@invarn/cibuild 2.9.6 → 2.9.8

package/dist/src/yaml/steps/fidelity-reference-provenance.d.ts

@@ -1,87 +0,0 @@
-/**
- * Reference-provenance assessment.
- *
- * A UI-fidelity reference is a PNG the gate cannot read, so reference validity
- * is asserted at export time as provenance metadata (`figmaNode`, `locale`,
- * `resolved`, `exportedAt`) and the gate checks that METADATA — never the
- * pixels, never via OCR.
- *
- * The assessment splits into two severities:
- *
- *  - FATAL faults → status `unverifiable` for the screen. A reference that is
- *    absent has nothing to judge against (`REFERENCE_ABSENT`); a screen with no
- *    provenance while the run declares a render locale keeps the legacy
- *    `NO_PROVENANCE` verdict (verifiable is earned only through the full
- *    export path, and it kills the ad-hoc-Figma-fetch root cause).
- *  - COPY-CHANNEL downgrades → the screen still renders and is judged on
- *    geometry, colors, typeface, spans, and lines; only copy comparisons are
- *    skipped, reported as a structured `copy_unverifiable` advisory naming the
- *    reason. Placeholder copy (`resolved == false`) and locale mismatches are
- *    normal customer reality — dynamic content is designed as placeholders —
- *    so the product adapts instead of refusing the screen or telling the
- *    customer to re-export.
- *
- * The check arms whenever per-screen provenance rides in params; a declared
- * render locale is only required for the locale comparison itself. Screens
- * with neither provenance nor a declared locale are unarmed and keep the
- * caller's legacy behaviour.
- *
- * Content differences (copy wording, geometry) are deliberately NOT evaluated
- * here — those are soft, judged findings that legitimately drift between
- * reference-export and gate-run.
- *
- * This module is the authoritative spec for the check. The Android render
- * runtime inlines an equivalent JS implementation (it ships as a self-contained
- * script string and cannot import this module); the render-step integration
- * tests exercise that inlined copy end-to-end against the same fixtures, so the
- * two cannot silently drift.
- */
-/** Export-time provenance as it travels in the run-input sidecar. */
-export interface ReferenceProvenanceMeta {
-    figmaNode?: string;
-    locale?: string;
-    resolved?: boolean;
-    exportedAt?: string;
-}
-/** A reason a reference cannot be honestly judged at all. */
-export interface ProvenanceFault {
-    /** Stable machine code (NO_PROVENANCE / REFERENCE_ABSENT). */
-    code: string;
-    /** Human/agent-readable reason, naming the screen. */
-    message: string;
-}
-/** Advisory code for a downgraded copy channel. */
-export declare const COPY_UNVERIFIABLE_CODE = "copy_unverifiable";
-/**
- * A copy-channel downgrade: the screen is judged normally except that copy
- * comparisons are unverifiable for the named reason.
- */
-export interface CopyChannelAdvisory {
-    code: typeof COPY_UNVERIFIABLE_CODE;
-    reason: 'unresolved_placeholders' | 'locale_mismatch';
-    /** Human/agent-readable reason, naming the screen. */
-    message: string;
-}
-/** The outcome of assessing one screen's reference provenance. */
-export interface ProvenanceAssessment {
-    /** Fatal: the screen cannot be judged (status `unverifiable`), or null. */
-    fault: ProvenanceFault | null;
-    /** Copy-channel downgrade riding in the per-screen result, or null. */
-    copyAdvisory: CopyChannelAdvisory | null;
-}
-/** The per-state status string written to protocol-result.json. */
-export declare const UNVERIFIABLE_STATUS = "unverifiable";
-/**
- * Whether provenance is "present" for arming purposes. A partial object (e.g.
- * a hand-dropped `{ figmaNode }`) is treated as no provenance — verifiable is
- * earned only through the full export path.
- */
-export declare function hasReferenceProvenance(p: ReferenceProvenanceMeta | null | undefined): p is ReferenceProvenanceMeta;
-/**
- * Assesses one screen's reference. Returns a fatal fault (screen
- * `unverifiable`), a copy-channel advisory (screen judged, copy skipped), or
- * neither. Never both: an absent reference wins over a downgrade because there
- * is nothing to judge against.
- */
-export declare function assessReferenceProvenance(screen: string, provenance: ReferenceProvenanceMeta | null | undefined, renderLocale: string | null, referenceExists: boolean): ProvenanceAssessment;
-//# sourceMappingURL=fidelity-reference-provenance.d.ts.map

package/dist/src/yaml/steps/fidelity-reference-provenance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fidelity-reference-provenance.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/fidelity-reference-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAAC;IACtD,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,uEAAuE;IACvE,YAAY,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC1C;AAED,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,GAC5C,CAAC,IAAI,uBAAuB,CAO9B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,EACtD,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,eAAe,EAAE,OAAO,GACvB,oBAAoB,CAqDtB"}

package/dist/src/yaml/steps/fidelity-reference-provenance.js

@@ -1,111 +0,0 @@
-/**
- * Reference-provenance assessment.
- *
- * A UI-fidelity reference is a PNG the gate cannot read, so reference validity
- * is asserted at export time as provenance metadata (`figmaNode`, `locale`,
- * `resolved`, `exportedAt`) and the gate checks that METADATA — never the
- * pixels, never via OCR.
- *
- * The assessment splits into two severities:
- *
- *  - FATAL faults → status `unverifiable` for the screen. A reference that is
- *    absent has nothing to judge against (`REFERENCE_ABSENT`); a screen with no
- *    provenance while the run declares a render locale keeps the legacy
- *    `NO_PROVENANCE` verdict (verifiable is earned only through the full
- *    export path, and it kills the ad-hoc-Figma-fetch root cause).
- *  - COPY-CHANNEL downgrades → the screen still renders and is judged on
- *    geometry, colors, typeface, spans, and lines; only copy comparisons are
- *    skipped, reported as a structured `copy_unverifiable` advisory naming the
- *    reason. Placeholder copy (`resolved == false`) and locale mismatches are
- *    normal customer reality — dynamic content is designed as placeholders —
- *    so the product adapts instead of refusing the screen or telling the
- *    customer to re-export.
- *
- * The check arms whenever per-screen provenance rides in params; a declared
- * render locale is only required for the locale comparison itself. Screens
- * with neither provenance nor a declared locale are unarmed and keep the
- * caller's legacy behaviour.
- *
- * Content differences (copy wording, geometry) are deliberately NOT evaluated
- * here — those are soft, judged findings that legitimately drift between
- * reference-export and gate-run.
- *
- * This module is the authoritative spec for the check. The Android render
- * runtime inlines an equivalent JS implementation (it ships as a self-contained
- * script string and cannot import this module); the render-step integration
- * tests exercise that inlined copy end-to-end against the same fixtures, so the
- * two cannot silently drift.
- */
-/** Advisory code for a downgraded copy channel. */
-export const COPY_UNVERIFIABLE_CODE = 'copy_unverifiable';
-/** The per-state status string written to protocol-result.json. */
-export const UNVERIFIABLE_STATUS = 'unverifiable';
-/**
- * Whether provenance is "present" for arming purposes. A partial object (e.g.
- * a hand-dropped `{ figmaNode }`) is treated as no provenance — verifiable is
- * earned only through the full export path.
- */
-export function hasReferenceProvenance(p) {
-    return (p != null &&
-        typeof p === 'object' &&
-        typeof p.locale === 'string' &&
-        typeof p.resolved === 'boolean');
-}
-/**
- * Assesses one screen's reference. Returns a fatal fault (screen
- * `unverifiable`), a copy-channel advisory (screen judged, copy skipped), or
- * neither. Never both: an absent reference wins over a downgrade because there
- * is nothing to judge against.
- */
-export function assessReferenceProvenance(screen, provenance, renderLocale, referenceExists) {
-    if (!hasReferenceProvenance(provenance)) {
-        if (renderLocale !== null) {
-            return {
-                fault: {
-                    code: 'NO_PROVENANCE',
-                    message: `reference for ${screen} has no export provenance; a reference is ` +
-                        `verifiable only when exported through the deterministic path`,
-                },
-                copyAdvisory: null,
-            };
-        }
-        // Unarmed: no provenance rode in and no locale was declared — the caller
-        // keeps its legacy behaviour (including its own reference-existence check).
-        return { fault: null, copyAdvisory: null };
-    }
-    if (!referenceExists) {
-        return {
-            fault: {
-                code: 'REFERENCE_ABSENT',
-                message: `reference image for ${screen} is absent`,
-            },
-            copyAdvisory: null,
-        };
-    }
-    if (provenance.resolved === false) {
-        return {
-            fault: null,
-            copyAdvisory: {
-                code: COPY_UNVERIFIABLE_CODE,
-                reason: 'unresolved_placeholders',
-                message: `reference for ${screen} carries unresolved copy placeholders ` +
-                    `(resolved=false); copy comparisons are skipped — geometry, color, ` +
-                    `typeface, span, and line judging still hold`,
-            },
-        };
-    }
-    if (renderLocale !== null && provenance.locale !== renderLocale) {
-        return {
-            fault: null,
-            copyAdvisory: {
-                code: COPY_UNVERIFIABLE_CODE,
-                reason: 'locale_mismatch',
-                message: `reference for ${screen} is locale "${provenance.locale}" but the ` +
-                    `render locale is "${renderLocale}"; copy comparisons are skipped — ` +
-                    `geometry, color, typeface, span, and line judging still hold`,
-            },
-        };
-    }
-    return { fault: null, copyAdvisory: null };
-}
-//# sourceMappingURL=fidelity-reference-provenance.js.map

package/dist/src/yaml/steps/fidelity-reference-provenance.test.d.ts

@@ -1,22 +0,0 @@
-/**
- * Unit tests for the reference-provenance assessment.
- *
- * A UI-fidelity reference is a PNG; the gate cannot read its text. So validity
- * is asserted at export time as provenance metadata, and the gate checks the
- * METADATA, never the pixels (no OCR).
- *
- * The assessment splits into two severities:
- *  - FATAL faults (reference absent; no provenance while a render locale is
- *    declared): the screen cannot be judged at all → status `unverifiable`.
- *  - COPY-CHANNEL downgrades (unresolved placeholders, locale mismatch): the
- *    screen renders and is judged on every non-copy channel; copy comparisons
- *    are skipped and reported as a `copy_unverifiable` advisory. Placeholder
- *    copy in a design is normal customer reality — the product adapts, the
- *    customer is never told to re-export.
- *
- * The check arms whenever provenance is present; a declared render locale is
- * only required for the locale comparison itself (and preserves the legacy
- * NO_PROVENANCE behaviour for unprovenanced screens).
- */
-export {};
-//# sourceMappingURL=fidelity-reference-provenance.test.d.ts.map

package/dist/src/yaml/steps/fidelity-reference-provenance.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fidelity-reference-provenance.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/fidelity-reference-provenance.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/src/yaml/steps/fidelity-reference-provenance.test.js

@@ -1,118 +0,0 @@
-/**
- * Unit tests for the reference-provenance assessment.
- *
- * A UI-fidelity reference is a PNG; the gate cannot read its text. So validity
- * is asserted at export time as provenance metadata, and the gate checks the
- * METADATA, never the pixels (no OCR).
- *
- * The assessment splits into two severities:
- *  - FATAL faults (reference absent; no provenance while a render locale is
- *    declared): the screen cannot be judged at all → status `unverifiable`.
- *  - COPY-CHANNEL downgrades (unresolved placeholders, locale mismatch): the
- *    screen renders and is judged on every non-copy channel; copy comparisons
- *    are skipped and reported as a `copy_unverifiable` advisory. Placeholder
- *    copy in a design is normal customer reality — the product adapts, the
- *    customer is never told to re-export.
- *
- * The check arms whenever provenance is present; a declared render locale is
- * only required for the locale comparison itself (and preserves the legacy
- * NO_PROVENANCE behaviour for unprovenanced screens).
- */
-import { describe, test, expect } from '@jest/globals';
-import { assessReferenceProvenance, hasReferenceProvenance, UNVERIFIABLE_STATUS, COPY_UNVERIFIABLE_CODE, } from './fidelity-reference-provenance.js';
-const GOOD = {
-    figmaNode: '12:345',
-    locale: 'en',
-    resolved: true,
-    exportedAt: '2026-06-18T10:00:00Z',
-};
-describe('assessReferenceProvenance', () => {
-    test('a present, provenanced, resolved, locale-matching reference is clean', () => {
-        expect(assessReferenceProvenance('Guest', GOOD, 'en', true)).toEqual({
-            fault: null,
-            copyAdvisory: null,
-        });
-    });
-    test('provenance present without a declared render locale is clean too', () => {
-        expect(assessReferenceProvenance('Guest', GOOD, null, true)).toEqual({
-            fault: null,
-            copyAdvisory: null,
-        });
-    });
-    test('an absent reference with provenance is FATAL (REFERENCE_ABSENT), locale or not', () => {
-        expect(assessReferenceProvenance('Guest', GOOD, 'en', false).fault?.code).toBe('REFERENCE_ABSENT');
-        expect(assessReferenceProvenance('Guest', GOOD, null, false).fault?.code).toBe('REFERENCE_ABSENT');
-    });
-    test('unresolved placeholders downgrade the copy channel — never the screen', () => {
-        const assessment = assessReferenceProvenance('Guest', { ...GOOD, resolved: false }, 'en', true);
-        expect(assessment.fault).toBeNull();
-        expect(assessment.copyAdvisory?.code).toBe(COPY_UNVERIFIABLE_CODE);
-        expect(assessment.copyAdvisory?.reason).toBe('unresolved_placeholders');
-    });
-    test('unresolved placeholders downgrade identically without a render locale', () => {
-        // Live evidence: the same resolved:false reference must earn the same
-        // verdict whether or not the run declared render_locale.
-        const assessment = assessReferenceProvenance('Guest', { ...GOOD, resolved: false }, null, true);
-        expect(assessment.fault).toBeNull();
-        expect(assessment.copyAdvisory?.reason).toBe('unresolved_placeholders');
-    });
-    test('a wrong-locale reference downgrades the copy channel (LOCALE reason)', () => {
-        // Italian reference vs an English render.
-        const assessment = assessReferenceProvenance('Guest', { ...GOOD, locale: 'it' }, 'en', true);
-        expect(assessment.fault).toBeNull();
-        expect(assessment.copyAdvisory?.code).toBe(COPY_UNVERIFIABLE_CODE);
-        expect(assessment.copyAdvisory?.reason).toBe('locale_mismatch');
-    });
-    test('locale comparison requires a declared render locale — its absence skips only that', () => {
-        const assessment = assessReferenceProvenance('Guest', { ...GOOD, locale: 'it' }, null, true);
-        expect(assessment).toEqual({ fault: null, copyAdvisory: null });
-    });
-    test('an absent reference wins over a copy downgrade (nothing to judge against)', () => {
-        const assessment = assessReferenceProvenance('Guest', { ...GOOD, resolved: false }, 'en', false);
-        expect(assessment.fault?.code).toBe('REFERENCE_ABSENT');
-        expect(assessment.copyAdvisory).toBeNull();
-    });
-    test('no provenance with a declared render locale stays FATAL (NO_PROVENANCE, legacy arming)', () => {
-        expect(assessReferenceProvenance('Guest', null, 'en', true).fault?.code).toBe('NO_PROVENANCE');
-        expect(assessReferenceProvenance('Guest', undefined, 'en', true).fault?.code).toBe('NO_PROVENANCE');
-    });
-    test('incomplete provenance (missing locale/resolved) is treated as no provenance', () => {
-        expect(assessReferenceProvenance('Guest', { figmaNode: 'x', exportedAt: 'y' }, 'en', true).fault
-            ?.code).toBe('NO_PROVENANCE');
-    });
-    test('no provenance and no render locale is unarmed — the caller keeps legacy behaviour', () => {
-        expect(assessReferenceProvenance('Guest', null, null, false)).toEqual({
-            fault: null,
-            copyAdvisory: null,
-        });
-        expect(assessReferenceProvenance('Guest', null, null, true)).toEqual({
-            fault: null,
-            copyAdvisory: null,
-        });
-    });
-    test('faults and advisories carry the screen name and a human reason', () => {
-        const fatal = assessReferenceProvenance('LoggedIn', GOOD, 'en', false);
-        expect(fatal.fault?.message).toContain('LoggedIn');
-        const downgraded = assessReferenceProvenance('LoggedIn', { ...GOOD, resolved: false }, 'en', true);
-        expect(downgraded.copyAdvisory?.message).toContain('LoggedIn');
-        expect(downgraded.copyAdvisory.message.length).toBeGreaterThan(10);
-    });
-    test('the downgrade message never tells the customer to fix their design', () => {
-        const assessment = assessReferenceProvenance('Guest', { ...GOOD, resolved: false }, 'en', true);
-        expect(assessment.copyAdvisory?.message.toLowerCase()).not.toContain('export it');
-    });
-});
-describe('hasReferenceProvenance', () => {
-    test('full export-path provenance is present; partial or missing is not', () => {
-        expect(hasReferenceProvenance(GOOD)).toBe(true);
-        expect(hasReferenceProvenance(null)).toBe(false);
-        expect(hasReferenceProvenance(undefined)).toBe(false);
-        expect(hasReferenceProvenance({ figmaNode: 'x' })).toBe(false);
-    });
-});
-describe('status strings', () => {
-    test('exposes the unverifiable status string the result document uses', () => {
-        expect(UNVERIFIABLE_STATUS).toBe('unverifiable');
-    });
-});
-//# sourceMappingURL=fidelity-reference-provenance.test.js.map

package/dist/src/yaml/steps/file.d.ts

@@ -1,52 +0,0 @@
-import { BaseStepExecutor } from './base.js';
-import type { StepDef, CIConfig } from '../../types.js';
-/**
- * A credential the pipeline declares, the build reads, and nobody supplied.
- *
- * Thrown at generation time, from the step that would have written the file,
- * so the build stops before its own build tool fails for a reason that names
- * the project instead of the value we dropped. Generation time is also the
- * only place `is_skippable` cannot swallow it: the converter sets that flag on
- * a StepDef *after* `execute()` returns, so a step which merely exited
- * non-zero would be reported as "failed but marked skippable — continuing".
- */
-export declare class MissingFileSecretError extends Error {
-    readonly varName: string;
-    readonly targetPath: string;
-    constructor(varName: string, targetPath: string);
-}
-export interface FileInputs {
-    /** Path where the file should be written, relative to the project root. */
-    target_path: string;
-    /** Name of the env var that holds the file content (resolved from secrets). */
-    var_name: string;
-    /**
-     * When true, the secret value is already base64-encoded binary (e.g. KEYSTORE_BASE64).
-     * The content is embedded as-is without re-encoding, so the runtime script decodes
-     * it once with `base64 -d` to recover the original binary.
-     */
-    base64_encoded?: boolean;
-}
-/**
- * Writes a file to a target path at runtime.
- *
- * The file content is stored in .cibuild-secrets.json and loaded by EnvResolver
- * into the `env` map before execute() is called.  We base64-encode the value
- * and embed it into the generated script, then decode at runtime with `base64 -d`.
- * Base64 output contains only [A-Za-z0-9+/=] so it is safe to embed in any shell
- * quoting context regardless of the original content (JSON, certificates, etc.).
- */
-export declare class FileStepExecutor extends BaseStepExecutor {
-    execute(inputs: FileInputs, env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
-    /**
-     * Whether the build will find the file at `target_path` without this step.
-     *
-     * Asked at generation time, which is when the step decides, and answerable
-     * because generation happens inside the checkout — on the host path locally
-     * and on the sandbox path inside the guest. The path is composed exactly the
-     * way the generated script composes the one it writes to, so the two cannot
-     * disagree about which file is in question.
-     */
-    private fileAlreadyInCheckout;
-}
-//# sourceMappingURL=file.d.ts.map

package/dist/src/yaml/steps/file.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAyBhD;AAED,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,gBAAgB;IAC9C,OAAO,CACX,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;IAiDnB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAI9B"}

package/dist/src/yaml/steps/file.js

@@ -1,108 +0,0 @@
-import { existsSync } from 'node:fs';
-import { basename, join } from 'node:path';
-import { BaseStepExecutor } from './base.js';
-/**
- * A credential the pipeline declares, the build reads, and nobody supplied.
- *
- * Thrown at generation time, from the step that would have written the file,
- * so the build stops before its own build tool fails for a reason that names
- * the project instead of the value we dropped. Generation time is also the
- * only place `is_skippable` cannot swallow it: the converter sets that flag on
- * a StepDef *after* `execute()` returns, so a step which merely exited
- * non-zero would be reported as "failed but marked skippable — continuing".
- */
-export class MissingFileSecretError extends Error {
-    varName;
-    targetPath;
-    constructor(varName, targetPath) {
-        super(`file@1.0.0 cannot write ${targetPath}: ${varName} is declared in this ` +
-            `pipeline but no value reached the build.\n` +
-            `\n` +
-            `A slot declared and left empty means the value arrives as a secret. ` +
-            `None did:\n` +
-            `not the pipeline itself, not .cibuild-secrets.json, and not this ` +
-            `build's environment.\n` +
-            `\n` +
-            `Supply it in one of two places:\n` +
-            `\n` +
-            `  locally        ci secrets add ${varName}\n` +
-            `  remote build   add ${varName} as an organization or pipeline ` +
-            `secret, then\n` +
-            `                 run the build again\n` +
-            `\n` +
-            `If ${basename(targetPath)} belongs to the repository instead, commit ` +
-            `it at\n` +
-            `${targetPath} — a file already in the checkout is used as it is.`);
-        this.name = 'MissingFileSecretError';
-        this.varName = varName;
-        this.targetPath = targetPath;
-    }
-}
-/**
- * Writes a file to a target path at runtime.
- *
- * The file content is stored in .cibuild-secrets.json and loaded by EnvResolver
- * into the `env` map before execute() is called.  We base64-encode the value
- * and embed it into the generated script, then decode at runtime with `base64 -d`.
- * Base64 output contains only [A-Za-z0-9+/=] so it is safe to embed in any shell
- * quoting context regardless of the original content (JSON, certificates, etc.).
- */
-export class FileStepExecutor extends BaseStepExecutor {
-    async execute(inputs, env, _config) {
-        const targetPath = this.getRequiredInput(inputs, 'target_path', 'file');
-        const varName = this.getRequiredInput(inputs, 'var_name', 'file');
-        const filename = basename(targetPath);
-        const content = env[varName];
-        if (!content) {
-            // Two absences, and they mean opposite things. A `var_name` nothing
-            // declares is a genuinely optional credential — a release keystore on a
-            // debug workflow — and skipping it is correct. A `var_name` the pipeline
-            // declares and leaves empty is a value that was supposed to arrive as a
-            // secret and did not: after issue 01 it is in none of the four places a
-            // value can come from, so the build is guaranteed red later, for a
-            // reason nothing in the log connects to this step. `mergeEnvVars` puts a
-            // declared key in the map even when its value is the empty placeholder,
-            // and nothing else puts a key there, so presence is the whole test.
-            //
-            // Except when the repository already carries the file. The Android
-            // generator declares KEYSTORE_BASE64 once, globally, but emits its
-            // `file@` step on every workflow including `pull-request`, where nothing
-            // signs anything — so "declared and empty" alone would refuse builds
-            // that are green today and rightly so. The question worth asking is the
-            // one the build will ask: will the file be there when it is read?
-            if (varName in env && !this.fileAlreadyInCheckout(targetPath, env)) {
-                throw new MissingFileSecretError(varName, targetPath);
-            }
-            const reason = varName in env
-                ? `${filename} is already in the checkout, using it`
-                : `skipping ${filename}`;
-            return this.createScriptStep(`echo "⚠️  ${varName} not set — ${reason}"`, 'file');
-        }
-        // Base64-encode the content so it can be embedded safely in the script
-        // regardless of quotes, newlines, dollar signs, or any other special characters.
-        // base64 output contains only [A-Za-z0-9+/=] which is safe in any shell context.
-        // When base64_encoded is true the secret is already base64 binary — skip re-encoding.
-        const encoded = inputs.base64_encoded
-            ? content
-            : Buffer.from(content).toString('base64');
-        const scriptContent = `\
-mkdir -p "$(dirname "\${CIBUILD_SOURCE_DIR:-$PWD}/${targetPath}")"
-printf '%s' '${encoded}' | base64 -d > "\${CIBUILD_SOURCE_DIR:-$PWD}/${targetPath}"
-echo "✓ Written ${filename}"`;
-        return this.createScriptStep(this.createBashScript(scriptContent, 'file'), 'file');
-    }
-    /**
-     * Whether the build will find the file at `target_path` without this step.
-     *
-     * Asked at generation time, which is when the step decides, and answerable
-     * because generation happens inside the checkout — on the host path locally
-     * and on the sandbox path inside the guest. The path is composed exactly the
-     * way the generated script composes the one it writes to, so the two cannot
-     * disagree about which file is in question.
-     */
-    fileAlreadyInCheckout(targetPath, env) {
-        const sourceDir = env.CIBUILD_SOURCE_DIR || process.cwd();
-        return existsSync(join(sourceDir, targetPath));
-    }
-}
-//# sourceMappingURL=file.js.map

package/dist/src/yaml/steps/flutter.d.ts

@@ -1,63 +0,0 @@
-/**
- * Flutter steps: flutter-installer, flutter-build, flutter-test
- */
-import { BaseStepExecutor } from './base.js';
-import type { StepDef, CIConfig } from '../../types.js';
-import type { ValidationRequirement, StepOutput } from '../validation-types.js';
-export interface FlutterInstallerInputs {
-    /** Flutter SDK version or channel (stable, beta, master, or specific version) */
-    version?: string;
-    /** Installation path for the Flutter SDK */
-    installation_path?: string;
-}
-/**
- * Installs or activates a specific Flutter SDK version.
- */
-export declare class FlutterInstallerStepExecutor extends BaseStepExecutor {
-    getValidationRequirements(_inputs: FlutterInstallerInputs, _env: Record<string, string>, _config: CIConfig): ValidationRequirement[];
-    getOutputs(): StepOutput[];
-    execute(inputs: FlutterInstallerInputs, _env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
-}
-export interface FlutterBuildInputs {
-    /** Root directory of the Flutter project */
-    project_location?: string;
-    /** Platform to build: ios | android | both */
-    platform?: string;
-    /** Additional flutter build parameters */
-    additional_build_params?: string;
-    /** iOS output type: app | archive */
-    ios_output_type?: string;
-    /** Android output type: apk | appbundle */
-    android_output_type?: string;
-    /** Additional iOS build params */
-    ios_additional_params?: string;
-    /** Additional Android build params */
-    android_additional_params?: string;
-    /** Enable debug mode (true/false) */
-    is_debug_mode?: string;
-}
-/**
- * Builds a Flutter project for iOS and/or Android.
- */
-export declare class FlutterBuildStepExecutor extends BaseStepExecutor {
-    getValidationRequirements(_inputs: FlutterBuildInputs, _env: Record<string, string>, _config: CIConfig): ValidationRequirement[];
-    getOutputs(): StepOutput[];
-    execute(inputs: FlutterBuildInputs, _env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
-}
-export interface FlutterTestInputs {
-    /** Root directory of the Flutter project */
-    project_location?: string;
-    /** Additional flutter test parameters */
-    additional_params?: string;
-    /** Enable coverage collection (true/false) */
-    generate_code_coverage_files?: string;
-}
-/**
- * Runs flutter test with optional coverage.
- */
-export declare class FlutterTestStepExecutor extends BaseStepExecutor {
-    getValidationRequirements(_inputs: FlutterTestInputs, _env: Record<string, string>, _config: CIConfig): ValidationRequirement[];
-    getOutputs(): StepOutput[];
-    execute(inputs: FlutterTestInputs, _env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
-}
-//# sourceMappingURL=flutter.d.ts.map

package/dist/src/yaml/steps/flutter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"flutter.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/flutter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAI1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA2DjH;AAMD,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qCAAqC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2CAA2C;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sCAAsC;IACtC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,qCAAqC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,yBAAyB,CACvB,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAQpB,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyF7G;AAMD,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAgD5G"}