error` is never downgraded. A hard requirement nothing could verify
-                // is not softer than one that was verified and failed.
-                return {
-                    stepName,
-                    stepIndex,
-                    requirement: requirement.severity === 'error'
-                        ? requirement
-                        : { ...requirement, severity: 'warning' },
-                    result: {
-                        passed: false,
-                        message: `Check failed: ${error instanceof Error ? error.message : String(error)}`,
-                    },
-                };
-            }
-        }
-        return null;
-    }
-    /**
-     * Extracts all $VAR and ${VAR} variable names referenced in an object recursively.
-     *
-     * `${{ secrets.X }}` / `${{ vars.X }}` references are deliberately ignored:
-     * those are resolved by the runner-side interpolator before cibuild sees
-     * the YAML (or by the dashboard's secrets-resolver on dispatch). Without
-     * this filter the inner regex would capture `{ secrets.X ` as if it were
-     * a `${VAR}` reference, producing garbled variable names in the
-     * missing-env error output.
-     */
-    extractVariableReferences(obj) {
-        const vars = new Set();
-        if (typeof obj === 'string') {
-            // Strip `${{ ... }}` refs first so they can't be mis-matched as `${VAR}`.
-            const sanitized = obj.replace(/\$\{\{[^}]*\}\}/g, '');
-            const pattern = /\$\{([^}]+)\}|\$([A-Z_][A-Z_0-9]*)/g;
-            let match;
-            while ((match = pattern.exec(sanitized)) !== null) {
-                vars.add(match[1] || match[2]);
-            }
-        }
-        else if (Array.isArray(obj)) {
-            for (const item of obj) {
-                for (const v of this.extractVariableReferences(item))
-                    vars.add(v);
-            }
-        }
-        else if (obj && typeof obj === 'object') {
-            for (const value of Object.values(obj)) {
-                for (const v of this.extractVariableReferences(value))
-                    vars.add(v);
-            }
-        }
-        return vars;
-    }
-    /**
-     * Replaces all unresolved $VAR and ${VAR} references with empty string.
-     * Used as a lenient fallback when full interpolation fails, so that
-     * getValidationRequirements can detect truly-missing variables correctly.
-     *
-     * `${{ ... }}` refs are left intact — they belong to the runner-side
-     * interpolator / dashboard secrets-resolver layer, not to shell-level
-     * variable substitution. Stripping them here would destroy the YAML for
-     * any downstream consumer that still expects to see them.
-     */
-    stripUnresolvedVars(obj) {
-        if (typeof obj === 'string') {
-            // `(?!\{)` prevents `\$\{[^}]+\}` from matching a leading `${` of
-            // `${{ ... }}` and stripping the inner content. Plain `$VAR` and
-            // `${VAR}` are still stripped as before.
-            return obj.replace(/\$\{(?!\{)[^}]+\}|\$[A-Z_][A-Z_0-9]*/g, '');
-        }
-        if (Array.isArray(obj)) {
-            return obj.map((item) => this.stripUnresolvedVars(item));
-        }
-        if (obj && typeof obj === 'object') {
-            const result = {};
-            for (const [key, value] of Object.entries(obj)) {
-                result[key] = this.stripUnresolvedVars(value);
-            }
-            return result;
-        }
-        return obj;
-    }
-    /**
-     * Parses a YAML step into a ParsedStep (simplified version of converter logic)
-     */
-    parseStep(yamlStep, _index) {
-        const stepKeys = Object.keys(yamlStep);
-        const stepNameWithVersion = stepKeys[0];
-        const stepConfig = yamlStep[stepNameWithVersion];
-        const atIndex = stepNameWithVersion.indexOf('@');
-        const name = atIndex === -1 ? stepNameWithVersion : stepNameWithVersion.substring(0, atIndex);
-        const version = atIndex === -1 ? undefined : stepNameWithVersion.substring(atIndex + 1);
-        let inputs = stepConfig?.inputs || {};
-        if (Array.isArray(inputs)) {
-            const inputsObj = {};
-            for (const input of inputs) {
-                if (typeof input === 'object' && input !== null) {
-                    Object.assign(inputsObj, input);
-                }
-            }
-            inputs = inputsObj;
-        }
-        return {
-            name,
-            version,
-            title: stepConfig?.title,
-            inputs,
-            run_if: stepConfig?.run_if,
-            is_always_run: stepConfig?.is_always_run,
-            is_skippable: stepConfig?.is_skippable,
-        };
-    }
-}
-/**
- * Format validation result for console output
- */
-export function formatValidationResult(result) {
-    if (result.valid && result.issues.length === 0) {
-        return '\n✅ All pre-execution validations passed\n';
-    }
-    const lines = [];
-    lines.push('\n' + '═'.repeat(70));
-    lines.push('PRE-EXECUTION VALIDATION RESULTS');
-    lines.push('═'.repeat(70));
-    // Summary
-    lines.push(`\n📊 Summary: ${result.counts.errors} error${result.counts.errors !== 1 ? 's' : ''}, ` +
-        `${result.counts.warnings} warning${result.counts.warnings !== 1 ? 's' : ''}, ` +
-        `${result.counts.info} info\n`);
-    // Group by step
-    for (const [stepName, stepIssues] of result.issuesByStep) {
-        const errors = stepIssues.filter((i) => i.requirement.severity === 'error');
-        const warnings = stepIssues.filter((i) => i.requirement.severity === 'warning');
-        const infos = stepIssues.filter((i) => i.requirement.severity === 'info');
-        lines.push(`\n📦 Step: ${stepName}`);
-        lines.push('─'.repeat(50));
-        for (const issue of errors) {
-            lines.push(`  ❌ ERROR: ${issue.requirement.description}`);
-            lines.push(`     ${issue.result.message}`);
-            if (issue.requirement.hint) {
-                lines.push(`     💡 ${issue.requirement.hint}`);
-            }
-        }
-        for (const issue of warnings) {
-            lines.push(`  ⚠️  WARNING: ${issue.requirement.description}`);
-            lines.push(`     ${issue.result.message}`);
-            if (issue.requirement.hint) {
-                lines.push(`     💡 ${issue.requirement.hint}`);
-            }
-        }
-        for (const issue of infos) {
-            lines.push(`  ℹ️  INFO: ${issue.requirement.description}`);
-            lines.push(`     ${issue.result.message}`);
-        }
-    }
-    lines.push('\n' + '═'.repeat(70));
-    if (result.counts.errors > 0) {
-        lines.push('❌ Validation failed. Please fix the errors above before running the pipeline.');
-    }
-    else {
-        lines.push('⚠️  Validation passed with warnings. Pipeline can proceed.');
-    }
-    lines.push('═'.repeat(70) + '\n');
-    return lines.join('\n');
-}
-//# sourceMappingURL=step-validator.js.map

package/dist/src/yaml/step-validator.test.d.ts

@@ -1,18 +0,0 @@
-/**
- * Unit tests for the pre-execution platform gate.
- *
- * A workflow's platform is established by its first platform-specific step,
- * and any later step of a different platform is refused. That rule is right
- * for an app that targets one platform and wrong for one that targets both:
- * a Kotlin Multiplatform build is *inherently* android-then-ios — gradle
- * assembles the XCFramework that `xcodebuild` then consumes — and there is no
- * way to split it, because a workflow is one dispatch on one machine and two
- * workflows share no filesystem.
- *
- * On 2026-09-01 that cost a real build: a generated KMM pipeline was refused
- * before a single step ran. These tests pin the narrow relaxation that fixes
- * it — permitted only where the pipeline *declares* a multiplatform app,
- * never inferred from the steps themselves.
- */
-import '../yaml/steps/index.js';
-//# sourceMappingURL=step-validator.test.d.ts.map

package/dist/src/yaml/step-validator.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-validator.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,wBAAwB,CAAC"}

package/dist/src/yaml/step-validator.test.js

@@ -1,140 +0,0 @@
-/**
- * Unit tests for the pre-execution platform gate.
- *
- * A workflow's platform is established by its first platform-specific step,
- * and any later step of a different platform is refused. That rule is right
- * for an app that targets one platform and wrong for one that targets both:
- * a Kotlin Multiplatform build is *inherently* android-then-ios — gradle
- * assembles the XCFramework that `xcodebuild` then consumes — and there is no
- * way to split it, because a workflow is one dispatch on one machine and two
- * workflows share no filesystem.
- *
- * On 2026-09-01 that cost a real build: a generated KMM pipeline was refused
- * before a single step ran. These tests pin the narrow relaxation that fixes
- * it — permitted only where the pipeline *declares* a multiplatform app,
- * never inferred from the steps themselves.
- */
-import { describe, test, expect } from '@jest/globals';
-import '../yaml/steps/index.js';
-import { StepValidator } from './step-validator.js';
-import { PlatformDetectionError } from './platform-detector.js';
-import { loadConfig } from '../config.js';
-const config = loadConfig();
-/** What every curated template declares, and what the detector reads first. */
-const STACK = 'macos-xcode-26.4';
-/**
- * A KMM build in one workflow: gradle establishes android, xcodebuild follows.
- *
- * The stack is not decoration. `PlatformDetector` resolves the host OS from it
- * first and only falls back to reading the steps — where a mixed workflow
- * throws before this validator ever runs. Every curated template declares a
- * stack, so this is the gate a real pipeline actually meets.
- *
- * `getInvarnMeta` takes `meta.invarn` as a whole when it is present, so a test
- * about the legacy block has to omit `meta.invarn` entirely.
- */
-function kmmShapedPipeline({ invarn, legacy } = {}, { stack = true } = {}) {
-    const base = stack ? { stack: STACK } : {};
-    const meta = legacy && !invarn
-        ? { 'cibuild.io': { ...base, ...legacy } }
-        : {
-            invarn: { ...base, ...invarn },
-            ...(legacy ? { 'cibuild.io': { ...base, ...legacy } } : {}),
-        };
-    return {
-        format_version: '1',
-        meta,
-        workflows: {
-            primary: {
-                steps: [
-                    { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
-                    {
-                        'xcodebuild@1.0.0': {
-                            inputs: {
-                                project_path: 'iosApp/iosApp.xcodeproj',
-                                scheme: 'iosApp',
-                                destination: 'generic/platform=iOS Simulator',
-                            },
-                        },
-                    },
-                ],
-            },
-        },
-    };
-}
-async function platformIssues(pipeline) {
-    const validator = new StepValidator(pipeline, 'primary', config);
-    const result = await validator.validateWorkflow();
-    return (result.issuesByCategory.get('platform') ?? []).map((i) => i.requirement.name);
-}
-describe('StepValidator platform gate', () => {
-    test('refuses a mixed workflow that declares no app platform', async () => {
-        expect(await platformIssues(kmmShapedPipeline())).toEqual(['xcodebuild']);
-    });
-    test('permits a mixed workflow that declares a KMM app', async () => {
-        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'kmm' } }))).toEqual([]);
-    });
-    test('permits it through the legacy meta.cibuild.io block too', async () => {
-        expect(await platformIssues(kmmShapedPipeline({ legacy: { platform: 'kmm' } }))).toEqual([]);
-    });
-    // meta.invarn wins as a whole when both blocks are present, so a stale
-    // `kmm` under the legacy key must not grant permission the current block
-    // withholds.
-    test('lets meta.invarn withhold what a stale meta.cibuild.io granted', async () => {
-        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'android' }, legacy: { platform: 'kmm' } }))).toEqual(['xcodebuild']);
-    });
-    // The regression this relaxation could introduce. A declared platform, never
-    // inference: an ios step in a workflow that says it is android stays refused.
-    test('still refuses an ios step in a declared-android workflow', async () => {
-        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'android' } }))).toEqual([
-            'xcodebuild',
-        ]);
-    });
-    test('still refuses an android step in a declared-ios workflow', async () => {
-        const iosFirst = {
-            format_version: '1',
-            meta: { invarn: { stack: STACK, platform: 'ios' } },
-            workflows: {
-                primary: {
-                    steps: [
-                        { 'xcodebuild@1.0.0': { inputs: { project_path: 'App.xcodeproj', scheme: 'App' } } },
-                        { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
-                    ],
-                },
-            },
-        };
-        expect(await platformIssues(iosFirst)).toEqual(['gradle-build']);
-    });
-    // 'other' means the app type was not classified. An unclassified app has not
-    // declared that it spans platforms; silence is not permission.
-    test('still refuses when the declared platform is other', async () => {
-        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'other' } }))).toEqual([
-            'xcodebuild',
-        ]);
-    });
-    // The declaration is about mixing, not about skipping the gate: a
-    // single-platform workflow was never at risk either way.
-    test('leaves a single-platform workflow alone whatever it declares', async () => {
-        const androidOnly = {
-            format_version: '1',
-            meta: { invarn: { stack: STACK, platform: 'kmm' } },
-            workflows: {
-                primary: {
-                    steps: [
-                        { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
-                    ],
-                },
-            },
-        };
-        expect(await platformIssues(androidOnly)).toEqual([]);
-    });
-    // Declaring the app's platform does not tell the detector which host OS to
-    // ask for, and a mixed workflow cannot be read off its steps. That refusal
-    // is `PlatformDetector`'s and comes first — it is not relaxed here, and its
-    // own message already says what to add.
-    test('does not substitute for the stack a mixed workflow still needs', async () => {
-        const noStack = kmmShapedPipeline({ invarn: { platform: 'kmm' } }, { stack: false });
-        expect(() => new StepValidator(noStack, 'primary', config)).toThrow(PlatformDetectionError);
-    });
-});
-//# sourceMappingURL=step-validator.test.js.map

package/dist/src/yaml/steps/android-sign.d.ts

@@ -1,35 +0,0 @@
-/**
- * Android signing step: sign-apk
- */
-import { BaseStepExecutor } from './base.js';
-import type { StepDef, CIConfig } from '../../types.js';
-import type { ValidationRequirement, StepOutput } from '../validation-types.js';
-export interface SignApkInputs {
-    /** Path(s) to APK or AAB file(s), pipe-separated */
-    android_app?: string;
-    /** Keystore file URL or local path (file://...) */
-    keystore_url?: string;
-    /** Keystore password */
-    keystore_password?: string;
-    /** Key alias inside the keystore */
-    keystore_alias?: string;
-    /** Private key password (defaults to keystore_password) */
-    private_key_password?: string;
-    /** Page alignment for .so files: automatic | true | false */
-    page_align?: string;
-    /** Signing tool: automatic | apksigner | jarsigner */
-    signer_tool?: string;
-    /** Output artifact name (without extension) */
-    output_name?: string;
-    /** Enable verbose logging */
-    verbose_log?: boolean;
-}
-/**
- * Signs APK/AAB files using apksigner or jarsigner with zipalign.
- */
-export declare class SignApkStepExecutor extends BaseStepExecutor {
-    getValidationRequirements(inputs: SignApkInputs, env: Record<string, string>, _config: CIConfig): ValidationRequirement[];
-    getOutputs(): StepOutput[];
-    execute(inputs: SignApkInputs, _env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
-}
-//# sourceMappingURL=android-sign.d.ts.map

package/dist/src/yaml/steps/android-sign.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"android-sign.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android-sign.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,gBAAgB;IACvD,yBAAyB,CACvB,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA0IxG"}